accidentally downloaded spam browser mac How to avoid or remove Mac Defender in Mac OS X v10.6 or earlier. Learn how to avoid or remove Mac Defender malware in Mac OS X v10.6 or earlier. A phishing scam has targeted Mac users by redirecting them from legitimate websites to fake websites which tell them that their computer is infected with a virus. The user is then offered Mac Defender "anti-virus" software to solve the issue. This “anti-virus” software is malware (i.e. malicious software). Its ultimate goal is to get the user's credit card information which may be used for fraudulent purposes. The most common names for this malware are MacDefender, MacProtector and MacSecurity. Apple released a free software update (Security Update 2011-003) that will automatically find and remove Mac Defender malware and its known variants. The Resolution section below also provides step-by-step instructions on how to avoid or manually remove this malware. Resolution. How to avoid installing this malware. If any notifications about viruses or security software appear, quit or any other browser that you are using. If a normal attempt at quitting the browser doesn’t work, then Force Quit the browser. In some cases, your browser may automatically download and launch the installer for this malicious software. If this happens, cancel the installation process; do not enter your administrator password. Delete the installer immediately using the steps below. Go into the Downloads folder, or your preferred download location. Drag the installer to the Trash. Empty the Trash. How to remove this malware If the malware has been installed, we recommend the following actions: Do not provide your credit card information under any circumstances. Use the Removal Steps below. Removal steps. Move or close the Scan Window. Go to the Utilities folder in the Applications folder and launch Activity Monitor. Choose All Processes from the pop up menu in the upper right corner of the window. Under the Process Name column, look for the name of the app and click to select it; common app names include: MacDefender, MacSecurity or MacProtector. Click the Quit Process button in the upper left corner of the window and select Quit. Quit Activity Monitor application. Open the Applications folder. Locate the app ex. MacDefender, MacSecurity, MacProtector or other name. Drag to Trash, and empty Trash. Malware also installs a login item in your account in System Preferences. Removal of the login item is not necessary, but you can remove it by following the steps below. Open System Preferences, select Accounts, then Login Items Select the name of the app you removed in the steps above ex. MacDefender, MacSecurity, MacProtector Click the minus button Use the steps in the “How to avoid installing this malware” section above to remove the installer from the download location. Note: Apple provides security updates for the Mac exclusively through Software Update and the Apple Support Downloads site. User should exercise caution any time they are asked to enter sensitive personal information online. Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information. Question: Q: I accidentally downloaded something that may be a virus or at least spam. I was trying to download something to play an internet video but I think it may be a virus or or malware. My home page is now Bing (on Safari) and I don't know how to change that. Also, I keep getting pop up ads. I deleted the file but that didn't change anything. I don't know what to do. I was told *not* to get a virus protector by the guys at the Apple Store. I'm new to Macs. I'd appreciate any help anyone can offer. Posted on Jun 26, 2014 10:53 AM. All replies. Loading page content. Page content loaded. Sounds like adware, not a virus. Jun 26, 2014 10:54 AM. Sounds like you have installed the Genieo adware at a minimum, and very likely may have others as well. The link stevejobsfan0123 gave you will help you remove it. Note that anti-virus software would probably not have protected you against this, as many variants of Genieo are detected by only a very few anti- virus apps. It's far more important to learn how to protect yourself. See my Mac Malware Guide. (Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.) Jun 26, 2014 12:25 PM. You installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.) Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future . Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one. Back up all data . You must know how to restore from a backup even if the system becomes unbootable . If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance. In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent . If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state. There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer. This step does not completely inactivate Genieo . Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions. Triple-click anywhere in the line below on this page to select it: Right-click or control -click the line and select.

Services ▹ Reveal in Finder (or just Reveal ) from the contextual menu. If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C . In the Finder, select.

Go ▹ Go to Folder. from the menu bar and paste into the box that opens by pressing command-V . You won't see what you pasted because a line break is included. Press return . A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password. Move each of these items to the Trash in the same way: If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one. Restart and empty the Trash. Don't try to empty the Trash until you have restarted. From the Safari menu bar, select.

Safari ▹ Preferences. ▹ Extensions. Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the and Chrome browsers, if you use either of those. Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results. Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately . You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software . Finally, be forewarned that when Genieo is mentioned on this site, the perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to run the provided uninstaller. As he knows and intends, the uninstaller does not completely remove the malware . Question: Q: I accidentally downloaded something that may be a virus or at least spam. I was trying to download something to play an internet video but I think it may be a virus or adware or malware. My home page is now Bing (on Safari) and I don't know how to change that. Also, I keep getting pop up ads. I deleted the file but that didn't change anything. I don't know what to do. I was told *not* to get a virus protector by the guys at the Apple Store. I'm new to Macs. I'd appreciate any help anyone can offer. Posted on Jun 26, 2014 10:53 AM. All replies. Loading page content. Page content loaded. Sounds like adware, not a virus. Jun 26, 2014 10:54 AM. Sounds like you have installed the Genieo adware at a minimum, and very likely may have others as well. The link stevejobsfan0123 gave you will help you remove it. Note that anti-virus software would probably not have protected you against this, as many variants of Genieo are detected by only a very few anti- virus apps. It's far more important to learn how to protect yourself. See my Mac Malware Guide. (Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.) Jun 26, 2014 12:25 PM. You installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.) Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future . Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one. Back up all data . You must know how to restore from a backup even if the system becomes unbootable . If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance. In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent . If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state. There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer. This step does not completely inactivate Genieo . Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions. Triple-click anywhere in the line below on this page to select it: Right-click or control -click the line and select.

