Is This Display A Virus or A Hack?

Scam. Do not click on any of the links provided.

Force quit Safari, then restart Safari while holding the Shift key.

You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before proceeding.

Malware is always changing to get around the defenses against it. In addition to the files listed in the support article, you may also have to remove the following in the same way:

~/Library/LaunchAgents/com.Installer.completer.download.plist

~/Library/LaunchAgents/com.Installer.completer.ltvbit.plist

~/Library/LaunchAgents/com.Installer.completer.update.plist

~/Library/Application Support/IM.Installer/Completer.app

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

After removing the malware, remember to reset your home page in all the web browsers affected, if it was changed.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.

If you find Apple's instructions too hard to follow, ask for an alternative that doesn't require you to trust a black-box application without knowing what it does.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Assume that the malware has not been installed and the problem is that each time you restart your Mac this popup is displayed:

I then Force Quit "InstallerS" and go on as normal. The next time I restart this same popup comes up.

I have removed FireFox and all my FireFox profile files. I have no other browser other than Safari. I have searched my hard drive and there is no "InstallerS", "InstallMac", "searchmoose", "Genieo" or other such files or folders on my Mac.

I have reinstalled OS X (10.10.2) and the popup still displays after restart.

I have no extensions installed in Safari.

The popup does not display when I restart and log in as a "guest" or as another user, hence I believe the file is located in my personal user profile somewhere.

How do I locate and remove the file that is causing this popup to be displayed each time I restart my Mac.

Thanks

jr378 wrote:

How do I locate and remove the file that is causing this popup to be displayed each time I restart my Mac.

You have the Genieo, aka InstallMac, adware installed. See my Adware Removal Guide for help removing it.

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)