Genieo and other Adware comes with Flash?

[Studio Pearson]

Hey!

What the hell?  Did I install an incorrect version of Adobe Flash?

When I wet to www.get.adobe.com/flashplayer/blah blah blah to install flash, I was given an installer that had, included in it, a bunch of adware that ultimately highjacked my browser and installed two very malicious adware's that I in no way would have ever wanted and it's very disingenuous and unprofessional to assume I would.

Is this a fake installer?  At the end of the day, the Flash it was trying to install was v. 13.0 when in fact, we're up to v. 14.0.  Could it be that adobe doesn't have the latest flash?

Anyway, will someone please tell me if this was Adobe's doing or some adware company.

FOR THOSE OF YOU TRYING TO UNINSTALL GENIEO AND THE SETTING THAT REDIRECTS  YOUR BROWSER!!!

First, go in to your applications folder and find the Genieo uninstaller.  It works.  If you Google this, someone in a forum somewhere has listed a bunch of file names that are to root folders for the whole program if you want to double check to see if the uninstaller did it's job.  I found that it did.  But don't trust them... they're clearly scumbags.

Second, the redirect is caused by a third party plug in that's in your browsers "extensions" settings which is in the preferences.  Simply find the thing called Omnibrowser and remove it or just turn it off.  It should be from a shady company called Installmac.

Either way, F@$k those guys.  Thank God I declined on that other thing that want's to "clean" your mac for you.... I saw an installer quickly appear, then disappear on my desktop before asking me if I wanted to install all of these useless programs.

Dear Adobe,

If you did this... WTF??!!!!!!!!!  Why, in a million years, if I were looking to upgrade my Flash player, would I want all of that other crap.  As if I'm just some dumb consumer who needs you to suggest the things I need and don't need.  Mind your business and stick to making singular programs that are amazing... not malicious adware.

And if it wasn't you, you really need to Google "Adobe Flash", and click on one of the first few links that appears... you'll find an installer that has all of this shit in it. 

Either way, f*ck Genieo and that shi!ty omnibrowser thing it comes with. 

Best,

Jeff

[_maria_]

Hello,

I'm sorry you installed malware/adware from a URL that appeared to be from Adobe, but was not.  The URL www.get.adobe.com/flashplayer/blah blah blah (prefaced by 'www') is not the Flash Player download URL.  Flash Player is delivered from http://get.adobe.com/flashplayer (no 'www' in the URL).  We also do not bundle/install Genieo with the Flash Player installer.

If you happen to have the full URL to this website (probably still in your browser history, unless you removed it), I'd appreciated it if you could post it here. I'll forward it to the appropriate folks to investigate and take appropriate action.

Thank you in advance.

--

Maria

[Studio Pearson]

The main one is this:

http://adobe-flash-player-non-ie.onfreedownload.com/download/file/id/1225261/os/mac/?lp=adwords&tg=us&kw=1&mt=p&ad=38539238453&pl=&ds=s&uid=140905912942b021b94a76090443ec8171726fc693&_ga=214465762.1409059130&gclid=CjwKEAjw4PCfBRCz966N9pvJ4GASJAAEdM_KN9EJ3uOkFAzGqNWoedF-CFf_BKp8s0m6dczX29VlyxoCyXPw_wcB

Some others are:

http://us.download-update.org/pd/147/344/

http://www.download-update.org/lp/adobe-flash/342/?_u=8urqgr4ui3ai81bl2j7qni4f3a6vfig0uffe2oi17r89mu5g8nt1-257e3a5f108a54d2cb282081664a182e

[pwillener]

Thank you for providing these URLs.  These are not websites that are in any way associated with Adobe.

You should not download Adobe software from any sites that are not on the adobe.com (or macromedia.com) domain.

[Studio Pearson]

No problem...

Yes! Lesson learned... However, when you google "Flash Player" it's the

top hit... or at least it was. I think it's sponsored.

[_maria_]

hi cannedpears,

I searched for genieo after replying to you yesterday and the first hit I got was the valid download URL from Adobe (get.adobe.com/flashplayer).  Google's search results take the users's search history into account when displaying their search results, so that could be why I didn't get it.  Either way, I went through a bunch of the results I got and obtained numerous websites linking to this fake installer (and others) and forwarded to the appropriate folks to follow-up on.  I didn't come across the URLs you posted, so, thank you for posting them and I will forward them as well to be acted upon.

With Flash Player being a popular software, many unscrupulous folks attempt to host the installers, and sometimes, inject these malicious software with the installer they host.  Once we become aware of these sites we do follow-up on them as the only valid installers are posted to adobe.com (currently this would be get.adobe.com, get3.adobe.com or www.adobe.com).  I understand sometimes it's difficult to tell.  I've seen some screenshots of installers where people have gone to great lengths to copy the official installer UI branding making them look very similar to the official ones to the unsuspecting folks out there.  Thanks again for your assistance in providing these fake URLs.

--

Maria

[mslizzieemily]

Okay, so this happened to me on Safari on OSX. I got a prompt when watching Netflix to install a Flash Player update. Was directed to the proper website and installed a .dmg file, which now that I look at it the file name is a bit dodgy. In any case it installed a piece of adware called Searchtab which changed my search from whatever I put as default to Yahoo.

Here are some screen shots:

Can anyone verify if this is the proper file name? We tried the same website on another computer and got the same file. I did this today (27/08/2014) and the "date added" is 22/09/2014. So I'm a little confused about that as well. It *should* be today's date.

Website we went to was:

Thanks!

[_maria_]

Hi mslizzieemily,

That all looks legit, except for the adware part.  The file downloaded from get.adobe.com/flashplayer is a shim installer that installs Flash Player (only, unless you elect to install a special offer, which, based on the screenshot you did not). The shim installer does have an odd name, but that one is the same I get when I download the shim installer from get.adobe.com/flashplayer.  Can you do the following:

• open terminal (/Applications/Utilities/Terminal)
• type: md5 (then space)
• then drag and drop the installer DMG onto the Terminal window and click Enter
  • If you saved the DMG to the desktop, it should look similar to:
    md5 /Users/UserID/Desktop/AdobeFlashPlayerInstaller_15_ltrosxd_aaa_aih-2.dmg
• The MD5 value for this particular shim installer is 0f80f4596871258c0f8fd5b58224adef.  Please confirm that what you get is this same value.

Did you by chance install something else around the same time?

--

Maria