remove installmac - Apple Community

Level 7

31,989 points

Oct 20, 2014 4:08 PM in response to Ron_can

Ron_can wrote:

The installmac icon is still on the Google menu bar.

Yes, because it's not gone. All you have done is removed some symptoms, but the cancer is still there. Genieo (aka InstallMac) is bad news, and it's got to go. You do not want their software running on your system, even if you're not having any serious symptoms anymore.

You never clarified how AdwareMedic didn't work. It should remove this adware for you. If it didn't work, I'd like to help figure out why and correct that.

Reply

Ron_can

Level 1

4 points

Oct 20, 2014 5:14 PM in response to thomas_r.

O.K., when Adware Medic finished it's routine, everything was just as it

was before acuating it. The process was repeated with the same result,

three times. Dead parrot.

On Monday, October 20, 2014, Apple Support Communities Updates <

Reply

thomas_r.

Level 7

31,989 points

Oct 20, 2014 6:55 PM in response to Ron_can

Ron_can wrote:

O.K., when Adware Medic finished it's routine, everything was just as it

was before acuating it.

Did it detect any adware, or not detect anything (ie, say that no adware was found)? If it detected adware, did you click the button to remove that adware, or just close the window showing what was detected?

Reply

Ron_can

Level 1

4 points

Oct 20, 2014 7:50 PM in response to thomas_r.

It said nothing. Sort of like Sargent Schultz. It just quit, with no

feedback at all.

On Monday, October 20, 2014, Apple Support Communities Updates <

Reply

Kurt Lang

Level 9

58,308 points

Oct 20, 2014 8:56 PM in response to Ron_can

It's possible the writers of this garbage have released a new variant that detects any attempt to disable itself and instead attempts to and/or succeeds in shutting down the detection software. So try this. Restart and hold down the Shift key to boot into Safe Mode. The OS only allows specific startup functions to load and run while in Safe Mode. Run Adware Medic.

Reply

thomas_r.

Level 7

31,989 points

Oct 21, 2014 4:29 AM in response to Ron_can

Do you mean that it quit all by itself, with no message at all? If so, at what point did that happen?

I feel a bit like I'm pulling teeth here, so if you'd rather not discuss this any further, please let me know and I'll stop pestering you.

Reply

Linc Davis

Level 10

209,547 points

Oct 21, 2014 9:26 AM in response to Ron_can

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of the script have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

5. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*genieo\* \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^$[0-9]+$ /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\$[0-9]+\$\$.+\$/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p);if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|(Bo|PO).+ sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test osascript\ -e );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'|tr , \\\n" 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. $ -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|corru|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA$|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:| VALI|xpma' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true $ -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '/S*/*/Ca*/*xpc* >&- ||echo No' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,Ex}* {/,}L*/{A*d,Ca*/*/Ex,Co{mpon,reM},Ex,In{p,ter},iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -path \\*s/Resources -prune -o -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents XPC\ cache Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "${s[63]}"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 35 49 61 51;D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 62 42;D12 34 43 53 44;D12 22 20 32 25;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 37 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

Copy the selected text to the Clipboard by pressing the key combination command-C.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

[Process completed]

to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report what happened. No harm will be done.

12. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

______________________________________________________________

Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Ron_can

Level 1

4 points

Oct 21, 2014 2:58 PM in response to thomas_r.

Thomas, pull away. I would like to get it completely out of my Mac but I'm delayed in responding/replying because of other busy-ness. Adware Medic just went through a routine and stopped being there, no explanation, not dialog box, just stopped. That's why I put it through its routine three times. I kept the app figuring if I made progress on any other path that I'd try it again, also being patient with it since it seems to be a work in progress.

Reply

Ron_can

Level 1

4 points

Oct 21, 2014 3:10 PM in response to Linc Davis

Linc -

Thank you for your attention to my problem - I hope more than myself can benefit from this discussion. I will run the test, hopefully tomorrow when I will have a block of time that I can devote to the problem.

