MacKeeper popup persists

I'm on a MacBook Pro with OSX 10.8.5 battling a MacKeeper popup that comes up whenever I visit one particular newspaper website. I've tried Adware Medic and reinstalling Firefox with only essential add-ons etc, and still I get the popup when visiting the newspaper website.
I've followed online advice from Thomas Reed/Adware Medic, and others, to use a fuller Finder search to try to track down suspicious files associated with malware (suspicious files with suffixes like *agent.plist etc.). Extrapolating from the wildcard symbols (*) in Thomas Reed's advice, he seems to advise that I should delete these matching LaunchAgent and LaunchDaemon files, but I'm hesitating, because from Googling around, I think these files are essential. Maybe I'm misinterpreting the expert advice from Thomas Reed. Should I delete these?
matching files (possible infection by Downlite malware):
system/library/launchagents/com.apple.printtool.agent.plist
system/library/launchdaemons/com.apple.printtool.daemon.plist
system/library/launchagents/com.apple.cfprefsd.xpc.agent.plist
system/library/launchdaemons/com.apple.cfprefsd.xpc.daemon.plist
system/library/launchagents/com.apple.mdmclient.agent.plist
system/library/launchdaemons/com.apple.mdmclient.daemon.plist
system/library/launchagents/com.apple.distnoted.xpc.agent.plist
system/library/launchdaemons/com.apple.distnoted.xpc.daemon.plist
matching files (possible infection by Buca Apps malware):
system/library/launchdaemons/com.apple.airportPrefsUpdater.plist
system/library/launchdaemons/com.apple.xprotectupdater.plist

mtariz wrote:
Should I delete these?
NO!
Pardon my shouting, but as a minimum that would almost certainly disable printing, Spotlight, XProtect and various other processes and might even brick your Mac, preventing you from restarting it. There is nothing whatsoever in the instructions on TheSafeMac telling you to ever remove anything from /System/Library/ period.
Adware Plus takes money from Microsoft, Google, Taboola, Amazon and perhaps others to allow their ads to pass through. See Google, Amazon 'n' pals fork out for AdBlock Plus 'unblock' – report. You would be better off with Adblock or Adblock Edge.
If you gave us the URL of that newspaper web site, then maybe some of us could confirm what you are seeing and offer better advise.

Similar Messages

How do i get rid of mackeeper popup

How do I get rid of mackeeper popup?

Majbrit wrote:
I (like you mentioned) was having a "Could not find server" problem when trying to install AdwareMedic.
In that case, you have the Downlite (aka VSearch, aka DynamicPricer) adware installed at a minimum. See:
Adware blocking AdwareMedic downloads!
If that page is blocked as well, see:
About the Downlite adware
(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Help, my Safari browser has been acting super strange. It keeps changing my default browser from Google to Only Search, and my search bar will only search on Yahoo no matter what I do. On top of that I get MacKeeper popups every time I click a link

Help, my Safari browser has been acting super strange lately! It keeps changing my default browser automatically from Google to Only Search (if you use the search engine Only Search it takes you to Yahoo.com). My search bar will only search on Yahoo no matter what I do to make it Google. On top of that I get MacKeeper popups every time I click on a link. What is worn with my computer and how do I fix it?!

There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for a file with a name of the form
          com.something.daemon.plist
Here something is a variable word, which can be different in each case. It could be "cloud," "dot," "highway," "submarine," "trusteddownloads," or pretty much anything else.
There may also be a file named
           com.something.helper.plist
in the same folder.
If you find files with names that fit the above description, post what you have for "something."

Mackeeper popups?

I've literally had my computer three days, and I've had this mackeeper popup that comes up randomly. I haven't installed anything, but the popup has come up so many times. I've never used a mac before this computer, so I'm not sure what to do. Can anyone help?

Mackeeper will keep at you until you run the program and go through the cleanup routine OR you delete the program and install something less intrusive that you can run whenever you want, not when they demand with pop-ups all the time.
There are a lot of other system utilities to choose from that do the same or better job and are far less annoying
Cheers!

Get rid of mackeeper popup

Help, how do I get rid of Mackeeper popup, I have not downloaded! It constantly pops up and redirects my searches.

Please review the options below to determine which method is best to remove the Adware installed on your computer.
The Easy, safe, effective method:
http://www.adwaremedic.com/index.php
If you are comfortable doing manual file removals use the somewhat more difficult method:
http://support.apple.com/en-us/HT203987
Also read the articles below to be more prepared for the next time there is an issue on your computer.
https://discussions.apple.com/docs/DOC-7471
https://discussions.apple.com/docs/DOC-8071
http://www.thesafemac.com/tech-support-scam-pop-ups/

I have popups blocked on Safari, but just had MacKeeper popup. Confused.

