An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Previous Thread
Next Thread
Print Thread
Page 1 of 2 1 2
Damned MacKeeper
#35034 07/12/15 06:56 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
If anyone ever doubted that MacKeeper is a disease..........

From another thread I learned about DetectX and downloaded it. The only item it found in all of its searches was a 3 year old MacKeeper document in my Library Preferences called: .3FAD0F65-FC6E-4889-B975-B96CBF807B78

Clicking on DetectX's "Send to Trash" did not get rid of the MacKeeper document.

I managed to find the file (it was invisible) and attempted to move it to the trash. I got a dialogue box that says: "The operation can’t be completed because backup items can’t be modified."

Now, however, like any other viral disease, the MacKeeper file is replicating itself. Instead of just the one, I now have about 20 documents with the same name.

Any thoughts on how to purge my drive of the pernicious MacKeeper file (now files)?

Last edited by ryck; 07/12/15 06:57 PM.

ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
ryck #35035 07/12/15 07:06 PM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
Don't know if it will work, but have you tried "rm"ing it in Terminal?

Edit: I just looked at the DetectX home page and found "For MacKeeper, it is important to follow the instructions on Applehelpwriter for how to uninstall MacKeeper properly."

Have you tried that?

Edit 2: I just d/l'ed DetectX, and it found a "MacKeeper" file with a name similar to yours; I was able to move it to the trash (on my own) and delete it. Personally, I think the file was erroneously identified as a MacKeeper file, possibly because its name was similar to one, but its very minimal contents seemed innocuous, so I gambled. I also had a second such file with absolutely no contents which I deleted before running DetectX.

Last edited by artie505; 07/12/15 07:48 PM.

The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: Damned MacKeeper
artie505 #35037 07/12/15 08:36 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
Personally, I think the file was erroneously identified as a MacKeeper file, possibly because its name was similar to one….

I wonder if that's also the case with my mysterious document. I subsequently closed everything, including DetectX. I then re-opened it and ran another search. This time DectectX didn't find anything and gave me a 'thumbs up'.

Originally Posted By: artie505
Don't know if it will work, but have you tried "rm"ing it in Terminal?

While it now seems the file may not be MacKeeper, there are about 20 copies of the file instead of one. For the sake of keeping things tidy I wouldn't mind removing all the redundant copies. Do you know what the Terminal command would be? Or is it even possible to remove all but one?

Last edited by ryck; 07/12/15 08:41 PM.

ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
ryck #35039 07/12/15 09:03 PM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
What I don't get is why the file replicated itself; have you opened it to see what's in it?

The Terminal command is rm -rf  (Don't forget the two [2] spaces.); then drag a file into Terminal, and its path will appear in the command, after which you hit "return". (I've never tried dragging multiple files.)

Last edited by artie505; 07/12/15 09:04 PM. Reason: Clarify command

The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: Damned MacKeeper
artie505 #35043 07/12/15 10:57 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
What I don't get is why the file replicated itself….

To make it more curious, it appears that other files are also replicating themselves.

Originally Posted By: artie505
...have you opened it to see what's in it?

I opened one with TextEdit and it said:


fJHrQnNdmElH2bXFFhU46ZGWwjDgfpV6sEa31vlxps
+m
+QVKtdIVJSg/VdGE6Gm/lhAzK9L7EiFZKP6wZhS4QQ5oZRWvVbgYG1wzza9l/8n62qOv3Wk05VXXVg1og2tmGCPuIa2J
+n5okwKa/OOy1/UODWwPATPlFW7JXdB1b
+gbVWOnbEVUVC0diWrIrf7iDF7BmfYdRmthrpowqL5c0aeV/QygydFpfoUysdni37qDmmBUPW8Cux
+PhUfzFtIORuqerqRP5PSbNxrBSxplQ9KXjSCxh0Hk3MI7M0+GYjETTSpa6X7hr90
+YrEwrKP+Fhml1glEAw0F/GLVEAmZPA==

NOTE: I put the carriage returns in the above information from TextEdit because it pasted as one long line headed somewhere out the right side of the FTM screen.

