Gwhet
Level 1 (0 points)

Q: Only search virus (safari)

Hi, I recently noticed that my homepage was changed from "Google" to "only search" I did a quick search from my cell phone and read through some of the forums on here I even followed the instructions regarding the same issue last month but did not find ANY of those listed files in my computer nor have I downloaded any extensions (at least non that are visible through the safari preferences menu). I do not want to download that adware software cause from what I understand it only masks the issue....This is my first apple desktop so I'm still getting used to navigating through the OS. Please help.

Mac mini

Posted on Dec 25, 2014 6:14 PM

Close
Gwhet

Q: Only search virus (safari)

  • All replies
  • Helpful answers

  • by rkaufmann87,

    rkaufmann87 rkaufmann87 Dec 25, 2014 6:30 PM in response to Gwhet
    Level 9 (58,956 points)
    Photos for Mac
    Dec 25, 2014 6:30 PM in response to Gwhet

    If you accidentally changed the default search engine it is easy to change it back. Safari - Preferences - Search tab - change the Search Engine to the one you want.

  • by Gwhet,

    Gwhet Gwhet Dec 25, 2014 6:34 PM in response to rkaufmann87
    Level 1 (0 points)
    Dec 25, 2014 6:34 PM in response to rkaufmann87

    I've changed it back to www.google.com quite a few times and it keeps going back to onlysearch.com.

  • by Gwhet,Helpful

    Gwhet Gwhet Dec 25, 2014 7:18 PM in response to Gwhet
    Level 1 (0 points)
    Dec 25, 2014 7:18 PM in response to Gwhet

    I actually figured it out by back pedaling through the apple forums and figured out I have accidentally  downloaded some malicious files (downlite) here are the steps I took to remove it all (some of the files listed were not in found but one or 2 of them were the culprits. Thank you apple forums 

    Remove unwanted adware that displays pop-up ads and graphics on your Mac

    Use these instructions to uninstall or remove ad-injection software—sometimes called adware.

    What is ad-injection software?

    Ad-injection software is advertising-supported software that can come from third-party download sites. Software you download from such sites may have been customized to install both the software you want and the ad-injection software. If your Mac has ad-injection software installed, you might see pop-up windows, ads, and graphics while surfing the web, even if "Block pop-up windows" is selected in Safari preferences. Ad-injection software might also change your homepage and preferred search engine.

    Check Safari settings and extensions

    Follow these steps to make sure that your Safari homepage, search engine, and browser extensions are the ones that you want.

    Check your homepage

    Go to Safari > Preferences, then click General. Make sure that the Homepage field contains the website you want.

    Check your preferred search engine

    Go to Safari > Preferences. The search engine setting is in either the Security pane or General pane, depending on the version of Safari that you're using. Make sure that the setting shows your preferred search engine.

    Check your Safari extensions

    Go to Safari > Preferences, then click Extensions. If you don't want an extension or can't determine what it does, select the extension from the list, then click Uninstall. These are examples of ad-injection extensions:

    • Amazon Shopping Assistant by Spigot Inc.
    • Ebay Shopping Assistant by Spigot Inc.
    • Searchme by Spigot, Inc.
    • Slick Savings by Spigot Inc.
    • GoPhoto.It
    • Omnibar

    Remove certain ad-injection software

    Follow these steps to remove Downlite, Conduit, or Genieo. If you're asked to enter a password when moving a file to the Trash or emptying the Trash, enter your administrator password.

    Remove Downlite, also known as VSearch

    1. Select each line in the list below, starting with /Library/Application Support/VSearch.
    2. Choose Edit > Copy.
    3. From the Finder, choose Go > Go to Folder.
    4. Choose Edit > Paste to paste the line you copied into the text field, then press Return.
    5. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Repeat the steps above for each item in the following list. If you get a message that the folder can't be found, continue to the next item in the list./Library/Application Support/VSearch

    /Library/LaunchAgents/com.vsearch.agent.plist/Library/LaunchDaemons/com.vsearch.daemon.plist

    /Library/LaunchDaemons/com.vsearch.helper.plist/Library/LaunchDaemons/Jack.plist

    /Library/PrivilegedHelperTools/Jack/System/Library/Frameworks/VSearch.framework

    After you remove the files above, restart your Mac. Then choose Finder > Empty Trash to permanently remove the files.

