MacKeeper keeps popping up.
MacKeeper relentlessly pops up when I search anything. No trace of it in applications. Found no files in spotlight. Please help me kick this nasty little pop-up.
You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
Similar Messages
-
Over the past two days, Mackeeper keeps popping up in a new tab, yahoo defaults as my search engine even though I have google set in preferences, and the "Top Sites" setting in preferences doesn't save. Seems I've somehow acquired some malware of sorts. I've searched the forums and have not found a solution that works on my machine yet.
There is no need to download anything to solve this problem.
You may have installed the "VSearch" trojan. Remove it as follows.
Malware is always changing to get around the defenses against it. These instructions are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates
if it's not already checked.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
I downloaded MacKeeper last year. Today my browser is messed up and I am getting popups. MacKeeper keeps popping up to download, so I updated my subscription-still messed up. Is this malware and if so, why did it show up a year later and after I paid again to update!?
You installed a variant of the "VSearch" trojan. Remove it as follows.
This malware has many variants. Anyone else finding this comment should not expect it to be applicable.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.projectx.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.projectx.daemon.plist
/Library/LaunchDaemons/com.projectx.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/projectx
/System/Library/Frameworks/v.framework
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
What is a mackeeper and why does it keep popping up? I am brand new to mac. carol h.
What is a mackeeper and why does it keep popping up? I am brand new to mac. carol h.
Hi,
For maintenance.
http://mackeeper.zeobit.com/
Check your Applications folder. If you don't want the app, just drag it to the Trash.
IMHO you do not need this utility. Your Mac will do maintenance for you.
Carolyn :-) -
i have a problem mackeeper keep opening up another tab and these little green circle stuff keep popping up on the page and overtime my cursor hover over it it pops up a little box with stuff in it does anyone have an idea how to get rid of it?
You installed a variant of the "VSearch" trojan. Remove it as follows.
This malware has many variants. Anyone else finding this comment should not expect it to be applicable.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.2c232f1e4d12129e.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.2c232f1e4d12129e.daemon.plist
/Library/LaunchDaemons/com.2c232f1e4d12129e.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/2c232f1e4d12129e
/System/Library/Frameworks/v.framework
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
Why does MacKeeper ad keep popping up and its not installed on my mac
MacKeeper ad keeps popping up. Its not installed in my apps
The Safe Mac » Adware Removal Guide
How to Remove MacKeeper
Uninstalling Software: The Basics
Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.
Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.
Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.
Some applications may install a startupitem or a Log In item. Startupitems are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the "-" button to delete it from the list.
Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.
If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, EasyFind, instead.
Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.
There are many utilities that can uninstall applications. Here is a selection:
1. AppZapper
2. AppDelete
3. Automaton
4. Hazel
5. AppCleaner
6. CleanApp
7. iTrash
8. Amnesia
9. Uninstaller
10. Spring Cleaning
For more information visit The XLab FAQs and read the FAQ on removing software. -
I have a macbook pro and i seem to have a bug or virus as mackeeper keeps propping up on me safari
i have a macbook pro and seem to have a bug/virus as mackeeper and other various websites keep popping up on my safari
There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form
com.something.daemon.plist
and
com.something.helper.plist
Here something is a variable word, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes the word is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.
If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:
/Library/LaunchAgents
In this folder, there may be a file named
com.something.agent.plist
where the word something is the same as before.
If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.
The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.
Open this folder:
/Library/Application Support
If it has a subfolder named just
something
where something is the same word you saw before, drag that subfolder to the Trash and close the window.
Don't delete the "Application Support" folder or anything else inside it.
Finally, in this folder:
/System/Library/Frameworks
there may an item named exactly
v.framework
It's actually a folder, though it has a different icon than usual. This item always has the above name. Drag it to the Trash and close the window.
Don't delete the "Frameworks" folder or anything else inside it.
If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked. -
MacKeeper/Zerobit Pop Up ad Problem
Can someone PLEASE tell me how to stop these MacKeeper/Zerobit pops from happening on my computer?
I've never used MacKeeper nor do I plan to ever use it now that this ad keeps popping up unwanted. What happens is I get this Mac "recommends" box that I have to click "Ok" for or completely quit Safari in order to get rid of it. Then there is this stupid ad for MacKeeper sitting there. I can seem to find anyway to get rid of it. Anyone else have this problem? Thanks.I don't think some of the people responding to this thread understand something integral to the problem we are having... we DON'T have any files because we NEVER downloaded Zeobit Mackeeper in the first place. Not by accident, not on a "trial basis", NOTHING. This is not an issue about "fully" removing a program, this is simply SPAM or Malware or whatever else you want to call losing your ability to control your computer when using Safari.
