Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Annoying MacKeeper ads

I am having annoying ads/pop-ups on my MacBook Pro that redirect me to install Mackeeper. (Some words on websites turn green, when I scroll over these words, a pop-up comes up that says: protection and security for you MacBook download now! mackeeperapp.zeobit.com


I never installed MacKeeper, I don't want it either.

I removed al my data in Safari and I installed an adblocker.


Non of this worked. What can I do to get rid of these terrible pop-ups?

MacBook Pro, OS X Mavericks (10.9.2)

Posted on May 18, 2014 4:35 AM

Reply
17 replies

May 18, 2014 9:39 AM in response to naomiw93

You probably installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/Application Support/VSearch

Right-click or control-click the line and select

Services Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchAgents/com.vsearch.agent.plist /Library/LaunchDaemons/com.vsearch.daemon.plist /Library/LaunchDaemons/com.vsearch.helper.plist /Library/LaunchDaemons/Jack.plist /Library/PrivilegedHelperTools/Jack /System/Library/Frameworks/VSearch.framework

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

Restart the computer and empty the Trash. Don't try to empty the Trash until you have restarted.

From the Safari menu bar, select

Safari Preferences... Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised the value of Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Annoying MacKeeper ads

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.