Originally Posted By: artie505
...then drag a file into Terminal, and its path will appear in the command, after which you hit "return"

The path does appear but, as soon as I hit 'return' Terminal adds: Permission Denied, and the delete does not occur.

Last edited by ryck; 07/12/15 11:05 PM.

ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
ryck #35045 07/12/15 11:25 PM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
What other files?

Have you done a command-I to see if they're locked?

You can to try the same rm command but preceded by sudo(space): sudo rm -rf(space).

Maybe they are MacKeeper and you ought to follow the link I posted.

(Looks like you moved...pretty country; good luck! smile )


The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: Damned MacKeeper
ryck #35046 07/12/15 11:26 PM
Joined: Aug 2009
Likes: 7
Offline

Joined: Aug 2009
Likes: 7
Try the command sudo rm -rf. Be sure to leave a space after -rf After you drag the file into Terminal and press Return, enter your administrator password and press Return again. (Nothing will appear to happen while you're typing the password.)


Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365
Re: Damned MacKeeper
artie505 #35048 07/12/15 11:46 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
(Looks like you moved...pretty country; good luck! smile )

Ya, one of our daughters advised we are going to have our first grandchild so we decided we should be where the child is. That decision took about a millisecond.

I'm just heading out to get someone from the airport, and will have a busy evening, so I'll get back to you and Jon tomorrow.


ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
artie505 #35051 07/14/15 05:02 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
What other files?

There's a whole range of them, some of which are folders with Unix Executable Files inside them. In all cases the duplicates, when examined using Get Info, appear to be exactly the same...dates created, modified, et cetera.

Some names are:
.3lbxjVRJ8r
.AutoBindDone
.background (which is a Folder with a Unix Executable File)
.38 Special (which is a MacPaint Image)
.3246584E-0CF8-4153-835D-C7D952862F9D
.AccessibilityAPIEnabled

Originally Posted By: artie505
Have you done a command-I to see if they're locked?

Yes but, even after unlocking them, they won't allow themselves to be removed to trash. Also, unlocking one also unlocks every duplicate.

Originally Posted By: artie505
You can to try the same rm command but preceded by sudo(space): sudo rm -rf(space).

Originally Posted By: jchuzi
Try the command sudo rm -rf. Be sure to leave a space after -rf After you drag the file into Terminal and press Return, enter your administrator password and press Return again.

It still rejects the attempt to remove and advises "Permission Denied"


Unless it's just coincidental, I do notice that I am seeing the spinning beachball periodically when in regular use of the computer. Prior to this, I almost never saw it.

Is this one of those times when you just scratch your head and keep on walking?

Last edited by ryck; 07/14/15 05:04 PM.

ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
ryck #35052 07/14/15 07:34 PM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
This is starting to sound like something that came up a looong time ago, so just maybe... Try booting into another volume and running Disk Utility > Repair Disk on your disagreeable volume, and then reboot and see if your recalcitrant files are any more agreeable.

Last edited by artie505; 07/14/15 07:39 PM. Reason: Clarify

The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: Damned MacKeeper
artie505 #35053 07/14/15 07:42 PM
Joined: Aug 2009
Likes: 2
Offline

Joined: Aug 2009
Likes: 2
Just my 2 cents worth. If you can boot into another volume, do that and then navigate back to the original volume and delete the files. That should work if you get all of them.

IMHO MacKeeper should be banned.

Re: Damned MacKeeper
ryck #35054 07/14/15 07:48 PM
Joined: Aug 2009
Likes: 4
Offline

Joined: Aug 2009
Likes: 4
Originally Posted By: ryck
Originally Posted By: artie505
(Looks like you moved...pretty country; good luck! smile )

Ya, one of our daughters advised we are going to have our first grandchild so we decided we should be where the child is. That decision took about a millisecond.