Re: Trust -

I have seen your posts on this forum for some time now and never seen any rants about your not being trustworthy. And, as you say it's Apple's place and I do have to trust at some point that good information and good intentions will prevail. I consider anyone who troubles themselves as you do (if not employed by Apple) to have a head start on sainthood.

A comment on using Apple support when you see that you might be charged $19.00 for phone help: One can plug along trying to figure something out because of having previously been lucky, but when time runs along and is thought of in terms of what it's worth, the $19.00 is a bargain. I try to keep that in mind, but I give the problem a try and suddenly realize I've lost hours wrestling with something with which I have absolutely no expertise.

Thanks again.

Reply

Linc Davis

Level 10

209,547 points

Oct 21, 2014 7:18 PM in response to Ron_can

Apple Support will not help you with this kind of problem, except to the extent of telling you to erase the startup volume. That will certainly get rid of any malware. The trouble is, what do you restore?

Reply

Ron_can

Level 1

4 points

Oct 22, 2014 4:20 AM in response to Linc Davis

Start time: 07:14:28 10/22/14

Model Identifier: iMac11,2

System Version: OS X 10.9.5 (13F34)

Kernel Version: Darwin 13.4.0

Time since boot: 48 minutes

SATA

WDC WD1001FALS-40Y6A0

FireWire

LaCie Hard Drive FireWire+ (LaCie Group SA)

boot args: 0x0

FileVault: FileVault master keychain appears to be installed

Diagnostic reports

2014-10-04 hidd crash

2014-10-10 UserEventAgent crash

2014-10-20 Finder hang

2014-10-21 AdobeResourceSynchronizer crash

2014-10-21 gutenprint.5.2 crash

Log

Oct 16 10:54:40 IOHIDSystem: Seize of IOHIDPointing failed.

Oct 16 10:54:40 IOHIDSystem: Seize of AppleMultitouchHIDEventDriver failed.

Oct 20 06:20:51 ALF: ifnet_get_address_list_family error 12

Oct 20 09:38:18 process installd[389] thread 106977 caught burning CPU! It used more than 50% CPU (Actual recent usage: 97%) over 180 seconds. thread lifetime cpu usage 90.030125 seconds, (89.494779 user, 0.535346 system) ledger info: balance: 90008213511 credit: 90008213511 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 91870941600

Oct 20 09:42:49 Can't load kext com.apple.kext.AMD7000Controller - failed to resolve library dependencies.

Oct 20 09:42:49 Kext com.apple.kext.AMD7000Controller failed to load (0xdc00800e).

Oct 20 09:42:49 Failed to load kext com.apple.kext.AMD7000Controller (error 0xdc00800e).

Oct 20 09:46:15 Process Setup Assistant [178] disabling system-wide I/O Throttling

Oct 20 09:46:15 Process Setup Assistant [178] disabling system-wide CPU Throttling

Oct 20 15:16:20 IOHIDSystem: Seize of AppleMultitouchHIDEventDriver failed.

Oct 20 15:16:20 IOHIDSystem: Seize of IOHIDPointing failed.

Oct 21 07:03:27 process Install[478] caught causing excessive wakeups. Observed wakeups rate (per sec): 1390; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45010

Oct 21 07:03:52 process Creative Cloud[451] caught causing excessive wakeups. Observed wakeups rate (per sec): 493; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45034

Oct 21 07:08:32 process Creative Cloud[705] caught causing excessive wakeups. Observed wakeups rate (per sec): 224; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45001

kexts

com.apple.AppleFSCompression.AppleFSCompressionTypeLZVN (1.0.0d1)

com.apple.AMDRadeonX3000 (1.2.4)

