-
All replies
-
Helpful answers
-
Jan 17, 2015 9:34 PM in response to Riley5Tullyby Linc Davis,If Safari crashes on launch and you don't have another web browser, you should be able to launch Safari by starting up in safe mode.
You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.
Back up all data before making any changes.
Besides the files listed in the linked support article, you may also need to remove this file in the same way:
~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist
If there are other items with a name that includes "Genieo" or "genieo" alongside any of those you find, remove them as well.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.
After removing the malware, remember to reset your home page in all the web browsers affected, if it was changed.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.
Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
-
Jan 27, 2015 6:40 AM in response to Linc Davisby Riley5Tully,is there any way to get rid of Genieo or InstalMac
-
Jan 27, 2015 2:16 PM in response to Riley5Tullyby Eric Root,Click the blue this Apple Support page in Linc's post - it will open an article with instructions on how to remove the program.
-
Jan 27, 2015 4:52 PM in response to Riley5Tullyby Riley5Tully,i cant do the ink because i cant get into safri preferences
-
Jan 27, 2015 5:20 PM in response to Riley5Tullyby Eric Root,You don't need to get into Preferences - just click the link. Copy below.
Remove unwanted adware that displays pop-up ads and graphics on your Mac
Use these instructions to uninstall or remove ad-injection software—sometimes called adware.
What is ad-injection software?
Ad-injection software is advertising-supported software that can come from third-party download sites. Software you download from such sites may have been customized to install both the software you want and the ad-injection software. If your Mac has ad-injection software installed, you might see pop-up windows, ads, and graphics while surfing the web, even if "Block pop-up windows" is selected in Safari preferences. Ad-injection software might also change your homepage and preferred search engine.
Check Safari settings and extensions
Follow these steps to make sure that your Safari homepage, search engine, and browser extensions are the ones that you want.
Check your homepage
Go to Safari > Preferences, then click General. Make sure that the Homepage field contains the website you want.
Check your preferred search engine
Go to Safari > Preferences. The search engine setting is in either the Security pane or General pane, depending on the version of Safari that you're using. Make sure that the setting shows your preferred search engine.
Check your Safari extensions
Go to Safari > Preferences, then click Extensions. If you don't want an extension or can't determine what it does, select the extension from the list, then click Uninstall. These are examples of ad-injection extensions:
- Amazon Shopping Assistant by Spigot Inc.
- Ebay Shopping Assistant by Spigot Inc.
- Searchme by Spigot, Inc.
- Slick Savings by Spigot Inc.
- GoPhoto.It
- Omnibar
Remove certain ad-injection software
Follow these steps to remove Downlite, Conduit, or Genieo. If you're asked to enter a password when moving a file to the Trash or emptying the Trash, enter your administrator password.
Remove Downlite, also known as VSearch
- Select each line in the list below, starting with
/Library/Application Support/VSearch. - Choose Edit > Copy.
- From the Finder, choose Go > Go to Folder.
- Choose Edit > Paste to paste the line you copied into the text field, then press Return.
- If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.
Repeat the steps above for each item in the following list. If you get a message that the folder can't be found, continue to the next item in the list.
/Library/Application Support/VSearch/Library/LaunchAgents/com.vsearch.agent.plist/Library/LaunchDaemons/com.vsearch.daemon.plist/Library/LaunchDaemons/com.vsearch.helper.plist/Library/LaunchDaemons/Jack.plist/Library/PrivilegedHelperTools/Jack/System/Library/Frameworks/VSearch.framework/System/Library/Frameworks/v.frameworkAfter you remove the files above, restart your Mac. Then choose Finder > Empty Trash to permanently remove the files.Remove Conduit, also known as Trovi, MyBrand, or Search Protect
- Select each line in the list below, starting with
/Applications/SearchProtect.app. - Choose Edit > Copy.
- From the Finder, choose Go > Go to Folder.
- Choose Edit > Paste to paste the line you copied into the text field, then press Return.
- If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.
Repeat the steps above for each file in the following list. If you get a message that the folder can't be found, continue to the next item in the list.
/Applications/SearchProtect.app/Library/LaunchAgents/com.conduit.loader.agent.plist/Library/LaunchDaemons/com.perion.searchprotectd.plist/Library/Application Support/SIMBL/Plugins/CT2285220.bundle~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin~/Library/Internet Plug-Ins/TroviNPAPIPlugin.pluginNow do the same for each folder in the following list. When these folders open, no file will be selected. Instead, select all items (Command-A) in the folder and drag them all to the Trash./Library/InputManagers/CTLoader//Library/Application Support/Conduit/~/Conduit/~/Trovi/After you remove the files above, restart your Mac. Then choose Finder > Empty Trash to permanently remove the files.
Remove Genieo, also known as InstallMac
First follow these steps to stop the Genieo or InstallMac processes, if they're running. Be particularly careful to restart your Mac when instructed.
- Open the Activity Monitor app:
You can use Spotlight (Command-Space) to search for "Activity Monitor," then choose Activity Monitor from the search results. - In the Activity Monitor window, click the CPU tab, then click Process Name at the top of that column to sort the list alphabetically.
- Look for the process "Genieo." Select it, then click the Force Quit button in the upper-left corner of the window.
- Look for the process "InstallMac." Select it, then click the Force Quit button.
- Quit Activity Monitor.
- From the Finder, choose Go > Go to Folder.
- Type
/private/etc/launchd.confin the text field, then press Return. - If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.
Restart your Mac, then continue to the next steps, below.Remove the files related to Genieo:
- Select each item in the list below, starting with
/Applications/Genieo. - Choose Edit > Copy.
- From the Finder, choose Go > Go to Folder.
- Choose Edit > Paste to paste the line you copied into the text field, then press Return.
- If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.
Repeat the steps above for each item in the following list. If you get a message that the folder can't be found, continue to the next item in the list.
/Applications/Genieo/Applications/InstallMac/Applications/Uninstall Genieo/Applications/Uninstall IM Completer.app~/Library/LaunchAgents/com.genieo.completer.download.plist~/Library/LaunchAgents/com.genieo.completer.update.plist/Library/LaunchAgents/com.genieoinnovation.macextension.plist/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist/Library/LaunchAgents/com.genieo.engine.plist/Library/LaunchAgents/com.genieo.completer.update.plist~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client/usr/lib/libgenkit.dylib/usr/lib/libgenkitsa.dylib/usr/lib/libimckit.dylib/usr/lib/libimckitsa.dylib~/Library/Preferences/com.apple.genieo.global.settings.plist~/Library/SavedState/com.genieo.RemoveGenieoMac.savedStateNow do the same for each folder in the following list. When these folders open, no file will be selected. Instead, select all items (Command-A) in the folder and drag them all to the Trash.
~/Library/Application Support/Genieo/~/Library/Application Support/com.genieoinnovation.Installer/~/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState/Restart your Mac, then continue to the next steps, below.
- From the Finder, choose Go > Go to Folder.
- Type
/Library/Frameworks/GenieoExtra.frameworkin the text field, then press Return. - If the file is on your Mac, a window opens with the file you searched for already selected. Drag the file to the Trash.
Restart your Mac, then choose Finder > Empty Trash to permanently remove the files.
-