Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

The MacKeeper Virus - how do I get rid of it in SAFARI?

The Computer is a MacBook Pro 17 inch, with OS X El Capitan, version 10.11, Processor 2.66 GHz Intel core i7, memory 8 GB 1067 MHz DDR3. The Application is Safari version 9.0 (11601.1.56)


The problem is the MacKeeper virus. I was informed about two months ago that Adobe Flash Player needed to be updated. I started the process and realized I had been had for a second time. Now almost every time I click on to a website I get redirected to a new sight in a new Tab and it is a MacKeeper promo promising me that it will clean up my Mac. From past experience it does not. Even when I click with in a website it will either open up a MacKeeper promo in that website and/or dump me into a new tab with a promo. Also a page will popup with all kinds of add on it with a close (X) in the upper right hand corner. If clicked on the original page will open up.


As a secondary problem it seems to have blocked the App store program and now I cannot update any programs. I cannot even get the latest update for OS X El Capitan.


I have looked at deleting and restarting and even reinstalling El Capitan but non seem to work. The MacKeeper virus stays there.


My next step it to take the computer to The Mac Experience, a local certified repair/retail shop, and have them wipe the virus. Then I will as how to keep the virus away the next time I become soft headed concerning certain updates.


Thank you and any suggestions

MacBook Pro (17-inch Mid 2010), OS X El Capitan (10.11)

Posted on Oct 23, 2015 12:23 PM

Reply
6 replies

Sep 7, 2017 8:45 AM in response to porgeswagger

You might want to consider starting a new discussion. Since this one is a couple of years old, less people are likely to look at it. A new post would be much more visible. You can link to this one. Please post what problems you are having. Linc hasn't participated in the forums for over a year.


I would uninstall ZipCloud. It tends to interfere with the computer's operation.


ZipCloud uninstall

Spotify Uninstall

Oct 23, 2015 12:40 PM in response to TomDean1946

Never, ever click on any download from a site saying you need to update Flash, install at codec, or whatever. They are always scams to get you to install adware, or worse. There are no viruses in OS X, but you did install a Trojan. Viruses install and replicate by themselves, Trojans have to be installed by you in some way; which is what happened.


You don't have MacKeeper. You have adware bludgeoning you with ads to purchase it. You can either follow Apple's manual instructions for removing adware, or use the free automated tool, Malwarebytes Anti-Malware for Mac.


It should be noted that Apple's manual removal instructions are typically outdated. Sometimes a lot outdated. It depends on when Apple last updated their instructions page. If you would prefer to manually remove the adware on your system, you can find much more up-to-date instructions on The Safe Mac's adware removal page.


The bad news is there's no telling what else was installed with this fake Flash download. You may succeed in removing adware and all will seem fine, but you may have also installed a backdoor or keylogger. Without knowing how to find or remove them in a way you can be certain they're gone, what you should really do is erase the drive and restore a backup you made before this occurred.

Oct 23, 2015 4:55 PM in response to TomDean1946

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Some of the most common types of adware can be removed by following Apple's instructions. If those instructions don't work for you, or if you have trouble following them, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure that doesn't involve downloading anything.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

Feb 14, 2016 4:07 PM in response to ChitlinsCC

Hi there,

I hope this is an update for all who have concerns about MacKeeper. This program was originally owned and marketed by 'Zeobit'. After a few days research and investigating this software (MacKeeper) it would appear that Zeobit has sold MacKeeper to 'Kromtech Alliance Corp whose parent company is named 'cleverbridge AG' based in Cologne-Germany.

When I called their ( MacKeeper) U.S. support number 2 days ago I was directed to an office in the Ukraine. I was basically encouraged to spend more money on further software by an " apple certified technician" ( I don't believe they are affiliated with Apple Macintosh at all).


Mea Culpa for not checking them out fully ahead of time. My 2 year subscription cost me $170.07 Canadian. This the same questionable software that has many warnings all over the internet, including " Do Not Install MacKeeper".


I have now removed the software and cancelled my subscription. Buyer beware. The company use sophisticated marketing techniques and smart phone support people to sell their products which are according to many, inefficient and dangerous to Mac OSX systems.


Hope this is useful to all out there in Mac land.


Andrew.

The MacKeeper Virus - how do I get rid of it in SAFARI?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.