Use these instructions to uninstall or remove ad-injection software — sometimes called adware – from your Mac.
Ad-injection software is advertising-supported software that can come from third-party download sites. Software that you download from such sites may have been customized to install both the software you want and the ad-injection software. If your Mac has ad-injection software installed, you might see pop-up windows, ads, and graphics while surfing the web, even if “Block pop-up windows” is selected in Safari preferences. Ad-injection software might also change your homepage and preferred search engine.
Check Safari settings and extensions
Go to Safari > Preferences, then follow these steps:
1. Click the General icon and make sure that the Homepage field contains the website you want.
2. Click the Search icon and make sure that the search engine setting shows your preferred search engine. Some versions of Safari have this setting in the General pane instead.
3. Click the Extensions icon. If you don’t want an extension or don’t know what it does, select the extension from the list and click Uninstall. These are examples of ad-injection extensions, but there are others:
• Amazon Shopping Assistant by Spigot Inc.
• Ebay Shopping Assistant by Spigot Inc.
• Searchme by Spigot, Inc.
• Slick Savings by Spigot Inc.
• GoPhoto.It
• Omnibar
Remove certain ad-injection software
Use this “Go to Folder” method to find and remove each item listed in the sections below, one item at a time:
1. Drag to select an entire line in the lists below, starting with /System/Library/Frameworks/v.framework, for example.
2. Choose Edit > Copy.
3. Open a Finder window, then choose View > As Columns.
4. Choose Go > Go to Folder.
5. Choose Edit > Paste to paste the line you copied into the text field.
6. Press Return.
• If the item is on your Mac, a window opens with the item you searched for already selected. Drag only that item to the Trash. If you’re asked to enter a password, enter your administrator password.
• If the item is not on your Mac, you’ll see a message that the folder can’t be found. Continue to the next item in the list.
Remove Downlite, VSearch, Conduit, Trovi, MyBrand, Search Protect
Use Go to Folder to find and remove each of these items:
/System/Library/Frameworks/v.framework
/System/Library/Frameworks/VSearch.framework
/Library/PrivilegedHelperTools/Jack
/Library/InputManagers/CTLoader/
/Library/Application Support/Conduit/
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
/Applications/SearchProtect.app
After you remove the items above, restart your Mac. Then choose Finder > Empty Trash to permanently remove them.
Remove Genieo, InstallMac
First follow these steps to stop the Genieo or InstallMac processes, if they’re running. Be sure to restart your Mac when instructed.
1. Open Activity Monitor.
You can use Spotlight (Command-Space) to search for “Activity Monitor,” then choose Activity Monitor from the search results.
2. In the Activity Monitor window, click the CPU tab, then click Process Name at the top of that column to sort the list alphabetically.
3. Look for the process “Genieo.” Select it, then click the Force Quit button (x) in the upper-left corner of the window.
4. Look for the process “InstallMac.” Select it, then click the Force Quit button.
5. Quit Activity Monitor.
6. Use Go to Folder to find and remove /private/etc/launchd.conf.
Restart your Mac
Use Go to Folder to find and remove each of these items:
/Applications/Genieo
/Applications/InstallMac
/Applications/Uninstall Genieo
/Applications/Uninstall IM Completer.app
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
~/Library/Application Support/Genieo/
~/Library/Application Support/com.genieoinnovation.Installer/
Restart your Mac
Now find and remove /Library/Frameworks/GenieoExtra.framework.
Restart your Mac
Choose Finder > Empty Trash to permanently remove the items.
Optionally remove other adware files
You don’t need to remove these files to disable the adware. If you do remove them, first remove the other files listed in the sections above. Use the same Go to Folder method to find and remove each item.
/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/LaunchDaemons/Jack.plist
~/Conduit/
~/Trovi/
~/Library/Caches/com.Conduit.takeOverSearchAssetsMac
~/Library/Caches/com.VSearch.bulk.installer
~/Library/Caches/com.VSearch.VSinstaller
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist
~/Library/Preferences/com.genieo.global.settings.plist.lockfile
~/Library/Preferences/com.geneio.settings.plist.lockfile
~/Library/Preferences/com.geneio.global.settings.plist
~/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState
~/Library/Saved Application State/com.VSearch.bulk.installer.savedstate
Go to the /Library/LaunchAgents/ folder and look for a file named com.*.agent.plist. The asterisk (*) could be any word, including “Apple.” Example: com.midnight.agent.plist. Move the file to the Trash.
Go to the /Library/LaunchDaemons/ folder and look for a file named com.*.daemon.plist and a file named com.*.helper.plist. The asterisk (*) could be any word, but it will be the same word used in the LaunchAgents folder, above. Example: com.midnight.daemon.plist and com.midnight.helper.plist. Move the files to the Trash.
Go to the /Library/Application Support/ folder and look for a file name that is the same word used in the LaunchAgents and LaunchDaemons folders, above. Example: midnight. Move the file to the Trash.
Restart your Mac, then choose Finder > Empty Trash to permanently remove the items.
Source: Apple Inc.
This will come in handy. Thank you. I have two infected macs in my office.