    Remove Conduit, also known as Trovi, MyBrand, or Search Protect

    1. Select each line in the list below, starting with /Applications/SearchProtect.app.
    2. Choose Edit > Copy.
    3. From the Finder, choose Go > Go to Folder.
    4. Choose Edit > Paste to paste the line you copied into the text field, then press Return.
    5. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Repeat the steps above for each file in the following list. If you get a message that the folder can't be found, continue to the next item in the list./Applications/SearchProtect.app

    /Library/LaunchAgents/com.conduit.loader.agent.plist/Library/LaunchDaemons/com.perion.searchprotectd.plist

    /Library/Application Support/SIMBL/Plugins/CT2285220.bundle~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

    ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.pluginNow do the same for each folder in the following list. When these folders open, no file will be selected. Instead, select all items (Command-A) in the folder and drag them all to the Trash.

    /Library/InputManagers/CTLoader//Library/Application Support/Conduit/

    ~/Conduit/~/Trovi/

    After you remove the files above, restart your Mac. Then choose Finder > Empty Trash to permanently remove the files.

    Remove Genieo, also known as InstallMac

    First follow these steps to stop the Genieo or InstallMac processes, if they're running. Be particularly careful to restart your Mac when instructed.

    1. Open the Activity Monitor app:
      You can use Spotlight (Command-Space) to search for "Activity Monitor," then choose Activity Monitor from the search results.
    2. In the Activity Monitor window, click the CPU tab, then click Process Name at the top of that column to sort the list alphabetically.
    3. Look for the process "Genieo." Select it, then click the Force Quit button in the upper-left corner of the window.
    4. Look for the process "InstallMac." Select it, then click the Force Quit button.
    5. Quit Activity Monitor.
    6. From the Finder, choose Go > Go to Folder.
    7. Type /private/etc/launchd.conf in the text field, then press Return.
    8. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Restart your Mac, then continue to the next steps, below.Remove the files related to Genieo:

    1. Select each item in the list below, starting with /Applications/Genieo.
    2. Choose Edit > Copy.
    3. From the Finder, choose Go > Go to Folder.
    4. Choose Edit > Paste to paste the line you copied into the text field, then press Return.
    5. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Repeat the steps above for each item in the following list. If you get a message that the folder can't be found, continue to the next item in the list./Applications/Genieo

    /Applications/InstallMac/Applications/Uninstall Genieo

    /Applications/Uninstall IM Completer.app~/Library/LaunchAgents/com.genieo.completer.download.plist

    ~/Library/LaunchAgents/com.genieo.completer.update.plist/Library/LaunchAgents/com.genieoinnovation.macextension.plist

    /Library/LaunchAgents/com.genieoinnovation.macextension.client.plist/Library/LaunchAgents/com.genieo.engine.plist

    /Library/LaunchAgents/com.genieo.completer.update.plist~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist

    /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client

    /usr/lib/libgenkit.dylib/usr/lib/libgenkitsa.dylib

    /usr/lib/libimckit.dylib/usr/lib/libimckitsa.dylib

    ~/Library/Preferences/com.apple.genieo.global.settings.plist~/Library/SavedState/com.genieo.RemoveGenieoMac.savedState

    Now do the same for each folder in the following list. When these folders open, no file will be selected. Instead, select all items (Command-A) in the folder and drag them all to the Trash.~/Library/Application Support/Genieo/

    ~/Library/Application Support/com.genieoinnovation.Installer/~/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState/

    Restart your Mac, then continue to the next steps, below.