Daemons

org.postfix.master

org.ntp.ntpd

org.cups.cupsd

com.vix.cron

com.sonos.SmbBump

com.microsoft.office.licensing.helper

com.google.keystone.daemon

Agents

com.google.GoogleTalkPluginD.74656.UUID

com.adobe.PDApp.AAMUpdatesNotifier.39104.UUID

com.evernote.EvernoteHelper

com.google.keystone.system.agent

com.adobe.AdobeCreativeCloud

com.akamai.single-user-client

com.adobe.ARM.UUID

Bundles

/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle

- com.apple.SecurityAgentPlugin.HomeDirMechanism

/System/Library/CoreServices/SecurityAgentPlugins/KerberosAgent.bundle

- com.apple.KerberosAgent

/System/Library/CoreServices/SecurityAgentPlugins/loginwindow.bundle

- com.apple.securityAgentPlugins.loginwindowUI

/System/Library/CoreServices/SecurityAgentPlugins/MCXMechanism.bundle

- com.apple.securityAgentPlugin.MCXMechanism

/System/Library/CoreServices/SecurityAgentPlugins/PKINITMechanism.bundle

- com.apple.PKINITMechanism

/System/Library/CoreServices/SecurityAgentPlugins/RestartAuthorization.bundle

- com.apple.securityAgentPlugin.RestartAuthorization

/System/Library/Extensions/AMDRadeonVADriver.bundle

- N/A

/System/Library/Extensions/AMDRadeonX3000.kext

- com.apple.AMDRadeonX3000

/System/Library/Extensions/AMDRadeonX3000GLDriver.bundle

- com.apple.AMDRadeonX3000GLDriver

/System/Library/Extensions/AMDRadeonX4000.kext

- com.apple.AMDRadeonX4000

/System/Library/Extensions/AMDRadeonX4000GLDriver.bundle

- com.apple.AMDRadeonX4000GLDriver

/System/Library/Extensions/AppleFSCompressionTypeLZVN.kext

- com.apple.AppleFSCompression.AppleFSCompressionTypeLZVN

/System/Library/Extensions/AppleIntelHD3000Graphics.kext

- com.apple.driver.AppleIntelHD3000Graphics

/System/Library/Extensions/AppleIntelHD3000GraphicsGA.plugin

- com.apple.driver.AppleIntelHD3000GraphicsGA

/System/Library/Extensions/AppleIntelHD3000GraphicsGLDriver.bundle

- com.apple.driver.AppleIntelHD3000GraphicsGLDriver

/System/Library/Extensions/AppleIntelHD3000GraphicsVADriver.bundle

- com.apple.AppleIntelHD3000GraphicsVADriver

/System/Library/Extensions/AppleIntelHD4000Graphics.kext

- com.apple.driver.AppleIntelHD4000Graphics

/System/Library/Extensions/AppleIntelHD4000GraphicsGLDriver.bundle

- com.apple.driver.AppleIntelHD4000GraphicsGLDriver

/System/Library/Extensions/AppleIntelHD4000GraphicsVADriver.bundle

- com.apple.AppleIntelHD4000GraphicsVADriver

/System/Library/Extensions/AppleIntelHD5000Graphics.kext

- com.apple.driver.AppleIntelHD5000Graphics

/System/Library/Extensions/AppleIntelHD5000GraphicsGLDriver.bundle

- com.apple.driver.AppleIntelHD5000GraphicsGLDriver

/System/Library/Extensions/AppleIntelHD5000GraphicsVADriver.bundle

- com.apple.AppleIntelHD5000GraphicsVADriver

/System/Library/Extensions/AppleIntelHDGraphicsGLDriver.bundle

- com.apple.driver.AppleIntelHDGraphicsGLDriver

/System/Library/Extensions/AppleIntelHSWVA.bundle

- com.apple.AppleIntelHSWFBVA

/System/Library/Extensions/AppleIntelIVBVA.bundle

- com.apple.AppleIntelIVBFBVA

/System/Library/Extensions/AppleIntelMCEReporter.kext

- com.apple.driver.AppleIntelMCEReporter

/System/Library/Extensions/ATIRadeonX2000.kext

