Q: how to i remove cinemapro 1-2?

1. Use  free  AdwareMedic to remove adware

    http://www.adwaremedic.com/index.php

   Install , open,  and run it by clicking “Scan for Adware” button   to remove adware.

   Once done, quit AdwareMedic.

             or

   Remove the adware manually by following the “HowTo” from Apple.

   http://support.apple.com/en-us/HT203987

2. Safari > Preferences > Extensions

    Turn those off and relaunch Safari.

    Turn those on one by one and test.

You installed the "CinemaPro" trojan. Take the steps below to disable it.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with any of the following names:

           com.cinemapro1-2.agent.plist

           com.extensions.updater*.agent.plist

           UpdateDownloader

Here * stands for a variable five-digit number. Some of these files may be absent. Move any that you have to the Trash and close the Finder window.

If there are any other files in the LaunchAgents folder with a name beginning either in "com.cinemapro" or "com.extensions.updater", move them to the Trash as well.

Log out or restart the computer. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.

3. Do as in Step 1 with this line:

~/Library

A folder named "Library" will open. Inside it there may be a subfolder with this name:

            cinemapro1-2

If so, move that subfolder—not the Library folder—to the Trash.

4. Finally, open this folder in the same way as above:

~/Applications

This is not the usual Applications folder, but a different one inside your home folder. Look for an application with this name:

             cinemapro1-2

and move it to the Trash, if present. Finally, empty the Trash.

That worked great.  Thanks!

Thank you for this post!  It worked great!

This worked, thanks a lot. This is awesome you helping people out like this!

Thank you so much Linc. This ad was driving me nut.

It helped!

Many thanks...this worked

this worked for me, thanks

Thank you! Perfect!

I have been fighting with this beast for about 3 weeks and put over 12 hours in using other fixes that didn't work. Thank you.
My only rogue activity afterwards was a "Facebook Password" popup that remained. (It leads to a suspicious activity loop that i couldn't seem to fix. Probably my own fault.) I removed Facebook from my mail preferences and can re-instate it later.
Everything seems to be working fine now.
THANK YOU SOOOO MUCH!

Thank you for sharing this! I followed the steps and it did work to remove cinemapro1.2 from safari, but it's still appearing in firefox...do you have any tips for removing it from there as well?

Thank you!!

If Safari is not affected, you may have installed a malicious Firefox extension.

First follow the instructions on this page. If there's a Firefox extension you can't remove in the Extensions manager, see below.

Back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

~/Library/Application Support/Mozilla

Copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "Mozilla" selected. Quit Firefox if it's running. Move the selected item to the Trash. Relaunch the browser and test.

If the extension is still present, repeat with this line:

/Library/Application Support/Mozilla

If this folder exists, you may be prompted for your administrator login password when making changes to it.

Some kinds of malware may insert code into the Firefox application itself. If the above steps don't solve the problem, quit Firefox, delete it from the Applications folder, and download a fresh copy directly from mozilla.org.

Thanks. Refreshing Firefox did the trick. Much appreciated.

Thank you.  Your directions were clear, concise and like good medicine safe and effective.