kac7799

Q: why does MacKeeper ad keep popping up and its not installed on my mac

MacKeeper ad keeps popping up.  Its not installed in my apps

MacBook Pro, OS X Mavericks (10.9.4)

Posted on Aug 16, 2014 5:09 PM

Close

Q: why does MacKeeper ad keep popping up and its not installed on my mac

  • All replies
  • Helpful answers

Page 1 Next
  • by a brody,

    a brody a brody Aug 16, 2014 5:13 PM in response to kac7799
    Level 9 (66,781 points)
    Classic Mac OS
    Aug 16, 2014 5:13 PM in response to kac7799

    You may have inadvertently installed it:

     

    http://discussions.apple.com/docs/DOC-3036

     

    Macupdate and other Mac related sites indiscriminately advertise it, and while you can block popups with Safari, Firefox has a much better popup blocker.

    A few ad blocker software titles exist for the Mac, but they frequently need updating with either the operating system updates or the browser update.

  • by Kappy,

    Kappy Kappy Aug 16, 2014 5:15 PM in response to kac7799
    Level 10 (270,190 points)
    Desktops
    Aug 16, 2014 5:15 PM in response to kac7799

    The Safe Mac » Adware Removal Guide

    How to Remove MacKeeper


    Uninstalling Software: The Basics

     

    Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash.  Applications may create preference files that are stored in the /Home/Library/Preferences/ folder.  Although they do nothing once you delete the associated application, they do take up some disk space.  If you want you can look for them in the above location and delete them, too.

     

    Some applications may install an uninstaller program that can be used to remove the application.  In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.

     

    Some applications may install components in the /Home/Library/Applications Support/ folder.  You can also check there to see if the application has created a folder.  You can also delete the folder that's in the Applications Support folder.  Again, they don't do anything but take up disk space once the application is trashed.

     

    Some applications may install a startupitem or a Log In item.  Startupitems are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder.  Log In Items are set in the Accounts preferences.  Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab.  Locate the item in the list for the application you want to remove and click on the "-" button to delete it from the list.

     

    Some software use startup daemons or agents that are a new feature of the OS.  Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.

     

    If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term.  Unfortunately Spotlight will not look in certain folders by default.  You can modify Spotlight's behavior or use a third-party search utility, EasyFind, instead.

     

    Some applications install a receipt in the /Library/Receipts/ folder.  Usually with the same name as the program or the developer.  The item generally has a ".pkg" extension.  Be sure you also delete this item as some programs use it to determine if it's already installed.

     

    There are many utilities that can uninstall applications.  Here is a selection:

     

        1. AppZapper

        2. AppDelete

        3. Automaton

        4. Hazel

        5. AppCleaner

        6. CleanApp

        7. iTrash

        8. Amnesia

        9. Uninstaller

      10. Spring Cleaning

     

    For more information visit The XLab FAQs and read the FAQ on removing software.

  • by Linc Davis,

    Linc Davis Linc Davis Aug 16, 2014 6:00 PM in response to kac7799
    Level 10 (207,926 points)
    Applications
    Aug 16, 2014 6:00 PM in response to kac7799

    You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

    Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

    Back up all data.

    Triple-click anywhere in the line below on this page to select it:

    /Library/LaunchAgents/com.vsearch.agent.plist

    Right-click or control-click the line and select

              Services â–¹ Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

    Repeat with each of these lines:

    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist

    Restart the computer and empty the Trash. Then delete the following items in the same way:

    /Library/Application Support/VSearch
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

    Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

    From the Safari menu bar, select

              Safari â–¹ Preferences... â–¹ Extensions

    Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

    This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

    You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go â–¹ Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

  • by jeffersons,

    jeffersons jeffersons Aug 19, 2014 5:15 PM in response to kac7799
    Level 1 (0 points)
    Aug 19, 2014 5:15 PM in response to kac7799

    I discovered a cause and a solution:

     

    Just recently new tabs started opening frequently in Chrome with Mackeeper ads. I hadn't installed any new software, browser extensions, etc. The intermediate site seemed to be youradexchange.com which runs javascript that launches the Mackeeper pages at mackeeper.zeobits.com or mackeeper2.zeobit.com.

