How to Remove MacKeeper Pop-ups

While those programs may help, one of the better programs is MalwareBytes, formerly called AdwareMedic, available from Thomas Reed's site at http://www.thesafemac.com and take time to read what Tom has to say about MacKeeper while there.

Thomas is a regular participant in ASC and a security researcher.

You don't need to, and should not, download anything to solve this problem. Never use any commercial "anti-virus" or "anti-malware" product that may be advertised on the Web.

You may have installed a variant of the "VSearch" ad-injection malware. Follow Apple Support's instructions to remove it.

If you have trouble following those instructions, see below.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library/LaunchDaemons

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form

com.something.daemon.plist

and

com.something.helper.plist

Here something is a variable string of characters, which can be different in each VSearch infection. So far it has always been an alphanumeric string without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes it's a meaningless string such as "e8dec5ae7fc75c28" rather than a word. Sometimes the string is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.

If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:

/Library/LaunchAgents

In this folder, there may be a file named

com.something.agent.plist

where the string something is the same as before.

If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.

Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.

The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.

Open this folder:

/Library/Application Support

If it has a subfolder named just

something

where something is the same string you saw before, drag that subfolder to the Trash and close the window.

Don't delete the "Application Support" folder or anything else inside it.

Finally, in this folder:

/System/Library/Frameworks

there may be an item named exactly

v.framework

It's actually a folder, though it has a different icon than usual. This item always has the above name; it doesn't vary. Drag it to the Trash and close the window.

Don't delete the "Frameworks" folder or anything else inside it.

If you didn't find the files or you're not sure about the identification, post what you found.

If in doubt, or if you have no backups, change nothing at all.

The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it. I don't recommend that you install the genuine "MPlayerX," because it's hosted on the rogue "SourceForge" website and is bundled with other malware.

This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Hello Divergal,

That certainly seems like an adware infection. The fastest, easiest, and safest way to remove it would be to download and run AdwareMedic from here: http://www.adwaremedic.com/index.php

This is the same software from Thomas Reed that Ralph Landry1 mentioned above. Thomas recently sold it to a larger company but the link I gave you above is still valid. I really like the software but I can't stand the new name.

The only tools that anyone needs to detect and remove adware are the Finder and a web browser, both of which you already have. Anyone who has enough computer skill to install adware can just as well remove it without using anything else.

Apple doesn't endorse any third-party "anti-virus" or "anti-malware" product. Here and here are its general statements about malware protection, and here are its instructions for removing the most common types of ad-injection malware. None of those support pages mentions anti-malware products. An Apple employee who recommends such a product is speaking only for himself or herself, not for the company. See this thread for an example of what the results can be.

You become infected with malware by downloading unknown software without doing research to determine whether it's safe. If you keep making that mistake, the same, and worse, will keep happening, and no anti-malware will rescue you. Your own intelligence and caution are the only reliable defense.

As a Mac user, I'm concerned about attempts by the Windows/Android anti-malware industry to move in on our platform. The truth is that relying on anti-malware makes us less safe from malware attack, not more, because it can't possibly defend against every threat, and if we have a false sense of security, we may take risks from which it doesn't protect us.

The Windows/Android anti-malware industry had more than $75 billion in sales in 2014 [source: Gartner, Inc.]. Its marketing strategy is to make people feel that they're defenseless against malware attack unless they use its products. But with all that anti-malware, the Windows and Android platforms are still infested with malware—most of it far more dangerous than mere adware. The same thing can be expected to happen to the Mac platform if its users depend on the same industry to protect them, instead of protecting themselves.

These are generalities. Regarding the "malwarebytes" product in particular, you may be told that there are no reports that is has caused damage. In fact, there is such a report by ASC user LizardMBP in this thread. Draw your own conclusions from that report.

You can also search this site for thousands of other comments on all kinds of anti-malware by ASC members other than myself. Below are a few examples, all quoted from different discussions.

Under no circumstances should you ever allow anti-virus software to delete something for you!

NEVER allow anti-virus software to remove files from your computer...

Anti-virus software is almost universally bad on the Mac, and isn't necessary. It won't protect you well against adware, either.

So, what is this anti-virus software protecting you from? Not a lot these days. In exchange for the very real possibility - though certainly not promise - of having trouble as a result.

Most commercial antivirus software is junk and some of it is harmful.

There will always be threats to your information security associated with using any Internet - connected communications tool... Assuming that any product will protect you from those threats is a hazardous attitude...

Antivirus software does more damage to Macs that the malware does.

We spend far more time here on the support forums cleaning up problems with antivirus software than we do cleaning up problems with viruses.

The only malicious software is the anti-virus or "clean up" software itself.

If you'd like to see links to the quoted discussions, ask.

Linc Davis wrote:

Regarding the "malwarebytes" product in particular, you may be told that there are no reports that is has caused damage. In fact, there is such a report by ASC user LizardMBP in this thread. Draw your own conclusions from that report.

It should be noted that the discussion that LizardMBP started, at your request on that thread, was filled with demonstrably false claims, and has since been removed by the moderators. Draw your own conclusions from that.

You can also search this site for thousands of other comments on all kinds of anti-malware by ASC members other than myself. Below are a few examples, all quoted from different discussions.

Some of those quotes are my own words, taken completely out of context in an attempt to make them say what you want them to say. Further, you are completely aware of the fact that these quotes are not representative of my full viewpoint, as we have had disagreements in the past when I have recommended specific third-party anti-virus solutions. I'm disappointed that you would choose such dishonest strategies to force your viewpoint on others. If there is any merit to your opinions, they should be able to stand on their own without resorting to such trickery.

You installed the "Trovi," "Conduit," or "SearchProtect" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before making any changes.

Besides the files listed in the linked support article, you may also need to remove these files in the same way:

~/Library/Application Support/Firefox/searchplugins/MyBrand.xml
~/Library/Application Support/Google/Chrome/External Extensions/fjadmdmahkpbhgbmmkiiaanlnlekelmn.json
~/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/deacruzemiliano@outlook.com

Note that when you go to remove the "SearchProtect" app in the Applications folder, you may find instead a subfolder named "SearchProtect" with several apps inside it. Remove that subfolder together with all its contents.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

"SearchProtect" may be distributed along with two other applications: "MacKeeper," which is a scam, and "ZipCloud," which, if not actually a scam, has a dubious reputation. Ask if you need instructions to remove those items.