- com.apple.ATIRadeonX2000

/System/Library/Extensions/ATIRadeonX2000GA.plugin

- com.apple.ATIRadeonX2000GA

/System/Library/Extensions/ATIRadeonX2000GLDriver.bundle

- com.apple.ATIRadeonX2000GLDriver

/System/Library/Extensions/ATIRadeonX2000VADriver.bundle

- com.apple.ATIRadeonX2000VADriver

/System/Library/Extensions/GeForce.kext

- com.apple.GeForce

/System/Library/Extensions/GeForceGA.plugin

- com.apple.GeForceGA

/System/Library/Extensions/GeForceGLDriver.bundle

- com.apple.GeForceGLDriver

/System/Library/Extensions/GeForceTesla.kext

- com.apple.GeForceTesla

/System/Library/Extensions/GeForceTeslaGLDriver.bundle

- com.apple.GeForceTeslaGLDriver

/System/Library/Extensions/GeForceTeslaVADriver.bundle

- com.apple.GeForceTeslaVADriver

/System/Library/Extensions/GeForceVADriver.bundle

- com.apple.GeForceVADriver

/System/Library/Extensions/hp_designjet_series.kext

- com.hp.print.hpio.Designjet.kext

/System/Library/Extensions/hp_Deskjet_io_enabler.kext

- com.hp.print.hpio.Deskjet.kext

/System/Library/Extensions/hp_Inkjet1_io_enabler.kext

- com.hp.print.hpio.Inkjet1.kext

/System/Library/Extensions/hp_Inkjet2_io_enabler.kext

- com.hp.print.hpio.Inkjet2.kext

/System/Library/Extensions/hp_Inkjet3_io_enabler.kext

- com.hp.print.hpio.Inkjet3.kext

/System/Library/Extensions/hp_Inkjet4_io_enabler.kext

- com.hp.print.hpio.Inkjet4.kext

/System/Library/Extensions/hp_Inkjet5_io_enabler.kext

- com.hp.print.hpio.Inkjet5.kext

/System/Library/Extensions/hp_Inkjet7_io_enabler.kext

- com.hp.print.hpio.inkjet7.kext

/System/Library/Extensions/hp_Inkjet8_io_enabler.kext

- com.hp.print.hpio.inkjet8.kext

/System/Library/Extensions/hp_Inkjet_io_enabler.kext

- com.hp.print.hpio.Inkjet.kext

/System/Library/Extensions/hp_io_printerclassdriver_enabler.kext

- com.hp.hpio.hp_io_printerclassdriver_enabler

/System/Library/Extensions/hp_Laserjet_io_enabler.kext

- com.hp.print.hpio.Laserjet.kext

/System/Library/Extensions/hp_Officejet_io_enabler.kext

- com.hp.print.hpio.Officejet.kext

/System/Library/Extensions/hp_Photosmart_io_enabler.kext

- com.hp.print.hpio.Photosmart.kext

/System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext

- com.hp.print.hpio.PhotosmartPro.kext

/System/Library/Extensions/hp_psa640_io_enabler.kext

- com.hp.hpio.hp_psa640_io_enabler

/System/Library/Extensions/hp_qc_io_enabler.kext

- com.hp.hpio.hp_psa530_630_io_enabler

/System/Library/Extensions/LexmarkUSBMerge.kext

- com.lexmark.print.usbmerge

/Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component

- net.telestream.wmv.import

/Library/Audio/Plug-Ins/HAL/AirPlay.driver

- com.apple.audio.AirTunesHALPlugin

/Library/Audio/Plug-Ins/HAL/AppleAVBAudio.driver

- com.apple.audio.AppleAVBAudio

/Library/Audio/Plug-Ins/HAL/BluetoothAudioPlugIn.driver

- com.apple.audio.BluetoothAudioPlugIn

/Library/Audio/Plug-Ins/HAL/iSightAudio.driver

- com.apple.iSightAudio

/Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin

- com.apple.cmio.DAL.AppleCamera

/Library/CoreMediaIO/Plug-Ins/FCP-DAL/AppleCamera.plugin

- com.apple.cmio.FCP-DAL.AppleCamera

/Library/Extensions/EPSONUSBPrintClass.kext