     

    With some testing I discovered the problem only occurred if I clicked certain menu items or buttons on Facebook.com. One was the dropdown arrow in the upper right of http://facebook.com (when logged in). The other I noticed was at http://www.facebook.com/friends — the edit button with the pencil icon to the right of the +Friends button. Here are images of those two areas:

     

    Screen Shot 2014-08-19 at 7.34.13 PM.png

    Screen Shot 2014-08-19 at 7.35.35 PM.png

     

    The solution:

    I did a process of elimination with the Chrome extensions I had installed and was able to identify the culprit as News Ticker Remover 3.2. It is an extension for hiding the news ticker on Facebook that I had used a long time without any problem. Using Chrome's Javascript Console (Tools > Javascript Console) I was able to see that a script was being inserted into the page:

     

    The page at 'https://www.facebook.com/[screenname]?sk=friends&list=1' was loaded over HTTPS, but ran insecure content from 'http://www.xlbz.com/adserver/imp.html': this content should also be loaded over HTTPS.

     

    Disabling News Ticker Remover 3.2 solved the problem. Note that this extension no longer appears to be available in the Chrome store and Facebook no longer has a news ticker (which I didn't realize because I had been blocking it with that extension).

  • by a brody,

    a brody a brody Aug 20, 2014 3:52 AM in response to jeffersons
    Level 9 (66,781 points)
    Classic Mac OS
    Aug 20, 2014 3:52 AM in response to jeffersons

    Thanks for isolating the problem.  I've linked to this thread so others may benefit from the user tip 3036.

  • by sam2588,

    sam2588 sam2588 Nov 5, 2014 1:34 PM in response to Linc Davis
    Level 1 (0 points)
    Nov 5, 2014 1:34 PM in response to Linc Davis

    Thank you for this. It still works even in november. It got so bad with my browsers that I couldn't open a single tab without having 3-4 ad tabs opening up next to it. It works fine now

  • by ryanalevy,

    ryanalevy ryanalevy Nov 11, 2014 5:16 PM in response to Linc Davis
    Level 1 (0 points)
    Nov 11, 2014 5:16 PM in response to Linc Davis

    Thank you so much! This worked!

  • by cinnamonpsycho,

    cinnamonpsycho cinnamonpsycho Nov 13, 2014 7:39 AM in response to jeffersons
    Level 1 (0 points)
    Nov 13, 2014 7:39 AM in response to jeffersons

    I dont have this extension that u speak of but am still copping this mackeeper ********, any ideas?

  • by EllieLeftFoot,

    EllieLeftFoot EllieLeftFoot Nov 15, 2014 7:31 AM in response to jeffersons
    Level 1 (0 points)
    Nov 15, 2014 7:31 AM in response to jeffersons

    hi

    this is happening to me.

    when you say disable news ticker remover - how do i do this?

    thanks in advance

  • by JPPhotography,

    JPPhotography JPPhotography Nov 20, 2014 10:48 AM in response to Kappy
    Level 1 (0 points)
    Nov 20, 2014 10:48 AM in response to Kappy

    You da man Linc.

  • by a brody,

    a brody a brody Nov 20, 2014 6:02 PM in response to cinnamonpsycho
    Level 9 (66,781 points)
    Classic Mac OS
    Nov 20, 2014 6:02 PM in response to cinnamonpsycho

    Cinnamon and Ellie,

    Both please start a new topic thread for yourselves. with your questions.  Trailing another thread, you won't get as many responses to solve your problem.

  • by hMne.,

    hMne. hMne. Nov 23, 2014 1:51 AM in response to Linc Davis
    Level 1 (0 points)
    Nov 23, 2014 1:51 AM in response to Linc Davis

    @Linc Davis : Awesome! it worked.. Thanks so much.. u saved my time.

  • by Vetteman56,

    Vetteman56 Vetteman56 Nov 26, 2014 7:13 AM in response to Linc Davis
    Level 1 (0 points)
    Nov 26, 2014 7:13 AM in response to Linc Davis

    Brilliant Linc D….. Thanks so much …. ALL FIXED - STRESS GONE.

  • by dgjie,

    dgjie dgjie Dec 7, 2014 4:00 AM in response to kac7799
    Level 1 (0 points)
    Dec 7, 2014 4:00 AM in response to kac7799

    I don't have these files

    /Library/LaunchAgents/com.vsearch.agent.plist

    etc.

     

    I either don't have the chrome extension

     

    But MacKeeper still keeps popping up. 

    It always opens two new tabs in Chrome

     

    Anyone another solution? 

Page 1 Next