How do i get rid of Spyware: Premieropinion

You should download AdwareMedic from thesafemac.com, as proposed by Thomas Reed. Run it. and you will also get rid of other adware at the same time.

Lex

Barney-15E wrote:

If you had downloaded it from the developer's website, it would have directed you through SourceForge.net which doesn't bundle adware with its downloads.

Unfortunately, that's not true anymore. SourceForge has gone to the Dark Side. See:

Time to boycott SourceForge?

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

Sounds like some malicious software!

Since deleting the LaunchDaemon is thwarted by the program re-installing the Daemon, I suspect that the Daemon/Agent is actually running and reinstalling its launch agent.

The Best way to uninstall the program is to also make sure the prog. is Not running while doing so.

We uninstalled PremierOpinions by first Rebooting into Safe mode - boot the computer with the Shift key held down.

(Apple's docs on Safe mode: Try safe mode if your Mac doesn't finish starting up - Apple Support )

This prevents any 3rd-party programs from opening. So it'll stop a lot of your programs (or fonts/printer drivers) from working - we're just using Safe Mode temporarily.

Then uninstall the prog by going to

Macintosh HD / Library / LaunchAgents

and

Macintosh HD / Library / LaunchDaemons

and deleting the two "com.PremierOpinions.plist" files. These files cause the OS to keep opening PremiereOpinion, either at boot or if it's not running at any time.

Finder will have you enter your password to make changes to these system folders.

Also check your

Macintosh HD / Users / <YourUsername> / Library / LaunchAgents

folder. (You can access this folder by holding [Option] while opening the Finder's Go... menu - the Library option will appear there while you hold [option] down.)

In our case PremierOpinions did not have an entry here, but we did find a geneio launcher there - apparently another adware thing, which we deleted.

Also Check your Apple Menu > SystemPrefs > Accounts > [YourUser] > Login Items

to make sure nothing untoward is being launched in this list. In our case we didn't find anything weird, but no harm in checking.

We found a weird browser plugin that had been installed into Safari, which we removed by:

Opening Safari, go to the menu File > Preferences... > Extensions

In Extensions, select the "SearchMe" extension and [Uninstall] that. Not sure if it's related to PreiereOpinions/CNet, but we didn't install it intentionally so we got rid of it.

Lastly, Delete PremierOpinions from your Macintosh HD / Applications Folder. Finder will again ask for a password here.

Finally, Restart your computer (do Not hold down any keys, and it'll boot into normal mode.)

This removed all the bugs we were experiencing (Safari having difficulty/running very slow, the PremierOpinions app in the menu bar etc.).

Just for your info we realized that PremierOpinions had been secretly installed when we used an installer downloaded from CNet (FileZilla in particular). In the future, use MacUpdate or SourceForge (or the original developer's site)!!!

This website was useful in figuring out the safari extension thing: http://malwaretips.com/blogs/premieropinion-removal/

demisjohn wrote:

Sounds like some malicious software!

Since deleting the LaunchDaemon is thwarted by the program re-installing the Daemon, I suspect that the Daemon/Agent is actually running and reinstalling its launch agent.

…

and deleting the two "com.PremierOpinions.plist" files. These files cause the OS to keep opening PremiereOpinion, either at boot or if it's not running at any time.

No. It is launchd that re-launches them if the KeepAlive parameter is set. Launchd uses the plist to load the process into it's queue when launchd comes alive, but once it is in the queue, launchd manages it.

You can delete the plist and the process will still be loaded in the launchd queue. You can kill the process and launchd will restart it if it is set to stay running, even with the plist deleted.

If it is in the main /Library, you must restart after deleting the plist.

If it is in your user /Library, you can log out and log in after deleting the plist.

You can also use launchctl to remove the process from the launchd queue.

Yeah, I was commenting on what I thought was Friberg stating that he DELETED the LaunchAgent plist file (while the LaunchAgent was loaded an still running in memory), and that the plist FILE reappeared after 10min. Perhaps I understood wrong and he was actually talking about the process.

In my experience launchd doesn't recreate a deleted plist file when it's removed, even if the agent/daemon is currently running. Please do let me know if that's incorrect.

This technical difference appears to have little impact on the solution though. (I think booting into safe mode is still the easiest way to remove it, rather than launchd gymnastics).

demisjohn wrote:

In my experience launchd doesn't recreate a deleted plist file when it's removed, even if the agent/daemon is currently running. Please do let me know if that's incorrect.

That is correct. Of course, it would also be possible for the process that the agent/daemon is responsible for keeping alive to periodically check for the existence of the agent/daemon file and re-create it if it has been removed. I don't know whether PremierOpinion does this or not, I'm just saying it's possible.

Hello demisjohn,

In fact, OS X lacks any kind of uninstall architecture like Windows has. The only way to uninstall software on a Mac is to use a vendor-provided uninstaller or uninstallation instructions. Never try to remove files by hand. Never use an "app zapper".

Unfortunately, lots of software doesn't come with any way to uninstall it. The more malicious the software, the harder it is to remove. A dedicated program like AdwareMedic knows the proper way to uninstall a number of known types of adware. AdwareMedic is like a safe and reliable "app zapper". It will not attempt to remove software it doesn't understand, that is what makes it safe and reliable.

The problem is that most of these programs that run hidden in the background have many different pieces. If you don't delete all of the pieces in the proper sequence, they can all come back. Even if you boot into safe mode and delete all the files you find, there could be a hidden login item, preference pane, etc. that restores it all instantly.

This topic comes up very frequently and always leads to a lively conversation. My personal recommendation is AdwareMedic. It is an uninstaller for adware. It doesn't try to uninstall everything like an "app zapper" and it is known to be easy to use and effective. Apple also publishes its own uninstallation instructions for adware. However, I cannot recommend Apple's instructions. They include far too many restarts, recommend removal of unnecessary files, and says some files do not need to be removed when they obviously do.

demisjohn wrote:

In my experience launchd doesn't recreate a deleted plist file when it's removed, even if the agent/daemon is currently running. Please do let me know if that's incorrect.

I thought you were saying the opposite. I just misunderstood, then.

Even though my attempt appears to have been successful (using at least 3 websites to locate all the files!), I must agree with you - AdwareMedic appears to be the sure-fire way to go, since he'll update the uninstaller as the malwares morph.

So I can tell you from experience, that if this is what you have, and don't want to struggle with it, or pay for some extra garbage, just go download malwarebytes. It is free for Mac users, and works great at taking care off all kinds of adware and malware. It will turn your headache into a 5 minutes task, where it does all the hard work. Hope this helps you all out.