Malware - 'Completer wants to make changes..'

[Big Stevie]

Are there any threads already on this subject?

Keep getting this pop up stating 'Completer wants to make changes to your computer', and asking for my password. Google search states its malware affecting lots of macbook users. Im also getting an icon appear on my desktop called 'Installer'.

Lots of folk reporting the free software AdwareMedic will find and remove the cause of the problem which is a Geneio file, but I haven't dared try it yet.

Anyone else getting this problem?

 

[Weaselboy]

Yep... you have installed the adware Geneio on there.

Restart and do a safe mode boot by holding down the shift key as it boots. This will prevent any login or startup items (like the adware) from launching.

Now download Adwaremedic from here and run it to remove Geneio. Restart afterwards.

That installermc or installer on the desktop is part of Geneio also.

 

[sjinsjca]

Excellent and actionable advice, Weaselboy.

OP, post back when you've tried Weasel's suggestions.

 

[Big Stevie]

I most certainly will, and many thanks.

 

[Big Stevie]

Yep... you have installed the adware Geneio on there.

Restart and do a safe mode boot by holding down the shift key as it boots. This will prevent any login or startup items (like the adware) from launching.

Now download Adwaremedic from here and run it to remove Geneio. Restart afterwards.

That installermc or installer on the desktop is part of Geneio also.

Thanks for the info, I have just completed the above. Below is what adwaremedic found on my macbook pro. Not sure what the Awesome Screenshot file is, but hopefully all unwanted files have now been removed

 

[DeltaMac]

Thanks for the info, I have just completed the above. Below is what adwaremedic found on my macbook pro. Not sure what the Awesome Screenshot file is, but hopefully all unwanted files have now been removed
...

Here's some info about Awesome Screeshot
http://www.thesafemac.com/screenshot-extension-injects-ads/
which should explain why the adwaremedic pointed that out.

 

[Big Stevie]

Here's some info about Awesome Screeshot
http://www.thesafemac.com/screenshot-extension-injects-ads/
which should explain why the adwaremedic pointed that out.

Thanks, I do now recall installing that app, but seldom used it. Now gone

 

[Artimus12]

Here's some info about Awesome Screeshot
http://www.thesafemac.com/screenshot-extension-injects-ads/
which should explain why the adwaremedic pointed that out.

Wow! I didn't realise Awesome Screenshot harboured malware. Adwaremedic also found "Spigot" on mine! Both now gone.

Thanks to all for the thread and answers.

 

[Big Stevie]

Im just surprised that there aren't any other threads on Geneio as it seems to be affecting lots of macbook owners.

 

[adamhenry]

Im just surprised that there aren't any other threads on Geneio as it seems to be affecting lots of macbook owners.

I've seen several threads that mention Geneio. Google finds a lot of posts as well. ????

 

[ecschwarz]

We've had a lot of people who have been having this happen (especially college students who use less-than-official movie/TV streaming sites). Correct me if I'm wrong, but wasn't Gatekeeper supposed to allow Apple to put an end to things like this once they appear?

 

[adamhenry]

We've had a lot of people who have been having this happen (especially college students who use less-than-official movie/TV streaming sites). Correct me if I'm wrong, but wasn't Gatekeeper supposed to allow Apple to put an end to things like this once they appear?

The "Anywhere" option will prevent Gatekeeper from doing it's job.

 

[ecschwarz]

The "Anywhere" option will prevent Gatekeeper from doing it's job.

Right - it's been a couple of days since I've seen an infected machine, but I seem to recall most of these being with users that wouldn't change from the default "Mac App Store and Identified Developers" or try to override things. I'll keep an eye out next time, but it seems that Gatekeeper is only being used for actual malware as opposed to adware.

 

[Michaelgtrusa]

Are there any threads already on this subject?

Keep getting this pop up stating 'Completer wants to make changes to your computer', and asking for my password. Google search states its malware affecting lots of macbook users. Im also getting an icon appear on my desktop called 'Installer'.

Lots of folk reporting the free software AdwareMedic will find and remove the cause of the problem which is a Geneio file, but I haven't dared try it yet.

Anyone else getting this problem?

How to fix adware problems on your Mac http://www.imore.com/how-fix-adware-problems-your-mac

 

[Big Stevie]

I've seen several threads that mention Geneio. Google finds a lot of posts as well. ????

Searching this forum for 'Geneio' only reveals three other threads, and only two of those are referring to anyone having issues. Ive read elsewhere that a recent Flash update could have caused the problem?

There are plenty of discussions about it on google, hence why I expected more threads discussing it on here.

 

[chrfr]

Searching this forum for 'Geneio' only reveals three other threads

You're misspelling it. It's Genieo.

 

[DeltaMac]

Searching this forum for 'Geneio' only reveals three other threads, and only two of those are referring to anyone having issues. Ive read elsewhere that a recent Flash update could have caused the problem?
...
There are plenty of discussions about it on google, hence why I expected more threads discussing it on here.

It can help if you spell "genieo" correctly for a search
https://forums.macrumors.com/search/?searchid=51023796

 

[Weaselboy]

Right - it's been a couple of days since I've seen an infected machine, but I seem to recall most of these being with users that wouldn't change from the default "Mac App Store and Identified Developers" or try to override things. I'll keep an eye out next time, but it seems that Gatekeeper is only being used for actual malware as opposed to adware.

That is exactly the problem and it is sad. For whatever reason, Apple has made a conscious decision not to add these adware programs to XProtect.

The dev. of the Adware Medic app writes about it here. He has submitted some of this adware to Apple for inclusion in XProtect and it was apparently ignored. Apple even has a support article on the subject here, so they do know of the problem.

I agree with the author of that article that Apple probably does not want to get into deciding what is "good" vs. bad adware and disrupt the adware supported software model.

You're misspelling it. It's Genieo.

It can help if you spell "genieo" correctly for a search
https://forums.macrumors.com/search/?searchid=51023796

Ackk... that's more my fault for misspelling it in my post and leading Big Stevie astray.

 

[ecschwarz]

The dev. of the Adware Medic app writes about it here...

I was trying to find that article, but gave up after a few attempts and then forgot to look again - thanks for sharing that.

 

[Weaselboy]

I was trying to find that article, but gave up after a few attempts and then forgot to look again - thanks for sharing that.

I noticed a new article on the same site here today. Looks like Apple is finally cracking down on Genieo and they have added it to the Protect definitions.