I have a macbook pro and i seem to have a bug or virus as mackeeper keeps propping up on me safari

i have a macbook pro and seem to have a bug/virus as mackeeper and other various websites keep popping up on my safari

There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination  command-C:
/Library/LaunchDaemons
In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form
          com.something.daemon.plist
and
           com.something.helper.plist
Here something is a variable word, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes the word is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.
If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:
/Library/LaunchAgents
In this folder, there may be a file named
          com.something.agent.plist
where the word something is the same as before.
If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.
The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.
Open this folder:
/Library/Application Support
If it has a subfolder named just
           something
where something is the same word you saw before, drag that subfolder to the Trash and close the window.
Don't delete the "Application Support" folder or anything else inside it.
Finally, in this folder:
/System/Library/Frameworks
there may an item named exactly
            v.framework
It's actually a folder, though it has a different icon than usual. This item always has the above name. Drag it to the Trash and close the window.
Don't delete the "Frameworks" folder or anything else inside it.
If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere  should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
          Install system data files and security updates (OS X 10.10 or later)
or
          Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.

Similar Messages

  • I have a MacBook Pro and I seem to have problems with my FaceTime. It want me to enter my apple ID, but when I do it comes up with a msg that says, "The server encountered an error processing registration. Try again later." What do I need to do?

    I have a MacBook Pro and have problems using my Facetime. Last time I used it without problems. Now I am trying to use it, and it is asking that I enter my Apple ID. When doing so, it comes up with a message that says, "The server encountered an error processing registrion. Try again later." What does this mean, and how do I fix it? Thanks.

    I had the same problem and found the solution here:
    https://discussions.apple.com/thread/3189272

  • I have a Mac Pro and it seems to have a malware. How can I remove it

    I have a Mac Pro and seems like it has a malware, adware . How can i remove it. MACkeeper keeps on popping

    You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
    Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
    Back up all data.
    Triple-click anywhere in the line below on this page to select it:
    /Library/LaunchAgents/com.vsearch.agent.plist
    Right-click or control-click the line and select
              Services ▹ Reveal in Finder (or just Reveal)
    from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
    Repeat with each of these lines:
    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist
    Restart the computer and empty the Trash. Then delete the following items in the same way:
    /Library/Application Support/VSearch
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
    From the Safari menu bar, select
              Safari ▹ Preferences... ▹ Extensions
    Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
    This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
    You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select
              Go ▹ Go to Folder...
    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

  • HT1146 I have a macbook pro and an imac, I have both these mails synced with my gmail account, when im on the macbook and open the mail I get it just fine but I dont get it on my imac afterwards and vice versa. How can I get all my mails on both machines?

    Need some help with this please..

    Open Mail, then under Mail, Preferences, look at the gmail account and find the settings for the account...see how the deletion is set.  If it deletes on opening, or when removed from the inbox (same thing) change that so the email stays available on the server.  Do that on both machines.  See if that makes things work right for you.

  • HT1554 I have a macbook pro and just got an air and I have started the Air but stuffed up and didnt transfer everything from my old computer to the new one. they have different passwords and names. help, Ive got no idea here...

    I set up my new air and now want to transfer my info from my macbook pro and I seem to have missed the boat and want to go back and do it . the computers are in different names with diff. passwords. Any idea?

    If you set yp the Air before transfer, look in Users or Accounts pref pane to see if the other user is there to login to.

  • I have a Macbook Pro and can no longer access Number I keep getting an error message 1712 please help

    I have a MacBook Pro and for some unknown reason I can't open numbers I keep getting a message error -1712 I can't open old documnents not the program

    -1712 is a time-out error. It means the application (Numbers) is taking too long to do somthing. The 'something' is often attempting to open a corrupted file.
    Holding the shift key, as suggested by Jerry, prevents Nmbers from trying to reopen files that were open when Numbers was last quit. For future reference, you might consider, before quitting Numbers, closing all files you will not require in your next session. Even ignoring the possibility of another corrrupted file bringing this problem on again later, not re-opening the files you do not need in the next session will shorten the launch time for Numbers.
    Regards,
    Barry

  • HT1338 I have a macbook pro and am trying to upgrade to OS x Mavericks but it won't seem to download from the app store

    I have a macbook pro and am trying to upgrade to OS x Mavericks but it won't seem to download from the app store

    http://www.apple.com/support/mac/app-store/contact.html?form=account

  • HT3231 I tried to migrate information from MacBook Air to ...Pro and it seemed to have taken files from folders on desktop as none exist on Air now.  As to where these files are, I don't know.  It has also taken my pictures from iPhoto to unknown destinat

    I tried to migrate information from MacBook Air to ...Pro and it seemed to have taken files from folders on desktop as none exist on Air now.  As to where these files are, I don't know.  It has also taken my pictures from iPhoto to unknown destination. ??

    If you used migration assistant then it probably created a new Login user and placed the migrated files under it.
    Regards,
    Captfred

  • I have a macbook pro and a ipod and yesterday while I was on my laptop on Facebook playing words with friends with my daughter who was on the iPod playing under her user name it seems that they combined into one profile.  what happened

    I have a macbook pro and a ipod and yesterday while I was on my laptop on Facebook playing words with friends with my daughter who was on the iPod playing under her user name it seems that they combined into one profile.  what happened?  they used to be separate and we could play against each other but now it says its the same user for both even though I signed in on facebook with my log on and she was on her ipod with her profile.  can I fix this? 

