Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Mackeeper and a plague of pop up tabs when using Safari and Chrome.

I am having difficulties with Mackeeper and a plague of pop up tabs that I believe to be associated with it, when using Safari and Chrome. Can someone please direct me how to remove it from my Mac? (before I lose my mind) thank you so much

MacBook Pro (Retina, Mid 2012), OS X Yosemite (10.10.2)

Posted on Mar 31, 2015 6:05 AM

Reply
6 replies

Mar 31, 2015 8:36 AM in response to jademermaid

Removing MacKeeper is simple, if you actually installed it. If you have reason to believe you did, write back for instructions.


You may have inadvertently installed adware. You do not need to download or install anything to fix it.


For a description of how this may have occurred, how to avoid it in the future, and for Apple's recommended actions read How to install adware. Apple's instructions are linked in the Recovery Procedure near the end of that document. Read and follow them carefully. Pay particular attention to the easily overlooked passages directing you to restart your Mac when required.

Mar 31, 2015 6:56 PM in response to jademermaid

A

There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware. Follow Apple Support's instructions to remove it.

If you have trouble following those instructions, see below.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library/LaunchDaemons

In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form

com.something.daemon.plist

and

com.something.helper.plist

Here something is a variable string of characters, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes it's a meaningless string such as "e8dec5ae7fc75c28" rather than a word. Sometimes the string is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.

If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:

/Library/LaunchAgents

In this folder, there may be a file named

com.something.agent.plist

where the string something is the same as before.

If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.

Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.

The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.

Open this folder:

/Library/Application Support

If it has a subfolder named just

something

where something is the same string you saw before, drag that subfolder to the Trash and close the window.

Don't delete the "Application Support" folder or anything else inside it.

Finally, in this folder:

/System/Library/Frameworks

there may an item named exactly

v.framework

It's actually a folder, though it has a different icon than usual. This item always has the above name; it doesn't vary. Drag it to the Trash and close the window.

Don't delete the "Frameworks" folder or anything else inside it.

If you didn't find the files or you're not sure about the identification, post what you found.

If in doubt, or if you have no backups, change nothing at all.

The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.

This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

B

If you did install "MacKeeper," see below.

"MacKeeper" is a scam with only one useful feature: it deletes itself.

First, back up all data.

Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.

If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and immediately emptying—then you'll have to reinstall it and start over.

IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.

In the Finder, select

Go Applications

from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the other functional components of the software will be deleted. Restart the computer and empty the Trash.

Quit MacKeeper before dragging it to the Trash.

Let MacKeeper delete its other components before you empty the Trash.

Don't try to drag MacKeeper from the Dock or the Launchpad to the Trash.

Don't try to remove MacKeeper while running in safe mode.

Mar 31, 2015 10:45 AM in response to Linc Davis

I would suggest that you DO download AdwareMedic. It is a very quick download and when opened will run very quickly. Suggesting that a download is more complicated or will take longer than following the multistep procedure advocated by Linc Davis should be viewed as an erroneous inference.


AdwareMedic is designed to identify numerous possible problem makers and will not be only easier to use but the chances for a successful resolution are much improved. In addition, procedures advocated by Linc Davis is simply a repeat of the second alternative that I suggested if AdwareMedic fails to rid your MBP of those pop ups. By comparison, using that alternative invites the possibility of unnecessary errors and mistakes.


So keep it fast and simple, use AdwareMedic. If there is no success, then by all means try the alternative I suggested as well as Linc davis. But the chances are that you will not need to.


This post is not under copyright and can be used in part or whole without attribution.


Ciao.

Mar 31, 2015 6:56 PM in response to jademermaid

Your question is one that usually brings out the worst of all the bad advice that circulates on this site.

Apple has provided a solution for your problem. It does not recommend, and you do not need, any program to remove adware. If someone tells you that an Apple employee has given instructions to run a program, ask him why that program is not mentioned on the Apple Support page that covers adware removal. Everything Apple has to say officially about adware is on that page. Nowhere else.

You can't trust any stranger on any website who tells you to download and run any unknown software, merely because he says it's safe. That's the mistake that caused the problem in the first place. Whether the software is safe or not is something you must decide for yourself on the basis of your own research.

You can't depend on any software to protect you from malware, or to remove it. If you don't learn how to protect yourself, you will be victimized again and again, and neither "adwaremedic" nor anything else will save you from the consequences, which may be a lot worse next time than just popup ads.

Mar 31, 2015 12:12 PM in response to jademermaid

If some one is actively discouraging you from refraining using a third party application that may well solve your problem, it should arouse questions on your part. To be sure there may be more than one solution, but should not that be presented as such rather than telling you to use an already proposed alternative.


Your best interests are not being well served and it certainly raises questions as to the motives involved in such an action.. Ask Linc Davis if he has ever used AdwareMedic or tested it? If so, then if there are dangers associated with it, should he not disclose those? Silence on his part regarding this aspect indicates that he has not done so, or if he has then there, are other reasons for his discouraging one to use AdwareMedic.


If you search these forums you will find that many, many users have used it with success and have been grateful for the advice. What has not been mentioned is that some users have had AdwareMedic recommended by Apple telephone support and technicians at some Apple store genius bars.


I have used AdwareMedic with excellent results and I fully endorse it.


Ciao.

Mackeeper and a plague of pop up tabs when using Safari and Chrome.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.