CleanMyMac2 & malware/adware?

  • 18 February 2015
  • 3 replies
  • 115 views

I just updated CleanMyMac2 to the latest version, and when I launched it, Webroot SecureAnywhere popped up stating that it had detected a threat.  It identified a threat named "OSX.Genieo.1.r," located w/in the CCM2's application support folder w/in the user Library.  Anyone else experience this same issue?  Anyone familiar with that particular threat?
 
 

3 replies

Userlevel 7
Badge +62
Hello @ 
Welcome to the Community Forum,
 
Can you tell me if Webroot has quarantined OSX.Genieo.1.r? You can Contact Support Here and they will look into this for you.
 
Would you please have a look at this Help Article concerning Mac threats and what to doif there is difficulty removing the threat.
 
http://www5.nohold.net/Webroot/Loginr.aspx?pid=12&login=1&app=vw&solutionid=2305 
 
Hope this helps and could you get back to us to let us know how you are doing?
 
 
Kind Regards,
Userlevel 7
Badge +62
Hello Again STCMD,
 
I just wanted to let you know that there is some information here about Genieo here, http://en.wikipedia.org/wiki/Genieo
 
I have a Mac and I use MacTuneup without an issue. But there are pros and cons in using cleaners with a Mac and I'm sure you have researched this?
 
CleanMyMac seems to be reputable so I'm not sure how you got this GENIEO, but the Support Team can check this out for you just to be on the safe side.
 
 
Kind Regards,
Userlevel 7
Badge +62
Hello @ 
 
 
I wanted to update you and let you know that this"OSX.Genieo.1.r, Is a False Positive. According to our Mac Threat Reseacher has stated here below!
 
 
"I am currently working with CleanmyMac to reverse this detection.  This is a False positive do to the way they have written their programs detection method.  We should have this resolved and pushed out within the next 24 hours.
Thanks,"
Devin T Byrd
Mac Threat Research Analyst Also Please follow these instructions here: You may un-quarantine and restore the file that was quarantined by the Webroot SecureAnywhere software if you have not already done so. To restore the file:

Part 1: Check to see if any related files are in quarantine
1. Click on the cog icon next to 'PC Security'.
2. Open the 'Quarantine' tab.
3. Check the box next to the filename you want to restore, then click Restore.

Part 2: Change the Detection Configuration for the files (if necessary)
1. In the PC Security setting screen, click the 'Block/Allow Files' tab.
2. If a file you want to use is in the list, make sure the 'Allow' radio button is selected.
3. If the file is not in the list, click the 'Add file' button.
4. Navigate to the file and click Open.
5. Make sure the item is set to "Allow" in the list.

Part 3: Verify that the related processes are set to "Allow"
1. From the main Webroot SecureAnywhere window click on the cog icon next to 'Utilities'.
2. Open the 'System Control' tab.
3. Under Control Active Processes, click 'Start'.
4. Find the active process(es) in the list. If they are not already set to "Allow", please change the setting.

Devin T Byrd
Mac Threat Research Analyst  Kind Regards,

Reply