MacKeeper hiding on speedtest.net site

Use one of the AdBlockers. I never see it there, or any ads at all, thankfully.

Use Firefox with the NoScript extension. The ad is hidden in an iFrame placed over part of the speedtest page (possibly without their knowledge), but it requires JavaScript to activate it. (Not Java - that's a far different animal and should be disabled in all browsers unless absolutely necessary)

To check for the nasties, try this;

http://applehelpwriter.com/2011/09/21/how-to-uninstall-mackeeper-malware/

Use Firefox with the NoScript extension.

noonday, problem with that is speedtest won't work unless allowed from NoScript, i.e. JavaScript must be enabled for the site. (BTW, I have NoScript set to block IFrames; they are replaced with a placeholder.) Of course, it's a good idea in general to keep things under control with NoScript, but what will keep that MacKeeper crap out of speedtest is Firefox with Adblock Plus.

Using both NoScript and Adblock Plus, I have never once seen a MacKeeper advert anywhere.

Yes, but MacKeeper's script is not the same script that you allow for Speedtest. I use Speedtest and I've never even seen the banner from my two Macs. I have from another one using Safari.

I do, of course, have Adblock Plus also, but that was already suggested by yourself, so would have been redundant for me to mention.

Yes, but MacKeeper's script is not the same script that you allow for Speedtest.

Something I'm not understanding then. This is all I'm seeing at speedtest

Just checked and you appear to be right.

Granted, it's a while since I did the original check.

AdBlock shows 2 hidden frames as well as 2 servers from .ookla

Ah, well - the JavaScript element is what it uses to download, so presumably is served from MacKeeper's own proxy when you click the ad.

You might be interested in seeing what requests speedtest is making. From RequestPolicy with all requests blocked:

doubleclick and Google I have permanently blocked anyway. MacKeeper could be being served by any of those (except Analytics). I'm still intrigued by the two hidden frames on the page.

I don't have c.speedtest currently blocked; any reason I should?

('fraid I don't have much time to play today - too many chores overdue)

FWIW, an ad for MacKeeper appears at the top of the page (when nothing blocks it) when one first opens the site page, but only if it detects that one is running a Mac "user agent" (browser). With the Safari developer menu choice set to a Windows user agent, the ad is instead for some Windows-specific utility.

This ad is served from ads.ookla.com, according to the URL that appears in Safari's status bar.

After one runs a speed test, another ad appears on the left of the results window, again for MacKeeper or the Windows utility, depending on the user agent. I'm not sure where that comes from since there is no URL shown for it.

EDIT: BTW, using Adblock for Safari blocks the ad at the top of the page, but not the one in the results.

I don't have c.speedtest currently blocked; any reason I should?

No. Flash won't load properly if blocked. Those are all cross-site requests, not scripts.

https://addons.mozilla.org/en-US/firefox/addon/requestpolicy/

I usually have it turned off -- with NoScript, Ghostery and Redirect Cleaner, just too many hoops to jump through -- but it can be useful on occasion.

FYI, since it's related, you may want to install a hosts file addition too.

Basically what this does is it resolves the IP of garbage domains BEFORE your DNS.

Thus if you assign a IP of say 0.0.0.0 (nothing) to these garbage domanin then your computer will refuse to connect to them in the first place. 🙂

This method is simple, doesn't require touching the terminal and there is a apx monthlly/bi-monthly updated free list on the internet.

1: Download the free TextWrangler from BBedit, you'll need this to edit the system file safely.

http://www.barebones.com/products/textwrangler/

2: Open TextEdit that Apple includes on all Mac's.

3: Open this page in a web browser and bookmark it for later use.

http://winhelp2002.mvps.org/hosts.txt

4: Select all the text and copy, close the browser

5: Paste into TextEdit

6: Delete these two lines near the top of the file.

127.0.0.1 localhost

::1 localhost #[IPv6]

7: Do a Find and Replace and change all instances of 127.0.0.1 to 0.0.0.0 and save the file on your desktop. Select all and copy to the clipboard.

8: Open TextWrangler and Open File By Name: /etc/hosts

DO NOT touch what you see there (ever), just move to the bottom of the file, add a few returns and Paste

9: Save the file, it will request your Admin password.

That's it, now all the crap on the Internet is blocked and your computer will refuse to connect.

You'll have to update the addition once every few months to catch the changes.