How did I receive a MacKeeper popup in Safari when have "block popups" checked in Safari preferences?
Thank you.

Hi...
That particular pop up tends to bypass the Safari ad blocker unfortunately.
Go to ~/Library/Safari
Move these files to the Trash.
Downloads.plist
History.plist
LastSession.plist
Quit then relaunch Safari to test.
Best to not install MacKeeper. Results of an ASC forum search for MacKeeper > Community Search: Apple Support Communities
Causes Mac users nothing but problems.

How to remove 'MacKeeper' popup ad?

Somewhere during a surfing experience, t encountered the popup ad for 'MacKeeper'. Along with that problem i found that my homepage upon opening Safari came up to 'QuickSearch' from months using 'Google'. I do not know where of why I all of a sudden got his with these plus others, but now I cannot seem to rid my computer of random hits of these and other popups that begin as soon as I try to surf the internet.
If anyone has had a similar experience and found a cure to rid these annoyances I would appreciate some help in ridding my computer of these pesky things.

This is what most people report as successful. Do not use the developer's uninstall, it is contaminated.
http://applehelpwriter.com/2011/09/21/how-to-uninstall-mackeeper-malware/

MobileMe removed but "invalid password" popup persists

Hello,
I'm having difficulties pertaining to what I assume is MobileMe software lingering on my computer. I'm running an iMac 9,1 with OS X 10.6.8. Awhile ago I uninstalled the MobileMe software. Despite the program seemingly gone from the computer, I'm still getting a popup ~every 30 mins that reads,
"You entered an invalid MobileMe member name or password. Verify your MobilMe member name and password in MobileMe System Preferences."
I'm perplexed as to how this popup is continuing. I've verified all of the MobileMe program files are gone from the computer (cannot locate any in the System/Library, Library/Preferences, or Library/LaunchDaemons folders, and have verified no files exist within the Keychains). MobileMe no longer exists in my System Preferences. There is no sync icon in the top right corner.
Can anyone help me stop this pesky popup?
Many thanks,
-Bailey

Do you have programs you were syncing with MobileMe that might be trying to access the non-existent web site?
iPhoto, Mail, iDisk and so forth.

How do i remove mackeeper popup ads

I keep getting pop up ads from MacKeeper and want to know how to prevent or remove them from my macbook air.

Identify and remove adware
http://www.thesafemac.com/arg/
or
use Adware Removal Tool.
http://www.thesafemac.com/art/

How can I block Mackeeper popup?

Every time I boot and start browsing in my Mac Book Pro, a Mackeeper pop up opens behind the opened window. When I right-click tray icon or minimize opened window, that [pop up window appears, and it locks up Firefox when I try to close it. I need to restart FF to close pop up.

Is this coming up in it's own window, or Firefox?
'''[https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/ Adblock Plus]''' {web link}
Blocks annoying video ads on YouTube, Facebook ads, banners
and much more. Adblock Plus blocks all annoying ads, and
supports websites by not blocking unobtrusive ads by default (configurable).

When I click the Safari app to open it, I keep getting this popup and I cannot close it without force quitting. I also cannot use Safari at all because this keeps poping up what do I do?

I will get this popup and when I try to quit it, it will show another popup called MacKeeper. I always get this ad however I have never downloaded. I am unable to use Safari because of this issue. I have tried restarting and shutting down my computer, but when I try and reopen Safari, I will get the same message and Mackeeper popup. Please help. It's like these popup ads have taken over my Safari. I have run multiple scans on my computer and it says no malware detected and no viruses.

Launch Safari with the Shift key held down. If that doesn’t work, disconnect your computer from the Internet and try again.
Those popups are being opened directly from the web and not by any malware installed on the machine.
(115214)

How do i get rid of popups?

I am having MacKeeper popup on my browser every time a new tab opens practically. Tune Up my Mac is also coming up occasionally as well as something called Mac Booster (I think?). I have notifications saying "congratulations you're a winner" and other spam of that sort and I have already moved all of the extensions on my google chrome setting and I am just not sure how to stop these but they are actually driving me insane. I'm not all techy so step by step "for dummies" would be most helpful.
Thanks in advance!

You may have installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

How to find a particular cookie?

