Why can I not delete MacKeeper even after following its uninstall instructions several times?

From what you describe you may have inadvertently installed adware. Eradicating it is simple. For an explanation or how this may have occurred, how to avoid it in the future, and for one possible solution read How to install adware.

If you have reason to believe you actually installed MacKeeper, read the following.

Follow these instructions to uninstall MacKeeper. They have been tested with the most recent version of MacKeeper. Earlier versions than the one released in 2012 require more extensive work to uninstall all its components.

If you actually used MacKeeper to alter your system, e.g. "remove excess binaries" or such, you will need to reinstall OS X as well as all your additional software. Uninstalling MacKeeper is insufficient to reverse the corruption it is capable of - once again, that is if you used it.

If you merely installed MacKeeper but did not use it to perform any particular action, the following instructions will suffice.

• If you used MacKeeper to encrypt any files or folders, use MacKeeper to un-encrypt them first.
• Quit the MacKeeper app if it is running.
• Open your Applications folder: Using the Finder's Go menu, select Applications.
• Drag the MacKeeper icon from your Applications folder (not the Dock) to the Trash.

You will be asked to authenticate (twice):

You do not need to provide a reason for uninstalling it:

Just click the Uninstall MacKeeper button. You will be asked to authenticate again.

After it uninstalls you may empty the Trash and restart your Mac. All that will remain is an inert log file that does nothing but occupy space on your hard disk.

Download and run the adware removal tool here > The Safe Mac » Adware Removal Guide

Easy, safe, and only takes a minute or two.

You haven't installed MacKeeper, so you can't remove it. You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

I don't usually do this, but I joined just to say thank you. I finally got rid of the mackeeper! 🙂 THANK YOU THANK YOU THANK YOU X BILLIONS AND GAZILLION TIMESSSSSSSSSSS

Hi Kenneth,

The effects of the particular adware you may be suffering from can make Internet browsing very cumbersome, and even attempting to open the link above will be frustrating when every page you attempt to load is being redirected to another one.

The removal instructions excerpted from that document follow below.

Beware that they apply only to the particular adware in question, will not eradicate others, and will not remain valid in the future, when the adware in question eventually changes. Adware authors are well aware that their garbage is not welcomed by end users, and are always seeking new and creative ways of imposing it upon them.

If the recovery procedure does not immediately rectify the problem, you are suffering from something else. Write back for recommendations.

Recovery procedure

• Quit Safari if it is running. Force-quit Safari if you cannot quit normally.
• Quit the MPlayerX application if it is running.

Next:

Select the entire line that follows (triple-click to select it), then control-click, and from the contextual menu that appears, select Services > Reveal in Finder:

/Library/Application Support/VSearch

Drag the file that appears to the Trash. You will need to authenticate to make this change.

Repeat the above instructions with each of the following files. If a dialog box appears stating "The operation can’t be completed because the item can’t be found" click OK and proceed to the next one in the list:

/Library/LaunchDaemons/com.vsearch.daemon.plist

/Library/LaunchDaemons/com.vsearch.helper.plist

/Library/LaunchAgents/com.vsearch.agent.plist

/System/Library/Frameworks/VSearch.framework

~/Library/Saved Application State/com.VSearch.bulk.Installer.savedState

To completely delete MPlayerX's remaining components continue with the following.

Note: be sure to read below regarding MPlayerX though. That program itself is unrelated to the problem.

~/Library/Application Support/MPlayerX

~/Library/Saved Application State/org.niltsh.MPlayerX.savedState

~/Library/Preferences/org.niltsh.MPlayerX.plist

Next:

• Drag the downloaded MPlayerX.dmg file from Downloads to the Trash.
• Drag the MPlayerX icon from Applications to the Trash. You will need to authenticate.
• Empty the Trash.

Next: Launch Safari and select Preferences from the Safari menu.

• Select the Extensions tab and uninstall any Safari Extensions that you do not recognize or are uncertain if you need them.

  By default Safari uses no Extensions. None are required for normal operation.

• Select the Privacy tab and reset the selection for "Block cookies and other website data" > From third parties and advertisers
• Select the General tab and reset your Homepage to your desired one.
• Review all other Safari Preferences to determine if anything else may have been changed.

Safari should then be restored to normal.

MPlayerX is not malware. It is a legitimate program that does not modify OS X. It doesn't require a password to install. It demands no acceptance of pages upon pages of incomprehensible legalese as a condition of its use. I have no idea how it came to be associated with the specific adware discussed in this document, nor is there any reason to believe its developer has agreed to that relationship. The lesson to be learned is that any legitimate program distributed through the Internet can be effectively hijacked by nefarious individuals to be bundled with malware no reasonable person would want.

If you want something that isn't available from the App Store, always obtain it from legitimate sources. As of this writing that happens to be http://mplayerx.org for MPlayerX. To remove it, merely drag it to the Trash. It requires no uninstallation procedure.

Moreover, If they were a simple repetition of MacKeeper’s instructions how to delete it, it would not work also.

Bear in mind the caveat I posted: "Earlier versions than the one released in 2012 require more extensive work to uninstall all its components." Also, if MacKeeper was incompletely removed by failing to precisely follow its uninstallation instructions, you may need to install it for the sole purpose of uninstalling it in the correct manner. MacKeeper's latest version uninstalls itself quite effectively. It's the one thing it does well.

I have no experience with earlier MacKeeper versions and can't help with them. As I recall some users recommended nothing short of completely erasing the systems affected by it.

This worked for me. Great Answer. Finder - Go - Apps - and take Mackeeper to the trash.