InstallMac uninstaller antics
Published February 16th, 2014 at 10:01 PM EDT , modified February 16th, 2014 at 10:01 PM EDT
InstallMac is adware that I have written about before, as it is currently being added to some downloads available on Softonic. (Without the permission of the developers of the apps in question, I should note.) This adware, as well as the Genieo adware that powers it, has been known for some time to have a non-functional uninstaller. Although the uninstaller does appear to remove the software, it leaves behind some of the hidden components. It turns out, though, that the uninstaller’s behavior is worse than previously known!
Credit for this discovery goes to Andy Ball, who posted a note on Apple’s support forums detailing the fact that the InstallMac uninstaller will apparently install these hidden components, if they are not present! In other words, if someone thinks they have InstallMac and runs the uninstaller, or has removed it but runs the uninstaller “just to be sure,” they will actually end up with hidden Genieo components installed that were not there before.
I decided to test Andy’s findings myself, and found that it behaves exactly as described. I began by Googling “installmac uninstaller” which led me to an InstallMac FAQ page. From there, I found a link to the official InstallMac uninstaller and downloaded it.
Upon running the installer on a clean system, which had never had InstallMac (or any other variant of Genieo) installed before, I was asked to install Java. I did so, then continued with the process, providing my administrative account password when asked, even though the password request raised several red flags. As can be seen, it referred to installing a new “helper tool,” which was very suspicious for something claiming to be an uninstaller.
When the uninstaller finished, there were no obvious signs of anything amiss. However, on inspecting the system, I found that this “uninstaller” had actually installed hidden background processes:
As can be seen from these screenshots, the GenieoExtra.framework file was installed. This package contains the deceptively-named “Application” process, seen in Activity Monitor, which is kept actively running by the LaunchAgent that was also installed. A privileged helper tool was also installed, and was kept loaded by a LaunchDaemon.
The Genieo uninstaller has been a problem for quite some time. Back in June of last year – almost 8 months ago – I wrote about the fact that it leaves these files behind as part of a story on deceptive Genieo installation. Since that time, Genieo representatives have claimed to be working on the problem, but a fix for the issue has never materialized. Now, although it seems that only the InstallMac uninstaller actually installs these files, serious questions must be raised about whether this behavior is a bug or intentional behavior.
Of all the adware I have seen and described in my Adware Removal Guide, Genieo (including the InstallMac variant of Genieo) has become the most prevalent piece of Mac adware out there. I receive more e-mail these days about Genieo removal than about all other malware and adware issues combined! It’s abundantly clear that users do not want this on their computers, and it’s equally clear that Genieo has no desire to make it easy for them to get rid of it.