Services ▹ Reveal in Finder (or just Reveal ) from the contextual menu. If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C . In the Finder, select.

Go ▹ Go to Folder. from the menu bar and paste into the box that opens by pressing command-V . You won't see what you pasted because a line break is included. Press return . A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password. Move each of these items to the Trash in the same way: If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one. Restart and empty the Trash. Don't try to empty the Trash until you have restarted. From the Safari menu bar, select.

Safari ▹ Preferences. ▹ Extensions. Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those. Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results. Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately . You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software . Finally, be forewarned that when Genieo is mentioned on this site, the perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to run the provided uninstaller. As he knows and intends, the uninstaller does not completely remove the malware . Question: Q: I accidentally downloaded something that may be a virus or at least spam. I was trying to download something to play an internet video but I think it may be a virus or adware or malware. My home page is now Bing (on Safari) and I don't know how to change that. Also, I keep getting pop up ads. I deleted the file but that didn't change anything. I don't know what to do. I was told *not* to get a virus protector by the guys at the Apple Store. I'm new to Macs. I'd appreciate any help anyone can offer. Posted on Jun 26, 2014 10:53 AM. All replies. Loading page content. Page content loaded. Sounds like adware, not a virus. Jun 26, 2014 10:54 AM. Sounds like you have installed the Genieo adware at a minimum, and very likely may have others as well. The link stevejobsfan0123 gave you will help you remove it. Note that anti-virus software would probably not have protected you against this, as many variants of Genieo are detected by only a very few anti- virus apps. It's far more important to learn how to protect yourself. See my Mac Malware Guide. (Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.) Jun 26, 2014 12:25 PM. You installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.) Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future . Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one. Back up all data . You must know how to restore from a backup even if the system becomes unbootable . If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance. In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent . If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state. There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer. This step does not completely inactivate Genieo . Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions. Triple-click anywhere in the line below on this page to select it: Right-click or control -click the line and select.

Services ▹ Reveal in Finder (or just Reveal ) from the contextual menu. If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C . In the Finder, select.

Go ▹ Go to Folder. from the menu bar and paste into the box that opens by pressing command-V . You won't see what you pasted because a line break is included. Press return . A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password. Move each of these items to the Trash in the same way: If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one. Restart and empty the Trash. Don't try to empty the Trash until you have restarted. From the Safari menu bar, select.

Safari ▹ Preferences. ▹ Extensions. Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those. Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results. Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately . You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software . Finally, be forewarned that when Genieo is mentioned on this site, the perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to run the provided uninstaller. As he knows and intends, the uninstaller does not completely remove the malware . Question: Q: I accidentally downloaded something that may be a virus or at least spam. I was trying to download something to play an internet video but I think it may be a virus or adware or malware. My home page is now Bing (on Safari) and I don't know how to change that. Also, I keep getting pop up ads. I deleted the file but that didn't change anything. I don't know what to do. I was told *not* to get a virus protector by the guys at the Apple Store. I'm new to Macs. I'd appreciate any help anyone can offer. Posted on Jun 26, 2014 10:53 AM. All replies. Loading page content. Page content loaded. Sounds like adware, not a virus. Jun 26, 2014 10:54 AM. Sounds like you have installed the Genieo adware at a minimum, and very likely may have others as well. The link stevejobsfan0123 gave you will help you remove it. Note that anti-virus software would probably not have protected you against this, as many variants of Genieo are detected by only a very few anti- virus apps. It's far more important to learn how to protect yourself. See my Mac Malware Guide. (Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.) Jun 26, 2014 12:25 PM. You installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.) Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future . Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one. Back up all data . You must know how to restore from a backup even if the system becomes unbootable . If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance. In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent . If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state. There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer. This step does not completely inactivate Genieo . Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions. Triple-click anywhere in the line below on this page to select it: Right-click or control -click the line and select.

Services ▹ Reveal in Finder (or just Reveal ) from the contextual menu. If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C . In the Finder, select.

Go ▹ Go to Folder. from the menu bar and paste into the box that opens by pressing command-V . You won't see what you pasted because a line break is included. Press return . A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password. Move each of these items to the Trash in the same way: If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one. Restart and empty the Trash. Don't try to empty the Trash until you have restarted. From the Safari menu bar, select.

Safari ▹ Preferences. ▹ Extensions. Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those. Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results. Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately . You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software . Finally, be forewarned that when Genieo is mentioned on this site, the perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to run the provided uninstaller. As he knows and intends, the uninstaller does not completely remove the malware .