Q: How do I get rid of adware?

The Safe Mac » Adware Removal Guide

Helpful Links Regarding Malware Protection

An excellent link to read is Tom Reed's Mac Malware Guide.

Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.

See these Apple articles:

  Mac OS X Snow Leopard and malware detection

  OS X Lion- Protect your Mac from malware

  OS X Mountain Lion- Protect your Mac from malware

            OS X Mavericks- Protect your Mac from malware

  About file quarantine in OS X

If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.)

From user Joe Bailey comes this equally useful advice:

The facts are:

1. There is no anti-malware software that can detect 100% of the malware out there.

2. There is no anti-malware that can detect anything targeting the Mac because there

     is no Mac malware in the wild, and therefore, no "signatures" to detect.

3. The very best way to prevent the most attacks is for you as the user to be aware that

     the most successful malware attacks rely on very sophisticated social engineering

     techniques preying on human avarice, ****, and fear.

4. Internet popups saying the FBI, NSA, Microsoft, your ISP has detected malware on

    your computer is intended to entice you to install their malware thinking it is a

    protection against malware.

5. Some of the anti-malware products on the market are worse than the malware

    from which they purport to protect you.

6. Be cautious where you go on the internet.

7. Only download anything from sites you know are safe.

8. Avoid links you receive in email, always be suspicious even if you get something

    you think is from a friend, but you were not expecting.

9. If there is any question in your mind, then assume it is malware.

Please don't download CleanUpMyMac2, it will do more harm than good and I don't know that it has any capability to remove adware.

Your best bet is to download and run TheSafeMac's Adware Removal Tool mentioned in the links Kappy has given you. It removes all currently known malware and is updated every time something new is discovered.

Adware is fairly simple to get rid of but since it's always changing, there is no single eradication method guaranteed to work in all cases and for all time. No reliable, automated means of preventing its installation exists. The best defense against installing adware or anything else unwanted is to avoid downloading software from untrustworthy sources, of which are countless examples.

To learn how to recognize those sources and prevent inadvertent installation of adware read How to install adware. It presents one common example that appears to have recently affected a large number of people. Just bear that limitation in mind.

You don't need to download anything.

Please post a screenshot that shows what you mean. Be careful not to include any private information.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

mazamr wrote:

 

I would really rather not download anything

Then just follow the instructions he gives for manually removing all the various adware files you have installed.

From the Safari menu bar, select

          Safari ▹ Preferences... ▹ Extensions

Turn all extensions OFF and test. If the problem is resolved, turn extensions back ON and then disable them one or a few at a time until you find the culprit.

Be sure to let us know the name of the extension which caused the adware as there can be additional files associated with many of them that will also need removal.

Thomas Reed has made it a personal mission to fight adware. His removal tool is completely safe.

I would really rather not download anything

I haven't tested the script that you are being urged to run, and I don't know what it does.

My opinion is that, when you've already gotten in trouble by downloading something unknown at the behest of a stranger on the Internet, to download another unknown thing at the behest of another stranger is not a move in the right direction. The right direction is to stop downloading unknown things and start protecting yourself by using the computer safely.

Even if the script works, which it might for all I know, you would be getting very much the wrong idea if you think there will always be a deus ex machina fix for malware attacks. There won't be.

I suggest the tedious procedure below to disable Genieo, if that's what it is. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.)

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.

Step 1

In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent. If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state.

There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer.

This step does not completely inactivate Genieo.

Step 2

Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions.

Triple-click anywhere in the line below on this page to select it:

/Library/Frameworks/GenieoExtra.framework

Right-click or control-click the line and select

          Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password.

Move each of these items to the Trash in the same way:

/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
~/Library/Application Support/com.genieoinnovation.Installer
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist

If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

Restart and empty the Trash. Don't try to empty the Trash until you have restarted.

Step 3

From the Safari menu bar, select

          Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results.

Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If youever download a file that isn't obviously what you expected, delete it immediately.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

Finally, be forewarned that when Genieo is mentioned on this site, the criminal perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to download a fake "uninstaller." As he knows and intends, the uninstaller does not completely remove the malware, and is in fact malware itself.