    You might need to be asking the folks at Facebook.

  • I have a macbook pro and i put a new hard drive in it but now wont start up but when i firewire it to another mac the hard drive seems to be fine

    i have a macbook pro and i put a 500 gb hard drive but know pro wont start up but when i firewire it to another mac the harddrive seems to be fine

    When you formatted the drive, before installing OSX, did you click Options on the Partition and select Mac GUID Bootable ?
    Just because it mounts as an external does not mean it's a bootable Volume ...

  • I have a MacBook Pro and tried to download and open the torbundle package.

    I have a MacBook Pro and tried to download and open the torbundle package. I get a message that reads "A copy of firefox is already running. Only one copy of firefox can be open at a time."
    1. I do not seem to have firefox anywhere of my computer. Ive been using safari and as far as my computers library is concerned there is no firefox.
    2. I have tried shutting down and restarting.
    3. I tried making a new user account.
    I believe the torbundle package is trying to open itself twice. Has anyone had this problem when trying to use tor on OS X?
    This is getting very frustrating! Help please!

    If you open Activity Monitor do you see a FireFox running? If so delete it.
    Have you tried deleting and redownloading/installing?
    Next:
    How can I get support?
    Your best bet is to first try the following:
    Read through this FAQ.
    Read through the documentation.
    Read through the tor-talk archives and see if your question is already answered.
    Join our irc channel and state the issue and wait for help.
    Send an email to [email protected]
    If all else fails, try contacting us directly.
    If you find your answer, please stick around on the IRC channel or the mailing list to help others who were once in your position.
    From:
    https://www.torproject.org/docs/faq.html.en

  • I have a MacBook Pro and an 1TB WD my passport for mac. I bought a second hard drive to act as back up and when I went to do this the original passport won't mount. It is showing in disc utility but it will not repair. I am told the mac cannot repair it.

    I have a MacBook Pro and an 1TB WD my passport for mac. I bought a second hard drive to act as back up and when I went to do this the original passport won't mount. It is showing in disc utility but it will not repair. I am told the mac cannot repair it and I need to back up the files and then restore the hard drive. But I can't open the hard drive to move the files onto the new one!
    Help me please. I am not very technical so please answer as if I have no clue!! This hard drive has my iPhoto on it and all my pictures of my son, wedding and my current photography course so I  desperate to get it back!
    Any help will he appreciated!

    disk0s2: I/O error.
    disk0s2: I/O error.
    The MBP's disk is damaged and requires replacement.
    Genius Bar Reservations: http://www.apple.com/retail/geniusbar/

  • I have a macbook pro, and am trying to update my software. I recently bought an iphone 5, and my software is to out of date to sync my phone with itunes. I currently am running 10.5.8 and I need to update to atleast 10.6.8. Just wondering if I need to pur

    I have a macbook pro, and am trying to update my software. I recently bought an iphone 5, and my software is to out of date to sync my phone with itunes. I currently am running 10.5.8 and I need to update to atleast 10.6.8. Just wondering if I need to purchase it from apple or if there is an easy/free way to update it.

    you need to purchase it: http://store.apple.com/us/product/MC573Z/A/mac-os-x-106-snow-leopard.  It is only on a disk, not in download form.

  • I have a MacBook Pro and just added an airport express to listen to my iTunes on my stereo. How do I get Firefox to use my AX when I use Grooveshark or Pandora?

    i have a MacBook Pro and just added an airport express to listen to my iTunes on my stereo. How do I get Firefox to use my AX when I use Grooveshark or Pandora?

    If the purchases are all from the same account then you can share the content by authorizing each device.
    If you have separate accounts then you have to be authorized to use the content purchased from another account.
    MJ

  • I have a macbook pro and use BT homehub 3.  can't work out how to connect my time capsule. can anyone help, thanks.

    I have a macbook pro and use BT homehub 3.  can't work out how to connect my time capsule. can anyone help?  thanks

    Just need to plug the TC in to the hub in bridge mode.. do not try and bridge the homehub.. it is not possible with the setup BT uses.
    To bridge the TC.. plug it directly into a computer by ethernet.. no other connection to the TC or the computer.
    Press and hold in reset until the front LED flashes rapidly.. about 10sec.
    Release the reset.
    Open the airport utility and setup the TC to bridge mode.
    The actual method depends on version of the OS and airport utility you use.
    This is version 5.
    Sorry I cannot post the v6 as I am on a snow leopard computer now. But you go to the network tab, and choose off bridge mode for method of connection. It will be NAT and dhcp by default.
    Then setup wireless.. you have a number of choices here.
    Either setup with the same SSID Security and password, as the homehub uses.. or a different name, and password..
    Each method works fine.. but you sometimes have issues with wireless channels.. for now leave it on auto and see what happens.. if you have issues lock down the radio channels on both devices.. use one out of the following on each, 1, 6, 11 or 13 in UK.. so say 6 on the homehub then 13 onthe TC.
    Update the TC.. unplug fromt the computer and plug it into the homehub.
    If you have other issues with the setup tell us what OS you run so we can post suitable screenshots.

Maybe you are looking for