MacKeeper/Zerobit Pop Up ad Problem

Whew! What a relief. Thanks again!

hi!

I stupidly downloaded mackeeper. I deleted the app and emptied the trash. But I am still getting the messages in my console app.

PLEAASSEEE help me get them off and stop reappearing??!?!?!

fitcs0110 wrote:

hi!

I stupidly downloaded mackeeper. I deleted the app and emptied the trash. But I am still getting the messages in my console app.

PLEAASSEEE help me get them off and stop reappearing??!?!?!

'Fraid you have a job ahead of you. Best instructions are on Phil Stoke's blog how to uninstall MacKeeper.

My particular issue is with the advertisement. I have never downloaded this piece of garbage, but the poup ad was still bothering me.

Although this technique won't prevent a popup window, it will at least prevent the dreaded mackeeper ad. I felt I may have gone crazy if I heard "On this page you can download MacKeeper" once more.

1. Applications -> Utilities -> Terminal

2. Type sudo nano /etc/hosts

3. Paste these 2 lines at the bottom:

127.0.0.1 zeobit.com

127.0.0.1 mackeeperapp.zeobit.com

4. Hit Control-x, then y, then enter to save

5. Type dscacheutil -flushcache into terminal

6. Restart Safari.

cmd-W does not close this new MacKeeper window. It is not a popunder, as it popped up infront of my Safari sessions. It looks like a system alert and it can not be dismissed without clicking the OK button to install MacKeeper. The window can not be closed using cmd-W. I have never downloaded or installed MacKeeper, and this thing has paralyzed Safari. The site it appears I got it from is http://out.popads.net. It appears to perhaps be a popout? Is this a new kind of malware/spyware/virus/annoyware? A popout?

cmd-W does not close this new MacKeeper window, it pops up in front of all your current Safari sessions, and appears exaclty like a system alert. Again, it can not be dismissed by cmd-W. It can only be dismissed without forcing a quit by clicking the OK button int he dialog box to consent to installing MacKeeper. In my book, then, it is neither a popup nor a popunder. It is definitely malware and it is something Apple should have engineered Safari to guard against.

FYI, I have never downloaded or installed MacKeeper. The site it appears I got it from is http://out.popads.net. The page loaded is popOut.php. Is this a new kind of nuisance? A PopOut?

Since your problem has absolutely nothing to do with the rest of this tread, you really should start your own thread rather then tagging on to the bottom of this one.

Allan

I have confirmed the issue with the technical support of the websites that serve the advertisement. While you are free to contribute to the conversation. I have identified the issue and shown a website to replicate the issue.

It is a popunder created by Zerobit and marketed to websites so they can force ads to those that do not pay subscription fees and have pop up blockers. The ads (pop unders) are not malicious in and if themselves but do place a cookie that tracks your web browsing and reports it back to the site serving the pop under. In my case, it was greenvilleonline.com

I'm sorry, Allen. I mistook the title of this thread to be "MacKeeper/Zerobit Pop Up ad Problem." Yes, I will go elsewhere to discuss my problem with the Zeobit-sponsored MacKeeper Pop Up Ad Problem, and its newly escalated behavior of not being dismissable.

SKHRAM: are you crazy??? never put in those lines into the hosts file: the first line should read

127.0.0.1 localhost

and the second line should not be there at all.

ALARM everybody: DO NOT FOLLOW skhram's advice.

Stephen, I switched off all Safari plugins and visited

http://out.popads.net., refreshed the page a few times, and never got any kind of pops.

pete

Allan, how is this thread not about MacKeeper/Zerobit?

pete

Lex, if you add those two lines at the end of the file, as stated, then the effect will be to force lookups for those addresses to resolve to "localhost," which essentially disables all communication with those servers (unless contacted via IP address directly). Still, editing the hosts file is not the best idea for solving this problem, as it requires a bit of technical know-how. Novices should not go poking around in there.

LexSchellings wrote:

SKHRAM: are you crazy??? never put in those lines into the hosts file: the first line should read

127.0.0.1 localhost

and the second line should not be there at all.

ALARM everybody: DO NOT FOLLOW skhram's advice.

I am most certainly not crazy. As Thomas elaborated on, it's an extremely simple concept. Loopback the site to your localhost, disabling communication with their server.

I don't think your outrage is necessary, espcially since you either don't know what you're talking about, or didn't read the post.

I was having a problem a bit like this with my mums Macbook Pro (laptop).
A window kept on opening and saying that she had won something. It would only let you press continue, no other things. So we tried force quitting then restarting but it opened to the EXACT same page when I had opened safari again.
In the end, I turned off the internet access (in this case, wifi) and then opened safari. I there for could go to my safari preferences and everything along that top bar.

I then clicked 'reset safari...'

It deleted all my safari history, saved passwords, favourited websites etc and then quit safari.
I then opened safari and it went straigh to google (my home page).
And there was no sign of the previous pop-up virus thingo.
I hope this helps someone.
Good luck!