- com.epson.print.kext.USBPrintClass

/Library/Internet Plug-Ins/AdobeAAMDetect.plugin

- com.AdobeAAMDetectLib.AdobeAAMDetect

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

- com.adobe.acrobat.pdfviewer

/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

- com.adobe.acrobat.pdfviewerNPAPI

/Library/Internet Plug-Ins/Default Browser.plugin

- com.apple.DefaultBrowser.PlugIn

/Library/Internet Plug-Ins/Disabled Plug-Ins/Windows Media Plugin.old

- com.microsoft.WMP.defaultplugin

/Library/Internet Plug-Ins/Disabled Plug-Ins/Windows Media Plugin.old/Contents/Resources/English.lproj

- N/A

/Library/Internet Plug-Ins/DivXBrowserPlugin.plugin

- com.divx.DivXBrowserPlugin

/Library/Internet Plug-Ins/DRM Plugin.bundle

- com.microsoft.DRMPlugin

/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

- net.telestream.wmv.plugin

/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin

- com.google.googletalkbrowserplugin

/Library/Internet Plug-Ins/iPhotoPhotocast.plugin

- com.apple.plugin.iPhotoPhotocast

/Library/Internet Plug-Ins/o1dbrowserplugin.plugin

- com.google.o1dbrowserplugin

/Library/Internet Plug-Ins/Quartz Composer.webplugin

- com.apple.QuartzComposer.webplugin

/Library/Internet Plug-Ins/QuickTime Plugin.plugin

- N/A

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

- com.microsoft.sharepoint.webkitplugin

/Library/Internet Plug-Ins/Windows Media Plugin

- com.microsoft.WMP.defaultplugin

/Library/Internet Plug-Ins/Windows Media Plugin/Contents/Resources/English.lproj

- N/A

/Library/iTunes/iTunes Plug-ins/Quartz Composer Visualizer.bundle

- com.apple.QuartzComposer.iTunesPlugIn

/Library/PreferencePanes/DivX.prefPane

- com.divx.divxprefs

/Library/PreferencePanes/Flip4Mac WMV.prefPane

- net.telestream.wmv.prefpane

/Library/PreferencePanes/QuickTime.prefPane

- com.apple.preference.quicktime

/Library/QuickTime/AppleMPEG2Codec.component

- com.apple.AppleMPEG2Codec

/Library/QuickTime/Flip4Mac WMV Advanced.component

- net.telestream.wmv.advanced

/Library/QuickTime/Flip4Mac WMV Export.component

- net.telestream.wmv.export

/Library/QuickTime/Flip4Mac WMV Import.component

- net.telestream.wmv.import

/Library/ScriptingAdditions/Adobe Unit Types.osax

- N/A

/Library/Spotlight/GBSpotlightImporter.mdimporter

- com.apple.garageband.spotlightimporter

/Library/Spotlight/iBooksAuthor.mdimporter

- com.apple.MDImporter.iBooksAuthor

/Library/Spotlight/iWork.mdimporter

- com.apple.MDImporter.iWork

/Library/Spotlight/Microsoft Office.mdimporter

- com.microsoft.MDImporter.Office

Library/Address Book Plug-Ins/SkypeABDialer.bundle

- com.skype.skypeabdialer

Library/Address Book Plug-Ins/SkypeABSMS.bundle

- com.skype.skypeabsms

Library/Internet Plug-Ins/Picasa.plugin

- com.google.PicasaPlugin

Library/PreferencePanes/AkamaiNetSession.prefPane

- com.yourcompany.AkamaiNetSession

Library/PreferencePanes/AkamaiNetSession.prefPane/Contents/Resources

- com.yourcompany.${PRODUCT_NAME

dylibs

/usr/lib/dtrace/libdtrace_dyld.dylib

/usr/lib/libgmalloc.B.dylib

/usr/lib/libruby.2.0.0.dylib

/usr/lib/libXplugin.1.dylib

Contents of /etc/fstab

[N/A]