    1. From the Finder, choose Go > Go to Folder.
    2. Type /Library/Frameworks/GenieoExtra.framework in the text field, then press Return.
    3. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Restart your Mac, then choose Finder > Empty Trash to permanently remove the files.

  • by danielfromgranger,

    danielfromgranger danielfromgranger Jan 13, 2015 12:23 PM in response to Gwhet
    Level 1 (0 points)
    Jan 13, 2015 12:23 PM in response to Gwhet

       I also download MacInstall (Genieo, Omnibar 1.2) but did not install the Application. Using iMac OS X 10.9.5.  No real problems except Completer install prompt and disk image appears on restart and other various times.

    Using this following procedure (edited by me for just Macinstall) the red highlighted files are the only files on my machine. Question is, can I just manually delete the highlighted files, except Frameworks  (and then delete Frameworks after restart) and be successful?

     

    Thanks, Dan from Granger

     

    Procedure:

     

    Check your Safari extensions

    Go to Safari > Preferences, then click Extensions. If you don't want an extension or can't determine what it does, select the extension from the list, then click Uninstall. • Omnibar

    Remove certain ad-injection software

    Follow these steps to remove Downlite, Conduit, or Genieo. If you're asked to enter a password when moving a file to the Trash or emptying the Trash, enter your administrator password.

    Remove Genieo, also known as InstallMac

    First follow these steps to stop the Genieo or InstallMac processes, if they're running. Be particularly careful to restart your Mac when instructed.

    1. Open the Activity Monitor app:
    3. You can use Spotlight (Command-Space) to search for "Activity Monitor," then choose Activity Monitor from the search results.
    5. In the Activity Monitor window, click the CPU tab, then click Process Name at the top of that column to sort the list alphabetically.
    7. Look for the process "Genieo." Select it, then click the Force Quit button in the upper-left corner of the window.
    9. Look for the process "InstallMac." Select it, then click the Force Quit button.
    11. Quit Activity Monitor.
    13. From the Finder, choose Go > Go to Folder.
    15. Type /private/etc/launchd.conf in the text field, then press Return.
    17. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Restart your Mac, then continue to the next steps, below.

    Remove the files related to Genieo:

    1. Select each item in the list below, starting with /Applications/Genieo.
    3. Choose Edit > Copy.
    5. From the Finder, choose Go > Go to Folder.
    7. Choose Edit > Paste to paste the line you copied into the text field, then press Return.
    9. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Repeat the steps above for each item in the following list. If you get a message that the folder can't be found, continue to the next item in the list.

    /Applications/Genieo

    /Applications/InstallMac

    /Applications/Uninstall Genieo

    /Applications/Uninstall IM Completer.app

    ~/Library/LaunchAgents/com.genieo.completer.download.plist

    ~/Library/LaunchAgents/com.genieo.completer.update.plist

    /Library/LaunchAgents/com.genieoinnovation.macextension.plist

    /Library/LaunchAgents/com.genieoinnovation.macextension.client.plist

    /Library/LaunchAgents/com.genieo.engine.plist

    /Library/LaunchAgents/com.genieo.completer.update.plist

    ~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist

    /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist

    /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client

    /usr/lib/libgenkit.dylib

    /usr/lib/libgenkitsa.dylib

    /usr/lib/libimckit.dylib

    /usr/lib/libimckitsa.dylib

    ~/Library/Preferences/com.apple.genieo.global.settings.plist

    ~/Library/SavedState/com.genieo.RemoveGenieoMac.savedState

    Now do the same for each folder in the following list. When these folders open, no file will be selected. Instead, select all items (Command-A) in the folder and drag them all to the Trash.

    ~/Library/Application Support/Genieo/

    ~/Library/Application Support/com.genieoinnovation.Installer/

    ~/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState/

    Restart your Mac, then continue to the next steps, below.

    1. From the Finder, choose Go > Go to Folder.
    3. Type /Library/Frameworks/GenieoExtra.framework in the text field, then press Return.
    5. If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.

    Restart your Mac, then choose Finder > Empty Trash to permanently remove the files.