Remove unwanted adware that displays pop-up ads and graphics on your Mac. https://support.apple.com/en-us/HT203987

remove_malware.sh

#!/bin/bash
echo "Remove unwanted adware that displays pop-up ads and graphics on your Mac"
echo "https://support.apple.com/en-us/HT203987"
echo ""

# 1. Downlite, VSearch, Conduit, Trovi, MyBrand, Search Protect, Buca Apps
echo "1. Remove Downlite, VSearch, Conduit, Trovi, MyBrand, Search Protect, Buca Apps"
echo ""
malware[0]="/System/Library/Frameworks/v.framework"
malware[1]="/System/Library/Frameworks/VSearch.framework"
malware[2]="/Library/PrivilegedHelperTools/Jack"
malware[3]="/Library/InputManagers/CTLoader/"
malware[4]="/Library/Application\ Support/Conduit/"
malware[5]="~/Library/Internet\ Plug-Ins/ConduitNPAPIPlugin.plugin"
malware[6]="~/Library/Internet\ Plug-Ins/TroviNPAPIPlugin.plugin"
malware[7]="/Applications/SearchProtect.app"
malware[8]="/Applications/WebTools.app"
malware[9]="/Applications/cinemapro1-2.app"
malware[10]="~/Applications/cinemapro1-2.app"

# check the malware
file_is_found=false
for ((i=0; i<${#malware[@]}; i++)); do
    malware=${malware[$i]}
    if [ -e "$malware" ] ; then
        rm -rvf "$malware"
        file_is_found=true
    fi
done
if [ $file_is_found == true ] ; then
    echo "The items above are removed. Please restart your Mac now."
    exit
fi


# 2. Genieo, InstallMac
echo "2. Remove Genieo, InstallMac"
echo ""
echo "Open 'Activity Monitor'."
echo "If you see a process named 'Genieo' or 'InstallMac,' select it and click the Force Quit button (x) in the upper-left corner of the window."
read -p "Click 'ENTER' to continue with the other steps in this section. "
echo ""
malware="/private/etc/launchd.conf"
if [ -e "$malware" ] ; then
    rm -rf "$malware"
    echo "$malware has been removed. Please restart your Mac now."
    exit
fi

malware[0]="/Applications/Genieo"
malware[1]="/Applications/InstallMac"
malware[2]="/Applications/Uninstall\ Genieo"
malware[3]="/Applications/Uninstall\ IM\ Completer.app"
malware[4]="/usr/lib/libgenkit.dylib"
malware[5]="/usr/lib/libgenkitsa.dylib"
malware[6]="/usr/lib/libimckit.dylib"
malware[7]="/usr/lib/libimckitsa.dylib"
malware[8]="/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client"
malware[9]="~/Library/Application\ Support/Genieo/"
malware[10]="~/Library/Application\ Support/com.genieoinnovation.Installer/"

# check the malware
file_is_found=false
for ((i=0; i<${#malware[@]}; i++)); do
    malware=${malware[$i]}
    if [ -e "$malware" ] ; then
        rm -rvf "$malware"
        file_is_found=true
    fi
done
if [ $file_is_found == true ] ; then
    echo "The items above are removed. Please restart your Mac now."
    exit
fi

malware="/Library/Frameworks/GenieoExtra.framework"
if [ -e "$malware" ] ; then
    rm -rf "$malware"
    echo "$malware has been removed. Please restart your Mac now."
    exit
fi

# 3. Optionally remove other adware files
echo "3. Optionally remove other adware files"
echo ""
rm -rvf "/Library/LaunchAgents/com.genieo.completer.update.plist"
rm -rvf "/Library/LaunchAgents/com.genieo.engine.plist"
rm -rvf "/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist"
rm -rvf "/Library/LaunchAgents/com.genieoinnovation.macextension.plist"
rm -rvf "/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist"
rm -rvf "/Library/LaunchDaemons/Jack.plist"
rm -rvf "~/Conduit/"
rm -rvf "~/Trovi/"
rm -rvf "~/Library/Application\ Support/webHelperApp/"
rm -rvf "~/Library/Caches/com.Conduit.takeOverSearchAssetsMac"
rm -rvf "~/Library/Caches/com.VSearch.bulk.installer"
rm -rvf "~/Library/Caches/com.VSearch.VSinstaller"
rm -rvf "~/Library/cinemapro1-2/"
rm -rvf "~/Library/LaunchAgents/com.genieo.completer.download.plist"
rm -rvf "~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist"
rm -rvf "~/Library/LaunchAgents/com.genieo.completer.update.plist"
rm -rvf "~/Library/LaunchAgents/com.webhelper.plist"
rm -rvf "~/Library/LaunchAgents/com.webtools.uninstaller.plist"
rm -rvf "~/Library/LaunchAgents/com.webtools.update.agent.plist"
rm -rvf "~/Library/LaunchAgents/Safari\ Security"
rm -rvf "~/Library/LaunchAgents/UpdateDownloder"
rm -rvf "~/Library/LaunchAgents/WebServerSocketApp"
rm -rvf "~/Library/Preferences/com.genieo.global.settings.plist.lockfile"
rm -rvf "~/Library/Preferences/com.geneio.settings.plist.lockfile"
rm -rvf "~/Library/Preferences/com.geneio.global.settings.plist"
rm -rvf "~/Library/Saved\ Application\ State/com.genieo.RemoveGenieoMac.savedState"
rm -rvf "~/Library/Save\d Application\ State/com.VSearch.bulk.installer.savedstate"
rm -rvf "~/Library/WebTools/"

# 4. Some files have names that can vary. Follow these steps to remove them.
echo "4. Remove some files have names that can vary."
echo ""
rm -rvf "/Library/LaunchDaemons/com.*.daemon.plist"
rm -rvf "/Library/LaunchDaemons/com.*.helper.plist"

cd "/Library/Application Support/"
for malware in `find /Library/LaunchAgents/ -name "com.*.agent.plist" | awk -F"." '{print $3}'` ; do
    ls | grep $malware | xargs rm -rvf
done

cd /Library/LaunchAgents/
rm -rvf "com.*.agent.plist"
rm -rvf "com.*.daemon.plist"
rm -rvf "*_enabler.plist"
rm -rvf "*_enabler.sh"
rm -rvf "*_updater.plist"
rm -rvf "*_updater.sh"
rm -rvf "*.ver"
rm -rvf "com.crossrider.wss*.agent.plist"
rm -rvf "com.extensions.updater*.agent.plist"

# 5. Remove Listchack, Texiday
echo "5. Remove Listchack, Texiday"
echo ""
rm -rvf "~/Library/Application Support/Listchack"
rm -rvf "~/Library/Application Support/Texiday"
rm -rvf "~/Library/LaunchAgents/Listchack.*.plist"

echo "Successful!!"