Contents of /etc/sysctl.conf

kern.ipc.maxsockbuf=512000

net.inet.tcp.sendspace=131072

net.inet.tcp.recvspace=358400

Contents of /etc/ssh_config

[N/A]

Contents of /Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.AAM.Startup-1.0</string>

<key>Program</key>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<string>-mode=logon</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>LaunchOnlyOnce</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.AdobeCreativeCloud</string>

<key>Program</key>

<string>/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud</string>

<string>--showwindow=false</string>

<string>--onOSstartup=true</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.google.keystone.agent.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.system.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Conten ts/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAg ent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.google.keystone.daemon.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.daemon</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Conten ts/MacOS/GoogleSoftwareUpdateDaemon</string>

</array>

<key>KeepAlive</key>

<key>RunAtLoad</key>

<key>MachServices</key>

<dict>

<key>com.google.Keystone.Daemon.UpdateEngine</key>

<true/>

<key>com.google.Keystone.Daemon.Administration</key>

<true/>

</dict>

<key>UserName</key>

<key>StandardErrorPath</key>

...and 4 more line(s)

Contents of /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>MachServices</key>

<dict>

<key>com.microsoft.office.licensing.helper.port</key>

<true/>

</dict>

<key>Label</key>

<string>com.microsoft.office.licensing.helper</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper</s tring>

</array>

<key>ServiceIPC</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.sonos.smbbump.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.sonos.SmbBump</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Sonos/smb_touch</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.AAM.Scheduler-1.0</string>

<key>Program</key>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<string>-mode=scheduled</string>

</array>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Acrobat XI Pro/Adobe Acrobat Pro.app/Contents/MacOS/Updater/Adobe Acrobat Updater Helper.app/Contents/MacOS/Adobe Acrobat Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.akamai.single-user-client.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.akamai.single-user-client</string>

<key>KeepAlive</key>

<dict>

<key>SuccessfulExit</key>

</dict>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Applications/Akamai/netsession_mac</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>AbandonProcessGroup</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.apple.CSConfigDotMacCert-EMAIL-SharedServices.Agent.pl ist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>KeepAlive</key>

<key>Label</key>

<string>com.apple.CSConfigDotMacCert-EMAIL-SharedServices</string>

<key>LimitLoadToSessionType</key>

<key>LowPriorityIO</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/System/Library/Frameworks/CoreServices.framework/Frameworks/OSServices .framework/Versions/A/Support/CSConfigDotMacCert</string>

<string>/Users/USER/Library/Logs/CSConfigDotMacCert.log</string>

<string>EMAIL</string>

<string>SharedServices</string>

</array>

...and 4 more line(s)

Font issues: 41

Firewall: On

DNS: 167.206.13.180

Listeners

launchd: afpovertcp

launchd: microsoft-ds

kdc: kerberos

User login items

iTunesHelper

- missing value

AdobeResourceSynchronizer

- /Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app

Restricted files: 12

Elapsed time (s): 116

Reply

thomas_r.

Level 7

31,989 points

Oct 22, 2014 5:57 AM in response to Ron_can

There are no signs of any components of Genieo (aka InstallMac), or any other adware I'm familiar with, in the results you got from Linc's script.

At this point, I'm guessing that when you said "The installmac icon is still on the Google menu bar," you actually meant that your web browser is still loading an InstallMac page when it opens. If that's the case, you just need to go into your browser's preferences and change your home page and search engine settings. See:

http://www.adwaremedic.com/kb/browsersettings.php

(Fair disclosure: I may receive compensation from links to my site and software, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Reply

Ron_can

Level 1

4 points

Oct 22, 2014 10:42 AM in response to thomas_r.

Hi Thomas -

Thank you. I did the routine you recommended and everything feels very clean now.

All traces of genieo are gone.

Ron

Reply

Jan 1, 2015 6:16 PM in response to ssacrist

For anyone else who is looking for this solution. I read through all of the post here. The post below is what did the trick for me (Many Thanks Linc) ... BUT I didn't realize it had worked because "installmac" had changed my default home page in Safari ... making it "look" like it was still there. Going to Safari preferences and changing my home page back to my original finished the job. There are NO traces, icons or anything now on my system.