I'm having an issue with the LA Times website. I don't normally use it that often, but during March I kept getting directed there via Google for news updates, and I apparently overstayed my welcome, as it started displaying a popup saying my "monthly free limit" of visits had been exceeded and asking me to pay for a subscription. Well, I don't usually visit them very often so a subscription makes no sense. Ergo, I figured I'd just wait until April and the problem would solve itself when the "max monthly free visits" or whatever reset.
Unfortunately when April came I still found myself staring down the damned subscription popup.
So I went to my cookies and deleted the "latimes" cookies -- and yet the popup persisted.
I downloaded and installed Chrome to see what would happen, and using Chrome I can visit the LA Times web site without a problem and read news articles. Ergo, whatever is causing the "pay up!" popup resides in my Firefox cookies SOMEWHERE. I just don't know where!
I don't really want to delete ALL my cookies -- they do some useful things -- so what I really want is to figure out exactly how the LA Times is determining how many visits I've made to their site and get rid of that cookie. They can't be just tracking my ISP address or I'd still be getting blocked when I use Chrome.
How can I find out what cookie is causing the problem? Also, is there a way to keep the LA Times from tracking this data in the future? It's not that I want to cheat them of their rightful revenue, it's just that I really don't use their site that often (or I'd pay for it). I assume they have an interest in my viewing their ads or they wouldn't offer any free page views at all.
An alternative solution would be to somehow tell Google that I don't want it to display any search results it gets that point me to the LA Times so that I don't have to deal with that obnoxious popup when I click to get a news story. I'm perfectly okay with simply not visiting the LA Times for my news but I rarely have the awareness to notice that I'm clicking on an LA Times link before I've gone ahead and clicked on it. I realize this isn't the place to ask that question but if by random chance someone happens to know how to do that instead, that would be great.

Yeah, that was the first thing I did -- I got rid of the "latimes" and "latimesblog" cookie folders, but it didn't solve the problem at all. This is why I'm thinking it's a hidden or inobvious cookie that the site is somehow using to track my visits. Is there any way to actually SEE when a website is writing a cookie and what cookies it's writing?

Help* Getting a pop up that says Your Apple computer has been blocked

My partner was using my laptop yesterday and was trying to download the NHL hockey game stream from nhl-stream.com. He tried downloading it and downloaded MacKeeper and some video player. This morning I realized what he did so I googled how to uninstall MacKeeper and did so. I was unable to find the help file to delete for MacKeeper. I also deleted the video player and everything recent from the downloads. Now I'm havinganor problems with my MacBook Pro. When I use Safari it's no longer my regular Google homepage it's search-quick.com which I cannot get rid of? (Anyone can tell me how that would be helpful)
My biggest problem is the pop up that comes up and says
*YOUR APPLE COMPUTER HAS BEEN BLOCKED*
Mac System Alert!!
System has been infected due to unexpected error! Please Contact Apple Care 1-855-680-7080 Immediately! To unblock your computer....
I Googled other pop ups like these on apple support and they says to hit Control W to close the window then change security preferences. The control W does not close the window I can only get rid of it by clicking Force Quit. Then when I reopen Safari either the Popup immediately comes or the first website i search it comes. Sometimes I also get new windows open for MacKeeper. This is very frustrating and I am still learning on how to work around my Mac. I have never found a problem with my computer before he went and downloaded the game.
IF anyone can direct me in the right direction to have this removed so it's safe again to go on my banking etc that would be great! I tried to call apple support but of course my call support has expired!

Choose Force Quit from the Apple menu, close Safari, and then launch it with the Shift key held down. If that doesn't work, temporarily disconnect the computer from the Internet.
If that message continues to appear, click here and run Adware Medic; the MacKeeper popups may also be produced by adware. You may need to use a different web browser.
(126390)

My Safari keeps crashing even after clearing cache/history/etc. Help?

I have tried resetting, clearing cache, and erasing the history. I'm not sure what is going on with my Safari. I did notice I kept getting those "Mackeeper" popups, but I never downloaded it or anything. Could this be the issue? I have looked through other threads and couldn't find a solution to the problem. Thanks!

Launch the Console application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
Step 1
Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left. If you don't see that menu, select
View ▹ Show Log List
from the menu bar.
Enter the name of the crashed application or process in the Filter text field. Select the messages from the time of the last crash, if any. Copy them to the Clipboard (command-C). Paste into a reply to this message (command-V).
When posting a log extract, be selective. In most cases, a few dozen lines are more than enough.
Please do not indiscriminately dump thousands of lines from the log into this discussion.
Important: Some private information, such as your name, may appear in the log. Anonymize before posting.
Step 2
Still in the Console window, look under User Diagnostic Reports for crash reports related to the process. The report name starts with the name of the crashed process, and ends with ".crash". Select the most recent report and post the entire contents — again, the text, not a screenshot. In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.) Please don’t post shutdownStall, spin, or hang logs — they're very long and not helpful.

MacKeeper popup persists

Similar Messages

Maybe you are looking for