OS 10.12.6

Quite often Mackeeper will appear uninvited asking me to download. Today it appeared and said I had 3 viruses and to remove them I should download Mackeeper.

I have ClamXAV and it didn't find anything. What is the story with Mackeeper and is there a way of preventing it from appearing?

Whilst I'm here, is there any way of allowing folders to be located anywhere on the desktop?

jaybass

Not that it's anywhere near guaranteed, but have you got Safari > Preferences > Security > Block pop-up windows checked?

If "Yes", I don't know if there's any way to keep those MacKeeper pop-ups from popping up other than by not visiting the websites at which they pop up, but I do know, not from personal experience, happily, but from any number of past mentions at FTM, that MacKeeper is to be avoided.

I think this will allow you to place folders anywhere on your desktop and have their positions survive a restart: in Finder, hit command-J and select "Sort by: None".

If that works for you as it does for me, newly created folders and other new items will line up along the right edge of your screen from where they can be moved anywhere.

Malwarebytes may be able to detect something. It has a free version, so it won't cost you anything.

Thanks for for that tip i.e. finder>command-J "sort by none" did the trick.

Safari>prefs>Block pop-up windows is already checked.

Jon, I have found ClamXAV has notified me immediately of any malware etc but thanks for the suggestion.

jaybass

It appears when you browse the Web because unethical Web owners place ads on their Web sites that open scary-looking but fake virus warnings urging you to download MacKeeper.

You can ignore these warnings; they are phony.

The makers of MacKeeper have already been sued twice, and lost twice, for fake virus warnings. They just pay the fines and move on, because fake virus warnings are a huge, huge moneymaker, and getting sued is simply part of the cost of doing business.

I read that Safari prefs>privacy>manage website data, type Mackeeper in the small window and it appears in the window below with the option to 'remove' I did that but it returned shortly aferwards. Perhaps whoever does the sueing should increase the fines to make it impracticable...if they have that much authority.

jaybass

Does this mean that the issue is more than MacKeeper pop-ups continually reappearing? Is the problem that you have installed MacKeeper and now need to get rid of it?

MacKeeper is notoriously difficult to delete and unless carefully and thoroughly expunged is reputed to leave bits parts and pieces around that apparently sometimes recreate/redownload/reinstall MacKeeper or at the very least have a deleterious effect on system performance. The removal instructions on MacKeeper's web site are generally conceded to be incomplete at best. A Google or DuckDuskGo search on how to remove MacKeeper will return a LOT of hits from places like OS X Daily, MacWorld, iskeysoft, YouTube, WikiHow, the Official Appple Support Communities, and many more. One of those links should exorcise the demon.

All you're doing with that exercise is searching your cookies for MacKeeper cookies and deleting them (only to see them return on their own).

That has nothing to do with MacKeeper's possible presence on your Mac. (Evercookies?)

I've been impressed by AppCleaner's ability to isolate and eliminate an app and most if not all its associated bits and pieces which one might not otherwise be able to isolate. On a couple of occasions there have been several residual items which a careful search can isolate and one can deal with them on an individual basis.

AppCleaner may still have a free version available. Check it out. It's available via the App Store or directly from FreeMacSoft.

AppCleaner is excellent but, in the name of protecting itself from malware, MacKeeper intentionally hides or disguises some components and others are a hodge podge of bits parts and pieces of other apps so conventional app removal techniques, even installation tracking daemons, are know to fail.

Like most other malware, it is known to pick random filenames when installing its components, to make them difficult to find and remove. And yes, it can sometimes "grow back" things you have deleted.

Some of the more virulent varieties require a reboot in safe mode to pull out the bits.

It has a lot of variations, I suspect the producers of the app have business arrangements with some of their clients, on a "find a creative way to install us and keep us installed and we'll pay you more" basis, and that's lead to an unusually large number of creative and persistent varieties of installations.

Not all web pages that push it are in on the joke though. Most ad banner pushing services have a rotating and changing catalog of ads, you don't see the same ad in the same spot on the page every time you load it. Businesses buy slots from the advertisers and get themselves into the rotation, and are billed by the number of "impressions" they are given - i.e. the number of times your ad is displayed on someone's screen. The advertisers have little incentive to police their ads because they're making money displaying them, malware isn't affecting their client (the web site) or their other client (the malware maker) so they're somewhat insulated from complaints.

Eventually a website owner will get enough complaints to threaten or drop the banner provider (who is paying the web site to display their banners, that's one way websites cover their operating costs) but they just move on to another web site, there's a lot of suckers to pick from. It's not a problem that's going to go away anytime soon.

Bigger sites get in the news for serving up malware, because they've got a much larger audience, the audience expects better from them, and as such they tend to keep a close eye on their advertisers. (and if they drop one, that's a major loss of business for the advertiser, so they are more likely to watch what they provide also) But it still happens from time to time.

artie, I don't think I mentioned that I downloaded DetectX Swift and have not had a pop-up since.

That was Feb18th so it has proved itself so far and the price is very reasonable.

jaybass

Thanks for the update, jaybass.

Can you tell us how DetectX Swift silenced those Mackeeper pop-ups?

Did it locate a rogue file or function or was it something else altogether?

Artie,

This is from the developer himself.


https://apple.stackexchange.com/questions/237754/is-detectx-itself-malware

I just attempted to go to the DetectX web site and ran into this warning either from Safari Technology Preview or OpenDNS (I couldn't tell which) based on the WOT (Web Of Trust) rating for the site. I read the developers comments in jaybass' link but those are self serving and therefore not necessarily trustworthy. Until the developer can clear this up with WOT and others, I won't be installing DetectX. That's a shame as it looks like an interesting tool.

I just followed the links to the dev's website on MacUpdate's DetectX and DetectX Swift pages (OpenDNS) and didn't get your pop-up.

Same with links provided by Google.

To change the subject, Do I need SIP enabled?
jaybass.

I just went to DetectX web site (twice) using safari and I never received any warning.

Considering this software is about 5 years old, unsupported, and free, why would the

developer make remarks that could be contrued as seIf serving?

Reviews are good.

jaybass

Are you using OpenDNS? That could be the source, I didn't take the time to go exploring to find out where the message originated. It could also be originating with Safari Technology Preview Release 50 (Safari 11.2, WebKit 13606.1.5) as Apple is always testing new security options. The WOT rating is current.

SIP is intended to protect your computer from viruses and other exploits modifying the OS to open it up for installing malware without your knowledge. If you disable SIP and your computer catches a virus or other exploit you have only yourself to blame. If you do disable SIP I would have a clean copy of MacOS available on a drive not connected to your computer available just in case.

I read conflicting opinions on a forum and apparently, it only needs disabling when installing certain kinds of software...did I get thay right?

It is now enabled.

jaybass

I'm using OpenDNS and DID NOT get your pop-up, and since jaybass - same 10.12.6 as me - didn't either, STP looks to be "at fault". (I'm in Safari 11.0.3 as compared to your 11.2.x)

More: I just switched from OpenDNS to Google's servers and still didn't get the pop-up.

I'm confused, jaybass.

Your initial post sounded like your problem was that you were getting MacKeeper pop-ups soliciting you to download it while you were browsing, but now it sounds like you used DetectX to uninstall it.

Did I misunderstand you?

Yes, Mackeeper was continually popping up asking to be downloaded.

Whether or not I trashed/uninstaled it I can't remember but after downloading

DetectX Swift, I have not had a pop up since. If MacKeeper keeps popping up on

your computer, give it a try. I'm sure you have back ups.

That's quite a comprehensive explanation the developer gives.

jaybass