Linc DavisSep 29, 2014 12:48 PM Re: remove installmac
Re: remove installmacin response to ssacrist

There is no need to download anything to solve this problem.

You installed the "InstallMac" trojan. I suggest the procedure below to disable it. This procedure may leave a few small files behind, but it will permanently deactivate the trojan (as long as you never reinstall it.)

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data before proceeding.

Step 1

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including one called "Omnibar," and any that have the word "Conduit," "Spigot," or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Step 2

In the Applications folder, there may be an item named "Installer" or "InstallMac." If so, drag it to the Trash.

Step 3

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents/com.genieo.completer.download.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "com.genieo.completer.download.plist" selected. Move that item to the Trash.

In the same folder is an item named "com.genieo.completer.update.plist". Move it to the Trash as well.

Log out or restart the computer and empty the Trash.

Make sure you don't repeat the mistake that led you to install this trojan

Reply

Jan 17, 2015 5:06 PM in response to Linc Davis

Start time: 16:30:53 01/17/15

Model Identifier: MacBookPro8,1

System Version: OS X 10.10.1 (14B25)

Kernel Version: Darwin 14.0.0

Time since boot: 18 minutes

Memory

BANK 0/DIMM0:

Size: 8 GB

Speed: 1333 MHz

Status: OK

Manufacturer: 0x029E

BANK 1/DIMM0:

Size: 8 GB

Speed: 1333 MHz

Status: OK

Manufacturer: 0x029E

Battery

Condition: Service Battery

SATA

Hitachi HTS545032B9A302

USB

USB Receiver (Logitech Inc.)

Diagnostic reports

2015-01-05 discoveryd crash

2015-01-10 iPhoto crash

Log

Jan 17 15:46:10 BUG in process suhelperd[172]: over-released legacy external boost assertions (1 total, 1 external, 0 legacy-external)

Jan 17 15:46:23 wl0: Roamed or switched channel, reason #8, bssid ac

Jan 17 15:48:41 BUG in process suhelperd[172]: over-released legacy external boost assertions (0 total, 0 external, 0 legacy-external)

Jan 17 15:57:00 wl0: Roamed or switched channel, reason #8, bssid ac

Jan 17 16:03:50 wl0: Roamed or switched channel, reason #8, bssid ac

Jan 17 16:05:02 wl0: Roamed or switched channel, reason #8, bssid ac

kexts

com.Cycling74.driver.Soundflower (1.5.1)

Daemons

com.google.keystone.daemon

com.trusteer.rooks.rooksd

com.adobe.fpsaud

Agents

com.adobe.ARM.UUID

com.google.keystone.system.agent

com.citrixonline.GoToMeeting.G2MUpdate

com.adobe.ARM.UUID

Startup items

/Library/StartupItems/RetroClient/RetroClient

/Library/StartupItems/RetroClient/StartupParameters.plist

Apps

/Applications/Google Drive.app

/Applications/Dropbox.app

Contents of /etc/hosts

127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

fe80::1%lo0 localhost

Contents of /etc/periodic/daily/555.siteadvisor

/usr/local/McAfee/SiteAdvisor/saupkeep -su

Contents of /System/Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.apple.installer.osmessagetracing</string>

<key>LaunchOnlyOnce</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/System/Library/PrivateFrameworks/OSInstaller.framework/Resources/OSMes sageTracer</string>

</array>

<key>UserName</key>

<key>GroupName</key>

<string>wheel</string>

<key>WatchPaths</key>

<array>

<string>/var/db/.AppleDiagnosticsSetupDone</string>

</array>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.google.keystone.agent.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.system.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Conten ts/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAg ent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.teamviewer.teamviewer.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Debug</key>

<true/>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.teamviewer.teamviewer</string>

<key>LimitLoadToSessionType</key>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/TeamViewer 8/TeamViewer.app/Contents/MacOS/TeamViewer</string>

<string>--agent</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>WorkingDirectory</key>

