I just got a pop up saying "Completer wants to make changes. The your password to allow this." Has anyone ever seen this?
Thanks
Mac Pro, Mac OS X (10.7.5)
I downloaded Avast security software and it isolated the virus. This is the first Mac virus I've had in 30 years!!
http://download.cnet.com/Avast-Mac-Security-2015/3000-2239_4-75451160.html
Please see my previous response. Also, note that Avast absolutely should not be used. It has been known to include its own adware component, is only downloadable from a known adware distributor (download.cnet.com) and has a long history of a high rate of false positives.
I used to find files:
find * -name "*genieo*"
and removed these:
(the directories contained genieo inside)
Perhaps you neglected "-i" from the grep command
BobMac13 wrote:
I used to find files:
That is not sufficient to remove Genieo. Those are only a few of the files that it installs, and some do not have the words "Genieo" or "InstallMac" in their names anywhere.
Further, I strongly caution against the use of "rm -rf" commands, unless you really know what you're doing! Those reading should be aware that a single typo in the command could wipe out a lot of data, even the entire user folder, depending on what the typo was.
For proper removal, see:
http://www.thesafemac.com/arg-genieo
(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)
Ok thanks to BobMacs post i did; find ~/ -name *genieo*, which found loads of files:
/Users/myname//Downloads/installgenieo.dmg
/Users/myname//Library/Application Support/com.genieoinnovation.Installer
/Users/myname//Library/Application Support/Google/Chrome/Default/Local Storage/http_www.genieo.com_0.localstorage
/Users/myname//Library/Application Support/Google/Chrome/Default/Local Storage/http_www.genieo.com_0.localstorage-journal
/Users/myname//Library/Caches/com.genieoinnovation.Installer
/Users/myname//Library/LaunchAgents/com.genieo.completer.download.plist
/Users/myname//Library/LaunchAgents/com.genieo.completer.ltvbit.plist
/Users/myname//Library/LaunchAgents/com.genieo.completer.update.plist
/Users/myname//Library/Preferences/com.genieo.global.settings.plist
/Users/myname//Library/Preferences/com.genieo.settings.plist
/Users/myname//Library/Preferences/com.genieoinnovation.macextension.plist
I then rm -rf 'd each of these files and ran find again, and it then found the below files which despite rm -rf 'ing them they were not removed. I tried sudo rm -rf and still no joy, any thoughts and advice as to how to remove the below and why rm -rf has not worked on them?
/Users/myname//Library/Application Support/com.genieoinnovation.Installer
/Users/myname//Library/Application Support/Google/Chrome/Default/Local Storage/http_www.genieo.com_0.localstorage
/Users/myname//Library/Application Support/Google/Chrome/Default/Local Storage/http_www.genieo.com_0.localstorage-journal
Thanks
Looks like I managed to remove them by navigating to the relevant folders and rm 'ing them from there. Fingers crossed thats all of that underhand intrusive adware software gone forever.
The files with "Application Support" in them contain a space and so the entire filename needs to be enclosed in double quotes for this command to execute properly.
***** And for everyone else, I agree with thomas_r --- don't execute unix commands unless you really know what you're doing.
I took a chance and downloaded Adware (I rarely run any kind of removal software but I figured it was worth a try). It found quite a few things, I let it delete them and haven't had a pop up all day so hopefully success.
December 26, 2014 Received "Completer wants to make changes. Type in your password." Sent an e-mail to Apple
Support. Called me back immediately and we what I would call "cleaned out the closet." Didn't charge me. Hope it's
gone. Seemed malicious.
Take Thomas R.'s advice and run AdwareMedic. It isolated the Completer files and removed them. Should also note that I'm almost certain this virus/trojan was installed when I needed to update Flash and clicked the Flash "Ad" at the top of Google's search results. These people need to go to prison.
I also believe I might have gotten this with a phony invitation to update Flash.
I have this problem too - completer.app keeps popping up.
I cannot use Adware as my Macbook is 10.6.8 - there are no extensions on Chrome so the manual adware removal does not work
I have already uninstalled and deleted all Geneio apps but still this completer.app keeps popping up. No idea what to do now. Hope someone finds a solution soon.
Try these steps from Apple: Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support
Also, I couldn't move one of the final files to the trash because I got a message that said it was open or in use. I found a process that is possibly very valid (Installd) running in the activity monitor but I think it was protecting one of those final files (maybe the Installer one?). I killed it and then was able to trash the file and complete the steps in the Apple support bulletin.
Go to the following site, Apple has instructions for stopping this:
Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support
Completer wants to make changes
