URGENT HELP! NEED TO GET RID OF MACKEEPER VIRUS BUT ACCIDENTALLY ALREADY MOVED IT TO TRASH AND EMPTIED TRASH BEFORE KNOWING THAT I NEEDED TO UNINSTALL IT THE RIGHT WAY!

[Please note this thread is quite old. Original posts contained links to Adware Medic that no longer exists. It's now call Malwarebytes.]

MacKeeper is not a virus. If you had read through the previous post you will see it's adware not a virus.

Force quIt your Mac. Hold down the power button until it quits. If you don't hold down long enough it just goes into sleep mode.

Restart in Safe Boot mode.

Follow these steps to start up into safe mode.

1. Start or restart your Mac.

2. Immediately after you hear the startup sound, press and hold the Shift key.

3. Release the Shift key when you see the Apple logo appear on the screen.

If you still have the MacKeeper installer in the trash or downloads folder run it and select uninstall.

Also see Apple's info on removing adware.

Stop pop-up ads and adware in Safari - Apple Support

If you continue to have issues, download EtreCheck. Paste the results in your reply.

http://www.etresoft.com/etrecheck

I Hope this reply finds you as you posted your reply/question some time ago. I'm having the exact problem you described with the two keychain windows popping up upon a restart. I'm actually typing this on my iPad because my desktop iMac is unusable, thx to this virus, I'm assumin. Could you please respon, especially if you were able to remedy the proble.

thankyou

Pete

My previous post was in regard to this reply on page 2 of this thread...

prompted to restart my computer, which I did, but after logging in I get two windows popping open about my keychain. The first says ' the system was unable to unlock your login keychain' and gives me three options : continue login, create new keychain and update keychain password. The second window lists various programs that want use my login keychain such as com.apple.icloudhelper.xpc, accountsd, identityservicesd, cloudd, etc.

...please help, thank you!

help me pleaseee.. i do identically download that mackeeper and when I'm installing the program my internet suddenly eror and the installation were eror too after that i just know if that program were virus and i can't quit the installation or shuting down the mac... help me please

Delete the following files:

Go to the User's Library folder. This folder is hidden by default. To unhide: Select the Finder in the Dock. Under Go in the Menu bar > hold down the Option key and you’ll see the Library.

Home/Library/Caches/com.zeobit.MacKeeper

Home/Library/Caches/com.zeobit.MacKeeper.Helper

Home/Library/LaunchAgents/com.zeobit.MacKeeper.Helper

Home/Library/LaunchAgents/com.zeobit.MacKeeper.plugin.Backup.agent

Home/Library/Preferences/com.zeobit.MacKeeper.plist

Home/Library/Preferences/com.zeobit.MacKeeper.Helper.plist

Warning: Only files containing the words ‘zeobit’, ‘MacKeeper’, ’911′, or ’911bundle’ should be deleted.

(In Mail Library folder, check LaunchAgents and LaunchDaemons just to be safe)

Go to Applications -> Utilities -> Keychain Access and open it. Unlock the Keychain and enter your Administrator password. You need to remove any items in the Keychains that contain ‘MacKeeper’ or ‘zeobit’.

Open Activity Monitor, and choose to view ‘All processes’. Check to see if any processes called ‘MacKeeper’, ‘zeobit’ or ’911 bundle’ are still running. Older versions of MacKeeper might have a ‘WINE’ process. If you see any of these, click on the process and hit ‘Quit Process’.

Finally, go to your Applications folder and remove MacKeeper.app by moving it to the Trash. You should also unpin it from your Dock by dragging it off.

Empty the Trash by clicking on Finder -> Empty Trash.

In System Preferences -> Users & Groups (or ‘Accounts’ if you’re using OS X Snow Leopard 10.6) -> Login Items. If MacKeeper or anything related to it is listed there, highlight it and click the ‘-’ button to remove it.

Awesome answer.

I think I got the same virus from a "flashback trojan", I guess.

MacKeeper is hijacking the safari browser, and takes me to one of several sites, tuneupmymac.com, detoxmymac.com, and the MacKeeper has hijacked the opening screen of safari, which should be google.com, but is now "onlysearch.com" or "only-search.com", which has a little icon in the lower left of the screen. Click on it, and BAM they want to help you "Get a Faster Mac with TuneupMyMac.com", and now goes also to "bulletflix.com" advancedmaccare.com (MacBooster)... It's getting out of control.

I am running OS X 10.9.5, the computer 2 is months old, and I switched to Mac from windows because windows is the worst program/OS imaginable.

I followed the instructions above and have looked in all folders on the hard drive, everywhere, and there is nothing in the caches, LaunchDaemons, LaunchAgents, Preferences, or in any folder.

___However, i have used the apple diagnostics and found that two permissions are being changed. So I repair them, and then after I relaunch the program, again, mysteriously, the permissions are again altered.

I am going to run AVAST and ClamXav...

Can anyone provide further support?

Thank you for your thoughts.

javascript:void(0);

Download the AdwareMedic removal tool

http://www.adwaremedic.com/index.php

See his notice in red at the top. Most likely you will need to use his direct link:

http://www.adwaremedic.com/AdwareMedic.dmg

I am going to run AVAST and ClamXav...

These will not help you.

Thank you very much!!!! After an accidental click, losing 24 hours & pulling my hair out, you saved my bacon.

Forever grateful 😀

Thanks!

tried so many other things and after all http://www.adwaremedic.com/AdwareMedic.dmg did the trick

!! STAY AWAY FROM MACKEEPER!!! IT'S NASTY ADWARE !!

you are my hero! i was going crazy.. why did i have to be so stupid and click that link in the first place.

Thank you thank you thank you!!!!

I've been having the same issue, and found most of the files you listed to delete. However, when I try to stop MacKeeper in my Activity Monitor, it refuses to quit. I checked a few other programs to make sure they would stop running through Activity Monitor, and they quit fine. But even using Force Quit on MacKeeper doesn't stop it. Any ideas on this?

Under the Apple in the Menu bar, select Log Out.

When you Log in, hold the Shift key down. This disables all login items.

Now see if you can quit in Activity Monitor.

If this fails do a Safe Boot and remove.

* shutdown

* start the Mac and *wait* for the startup chime to sound

* after the sound, press and hold down the shift key

* keep holding and *wait* until the grey  Apple logo appears

* now release the shift key and just wait (it could take a few minutes)

* eventually the login screen appears with the words SAFE BOOT

* continue to login

I have found the library, but there doesn't seem to be any of the files you are saying to delete. Any ideas or suggestions what to do?

It's possible there are no files to remove. You can download the installer again and run the uninstaller that's included.

http://mackeeper.zeobit.com/uninstall_mackeeper

Another option would be to download AppCleaner. When you run it, you will see all the files associated with the app. You can cancel or select delete.

accidentally downloaded mackeeper and once i found out it was a virus immediately i moved it to the trash and emptied the trashbin

Badly written and unnecessary software, but it is not a virus.