<string>/Applications/TeamViewer 8/TeamViewer.app/Contents/MacOS</string>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Debug</key>

<true/>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.teamviewer.desktop</string>

<key>LimitLoadToSessionType</key>

<array>

<string>LoginWindow</string>

</array>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/TeamViewer 8/TeamViewer.app/Contents/Resources/TeamViewer_Desktop</string>

<string>--agent</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>WorkingDirectory</key>

...and 3 more line(s)

Contents of /Library/LaunchDaemons/com.adobe.fpsaud.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.fpsaud</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Adobe/Flash Player Install Manager/fpsaud</string>

</array>

<key>StartInterval</key>

<key>KeepAlive</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.google.keystone.daemon.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.daemon</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Conten ts/MacOS/GoogleSoftwareUpdateDaemon</string>

</array>

<key>KeepAlive</key>

<key>RunAtLoad</key>

<key>MachServices</key>

<dict>

<key>com.google.Keystone.Daemon.UpdateEngine</key>

<true/>

<key>com.google.Keystone.Daemon.Administration</key>

<true/>

</dict>

<key>UserName</key>

<key>StandardErrorPath</key>

...and 4 more line(s)

Contents of /Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Debug</key>

<true/>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.teamviewer.service</string>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/TeamViewer 8/TeamViewer.app/Contents/Resources/TeamViewer_Service</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>WorkingDirectory</key>

<string>/Applications/TeamViewer 8/TeamViewer.app/Contents/Resources</string>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.trusteer.rooks.rooksd.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.trusteer.rooks.rooksd</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Rapport/bin/rooksd</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Reader 9/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.apple.FolderActions.enabled.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.apple.FolderActions.enabled</string>

<key>OnDemand</key>

<key>Program</key>

<string>/System/Library/CoreServices/Folder Actions Dispatcher.app/Contents/MacOS/Folder Actions Dispatcher</string>

</dict>

</plist>

Contents of Library/LaunchAgents/com.apple.FolderActions.folders.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.apple.FolderActions.folders</string>

<key>Program</key>

<string>/usr/bin/osascript</string>

<key>ProgramArguments</key>

<array>

<string>osascript</string>

<string>tell application "Folder Actions Dispatcher" to tick</string>

</array>

<key>WatchPaths</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.citrixonline.GoToMeeting.G2MUpdate.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.citrixonline.GoToMeeting.G2MUpdate</string>

<key>ProgramArguments</key>

<array>

<string>~/Library/Application Support/CitrixOnline/GoToMeeting/G2MUpdate</string>

</array>

<key>EnableGlobbing</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Root crontab

0 */4 * * * /usr/local/McAfee/fmp/bin/UpdateHelper update >> /dev/null 2>&1

40 12 * * * /usr/local/McAfee/fmp/bin/GenUtility 5 >> /dev/null 2>&1

0 4 * * 2 /usr/local/McAfee/AntiMalware/VShieldTaskManager 4 >> /dev/null 2>&1

Bad plists

Library/Preferences/com.apple.iphotomosaic.plist

Library/Preferences/com.solidstatenetworks.awkhost.plist

Library/Preferences/System Mac.plist

Firewall: On

Listeners

cupsd: ipp

User login items

Microsoft AU Daemon

- /Applications/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app

EEventManager

- missing value

Microsoft Database Daemon

- /Applications/Microsoft Office 2008/Office/Microsoft Database Daemon.app

VMware Fusion Helper

- missing value

BitTorrent

- missing value

Google Drive

- /Applications/Google Drive.app

RingCentral

- missing value

Dropbox

- /Applications/Dropbox.app

AdobeResourceSynchronizer

- /Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app

VMware Fusion Start Menu

- /Applications/VMware Fusion.app/Contents/Library/VMware Fusion Start Menu.app

Google Chrome

- /Applications/Google Chrome.app

Safari extensions

SiteAdvisor

Widgets

iStat Pro

iCal

Restricted files: 7564

Elapsed time (s): 450

Reply