Genieo changing its name?
Published June 19th, 2015 at 9:19 AM EDT , modified June 19th, 2015 at 9:19 AM EDT
Earlier this month, I wrote about how new variants of the Genieo adware are proliferating. Now, however, it looks like Genieo may be changing its name. A new site, for an app called InKeepr, appears to be poised to take Genieo’s place, perhaps because of all the negative name recognition now associated with the Genieo name.
The old site, at genieo[dot]com, currently shows nothing but a notice that it is “temporarily down for maintenance.” According to the Internet Archive Wayback Machine, this seems to have happened sometime between May 13 and May 24.
The new domain, inkeepr[dot]com, was first registered in February of this year. It’s unknown, however, when it first went live, as the Wayback Machine did not yet have that page archived. My unsubstantiated guess would be that it must have happened around the same time, although I have no proof of that.
Some readers may be wondering right about now why I’m connecting InKeepr with Genieo… well, the simplest explanation comes from the contact info from the InKeepr website. This page clearly identifies the head office as belonging to Genieo Innovation Ltd, the Israeli company behind the Genieo adware.
Further evidence comes from downloading the InKeepr software from the InKeepr site. This software behaves almost identically to Genieo. It uses the same three LaunchAgent files to keep a process (now named AppDS, not much better than the old “Application” process) running. It installs an InKeepr app that is very similar to the old Genieo and InstallMac apps. It installs the same Reset Search application. Even the “news” pop-up in the Finder looks very similar to the pop-up displayed by the older Genieo adware.
I can only guess that this name change is intended as a way of avoiding the negative name recognition now associated with the Genieo and InstallMac brands. Clearly, Genieo Innovation doesn’t intend to just roll over and give up, and is still trying to find ways of infecting people with its adware.
I have yet to see InKeepr in the wild, obtained from somewhere other than the InKeepr site. I have seen reports that it is included in a download available on Sourceforge (which has recently been guilty of wrapping other people’s software in adware installers), but I don’t know which download that might be. In any case, if you run an installer and see mention of InKeepr, force-quit the installer immediately and throw it in the trash!
Fortunately, AdwareMedic already detected most of the components of InKeepr, and I have added detection of the rest this morning. If you have been infected with InKeepr, or any of the other recent variants of Genieo, AdwareMedic should remove it for you.