Thank you, MDN.
Great to have a manual way of doing this, thanks! Also can try Adware Medic, has worked for me and is donationware.
Adware Medic works great, although I’m not sure how often the developer updates the app and I’m not sure if it works as comprehensively as the above manual instructions. But it sure is a heck of a lot easier …
http://www.adwaremedic.com/index.php
Very useful!
Thanx
Bookmarked !
Information is good.
Apple can do better.
It’s good that they are linking to this, but it’s old news already. It’s been out for a month, or so.
How does one get infected by this? Human install?
Yes, from a non-App Store site where it’s embedded in the application you’re intentionally installing. If you want to install third party apps or extensions (including Flash), go to the source site (Adobe, in this case) to get the app.
Nearly all websites offering collections of apps to download now infest their installers with adware. That includes what used to be beloved VersionTracker, which has been engulfed into the horror that is CNET’s Downloads.com.
Exceptions, and still beloved:
– MacUpdate & MajorGeeks Mac
I’d provide links, but that would make WordPress very upset.
Unfortunately, someone who isn’t prone to hyperbole told me some stuff from MacUpdate has come with some adware recently. Not sure if this was accidental or if they knew about it.
I’d like to know what it was, if you’re able to find out. The Mac security bunch I work with are on the warpath about what’s going on with adware on the Mac. You can let me know directly at: derekcurrie-at-mac-dot-com. My relationship with MacUpdate leads me to believe that they’d like to know as well.
QED Solution: Adware Medic by my colleague Thomas Reed. It’s free (donationware).
Adware Medic Murderizes:
– Codec-M
– Yontoo
– ChatZum
– Conduit…
– Searchme…
– GoPhoto.it
– Omnibar
– savekeep
– Jollywallet
– Vidx…
– MacVX…
– Awesome Screenshot
– Shopy Mate…
– Search App by Ask
– PalMall…
– PremierOpinion
Thomas also offers his own adware removal guide here:
http://www.thesafemac.com/arg/
Thomas is a frequent contributor of adware and malware signature code to Apple, VirusTotal and ClamAV.
Wow, the hater trolls are back today! I post an incredibly useful post and trollTards ding me with 1 star. I hate you too! 😀
They’ve been around fir a few weeks ready to shit on a watch a dow a book and a wow…
Excellent! It classified PhotoZoom (the only hit) as adware, which is interesting. Chucked it out, just in case. Cheers!
Some ‘adware’ is a matter of taste or need. Maybe someone likes the search bar for Ask.com. But it’s been an unwanted annoyance for a lot of people.
OMFG!
How do people get that shit on their Macs?
I leave my Mac Pro on almost all the time via broadband cable and use the internet heavily and have none of this shit on my computer.
I currently use Intego’s NetBarrier and Virus Barrier software, have the Apple Firewall turned on, and have 2 Airport units between my Mac Pro and the Cable Modem.
I also have the following extensions on Safari:
Incognito, Disconnect and Click to Plugin.
Where I am seeing trouble is on my iPad which can be fixed when on WiFi by Weblock software.
MDN on iOS via the browser gets the app store launched- something Apple needs to fix. Apple needs to give users the option of turning off the API that allows web content to launch the app store.
I’ve never downloaded from 3rd party websites, but still got a crumb which kept redirecting to a download site warning me I had to update Flash, in spite of not using Flash.
I think it used a malformed cookie to do this, as once I cleaned out the cookies it went away. Not absolutely sure though.
The article says the source is Apple, Inc. Is there a link to the source at apple.com ?
https://support.apple.com/en-us/HT203987
Great stuff. Adware Medic will automate this for people who don’t want to go through all this effort. The people who created this crapware should be murdered.
My neighbour (who’s a dentist) installed some software from a “Free movie” site (Russian IP)… her search engine changed to some obscure one and pop ups were happening all the time.
I used the Medic App to remove the adware and gave a bit of education to my neighbour about installing Apps from unknown sources. Additionally, I created a new Admin account and changed hers to a Standard account.
I can’t be the only one getting hellish redirects to the App store when I visit this site on my iPhone 6, right? I’m almost ready to never visit this site on mobile until this is fixed.
Yes, Adware Medic is easy, fast, effective and free.
For decades, I’d never been infected, but clicking the wrong button while downloading Cyberduck FTP (an excellent program BTW) launched a takeover of all my browsing. Very, very frustrating, but an hour of intensive research turned-up Adware Medic and all was quickly brought back to normal.
Cyberduck pales in comparison to the very Mac-like and fast Yummy FTP Lite, $2 at the App Store. I have no relationship to the developer other than as a satisfied user.
All very well – for Macs, but what about iOS? I still can’t visit MDN on my iPad or iPhone. Thankfully the redirects to the AppStore have gone away along with Apple ID requests…no way José would I click any of those, but “Win an iPad” comes up with every tab or link clicked on MDN’s site and will automatically redirect after a few secs anyway.
Advice appreciated.
Great article. Many thanks.
Any ideas for blocking the constant ads on my iPad?
They are unrelenting!