Anyway, We've localized it to a particular website called "WowHead" it's a Warcraft Wiki type of site. I used two different machines and got the same result. Just head over to that website enough times and you'll get the pop up. I'm sure you can get the pop up from other sites as well. I appreciate the help that posters to this thread have offered, but I've unfortunately come to the conclusion that no one can has an answer to this problem... no matter how much they'd like to think they do or are graciously trying to help (as in the case of the 2nd poster). But good luck, if I find anything on the interwebz, I'll repost any info here! -
Adobe Reader new downloads keep popping up. What is it and do I have to pay for it and how can it h
Hi all............I was reading my sat nav cd on my computer and 'adobe Reader new downloads' keeps popping up. When I asked a friend do I need this they just say 'no' but I am curious and like to learn. What is 'Adobe' Reader OR 'Acrobat'. You see I'm trying to learn how to use the mp3 plaver on my sat nav and download updates for it but there's never anything to say 'how much' or 'free' and there is so much to read. Anyway does anyone know if these downloads are free? and what do they do? All help welcome as I don't understand at all what it is? Oh and thanks in advance :)
Can we go back about the new downloads thing... what is the message
(exact text please) and when does it come up? If it takes you to a
web site, what is the web address (you can copy and paste this from
the browser). I am worried that this may be more sinister than it
seems.
Aandi Inston -
I changed my apple password from my i phone so when I tried to get on on my Ipad 2, the sign into icloud keeps popping up! It will not go away after entering the password, it doesnt say it's wrong it just keeps popping up! I have had no prolems with my iphone or my mac! I tried updating and that didnt help! Someone please help!!
The reason it won't authenticate your password is because it isn't connected to wifi. Reset it by holding the power and home buttons at the same time until you see the Apple logo, the release and wait for it to restart. As soon as it restarts, quickly go to Settings>Wi-Fi and connect it before it starts prompting you. Once it's connected to wifi, enter your password when prompted and it should take it this time.
-
I have recently changed my Apple Id but now my sons Ipad keeps popping up saying Sign In to iCloud with the old Id.. How do I change my iCloud ID on my devices??
Hello Becla,
After reviewing your post, I have located an article that can help in this situation. It contains helpful advice concerning iCloud accounts:
iCloud: Set up iCloud on your devices
http://support.apple.com/kb/PH2609
Thank you for contributing to Apple Support Communities.
Cheers,
BobbyD -
I just recently got an iPod touch 5 and it won't let me download apps. It says they are free but when I install it , it keeps popping up saying before purchasing I must tap continue to verify my purchase something like that. Idk what to do. !!!!!
Yes. You can set the payment method to "None" once you log into iTunes on your PC/Mac. I have it set up this way.
-
i want to update my apps on my iphone4 and when i go to update them a message keeps popping up saying "sign in to varify your acount" i sign in then it takes me to a billing page i put in all of my billing information and it says security code wrong i i have the Mastercard infront of me every time i try to do this and it tells me that i have an "invalid security code"
Might be an address formatting issue with your iTunes account records. See http://support.apple.com/kb/TS1646.
-
My iphone 5 wont let me update apps keeps popping up with old apple id how do i fix this
my iphone 5 wont let me update apps keeps popping up with old apple id how do i fix this??
All apps downloaded/purchased are tied to the apple ID used to download/purchase them.
If you change your Apple ID and do not wish to use the old apple ID and password to update them, you have to delete them and redownload or buy them under the new apple ID. -
When my husband and I first bought our iPhones, I was the only one with an Apple ID (since he never used iTunes). He used my apple id to get apps. Now he has his own ID, but my apple ID email address keeps popping up on his phone when he tries to download an app. We do not want to have all of the same apps on our phones. How can we change the ID on his phone? I already tried going to Settings>iTunes &App Store> and changing the Apple ID to his account email and that did not solve the problem. To make things worse, I recently changed my Apple ID email address (without getting a new ID) and I do not remember my old password (and this is the address that is popping up on his phone). He does not have any music on his phone and all of the Apps that he has are free. Any help you could offer would be great (-:
All apps are forever tied to the Apple ID that bought them. To stop your id from popping up, you need to delete the apps on his phone, and then repurchase them under his account.
Maybe you are looking for
-
Keyboard isn't functioning correctly, can't get into my computer
Hi there. A few days ago my keyboard started acting very strange. For example, when I push 'D', nothing happens. If I push it 5 times, a bunch of random letters show up. I stupidly shut my computer down and when I turned it on again of course I had t
-
Hi folks! I was wondering if it's possible to use my iMac as a hub to connect to my xbox360 on internet Thanks Aeterna
-
I cannot watch movie purchased on macbook pro running mavericks
cannot view movie in itunes. purchsed and downloaded. can view images as i move the movie forward but does not play. very unhappy.
-
HP enter administrator password on power on password
Hi All, Please help me with my problem...HP enter administrator password on power on password.... System Disabled : 92961174 Thank you in advance. maersk
-
Web-friendly size, form and shape?
For web streaming- what is the workflow for 24p AND widescreen 16:9 AND a manageable size (4.5 minute short < 100Mb)- how can this be accomplished? Source footage is 1080i60 (Sony HVR-A1), FCP 5.1.4 with the Nattress pluin.