'Tis indeed a lovely area ... for the moment. But just as living on the island is dangerous, so is the Lower Mainland right up to the Rockies: When the tectonic plates shift — any time now, according to the pundits ... hold your breath or don't — Golden will be beachfront property. tongue smirk

Re: Damned MacKeeper
grelber #35055 07/14/15 09:31 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: grelber
'Tis indeed a lovely area ... for the moment. But just as living on the island is dangerous, so is the Lower Mainland right up to the Rockies: When the tectonic plates shift….

Except that I am in the spot deemed the lowest earthquake risk in the province. When the insurance person tried to sell me the same earthquake insurance I had on the island, I pointed out that the insurance company's back-up servers were here for that very reason - lowest risk of earthquake.


ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
artie505 #35056 07/14/15 09:46 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
Try booting into another volume and running Disk Utility > Repair Disk on your disagreeable volume, and then reboot and see if your recalcitrant files are any more agreeable.

Nope….didn't work. However, I did take the opportunity to do a Directory Rebuild - which I haven't done for a while - using DiskWarrior.


ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
Douglas #35057 07/14/15 09:48 PM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: Douglas
If you can boot into another volume, do that and then navigate back to the original volume and delete the files.

Good thought….except the files are invisible and I believe they can only be made visible on the booted volume.


ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
ryck #35059 07/14/15 10:29 PM
Joined: Aug 2009
Likes: 7
Offline

Joined: Aug 2009
Likes: 7
Since you were denied permission to do this, try repairing permissions. True, permission repair is not as necessary as it once was, but it won't hurt to try.


Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365
Re: Damned MacKeeper
ryck #35061 07/14/15 11:11 PM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
Quote:
I just looked at the DetectX home page and found "For MacKeeper, it is important to follow the instructions on Applehelpwriter(*) for how to uninstall MacKeeper properly."

I posted that a while back; have you tried it?

(*) how to uninstall MacKeeper – updated | (The instructions specifically mention the file you originally referenced, i.e. /Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78)


The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: Damned MacKeeper
ryck #35063 07/14/15 11:55 PM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
Originally Posted By: ryck
Originally Posted By: Douglas
If you can boot into another volume, do that and then navigate back to the original volume and delete the files.

Good thought….except the files are invisible and I believe they can only be made visible on the booted volume.

When I make my invisibles visible (with XtraFinder) they show in all of my volumes...boot, bootable, and non-bootable.

Last edited by artie505; 07/15/15 12:41 AM. Reason: Clarify, add link

The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: Damned MacKeeper
artie505 #35064 07/15/15 01:04 AM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
Quote:
I just looked at the DetectX home page and found "For MacKeeper, it is important to follow the instructions on Applehelpwriter(*) for how to uninstall MacKeeper properly."

I posted that a while back; have you tried it?

Yes, and I couldn't find any method that would work for me.

Originally Posted By: artie505
The instructions specifically mention the file you originally referenced, i.e. /Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78)

That's correct and it also mentions that this is one requiring removal in Terminal….which we have tried but no go.

I note that the site mentions that DetectX has been updated to search for the items in their list, including .3FAD0F….., but that isn't the case with me. DetectX found the file once but, in any search since then, it does not. I am using the latest version of DetectX.

Last edited by ryck; 07/15/15 01:04 AM.

ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
artie505 #35065 07/15/15 01:06 AM
Joined: Aug 2009
Likes: 14
ryck Offline OP
OP Offline

Joined: Aug 2009
Likes: 14
Originally Posted By: artie505
When I make my invisibles visible (with XtraFinder) they show in all of my volumes...boot, bootable, and non-bootable.

I'll give that a try tomorrow.


ryck

"What Were Once Vices Are Now Habits" The Doobie Brothers

iMac (Retina 5K, 27", 2020), 3.8 GHz 8 Core Intel Core i7, 8GB RAM, 2667 MHz DDR4
OS Ventura 13.6.3
Canon Pixma TR 8520 Printer
Epson Perfection V500 Photo Scanner c/w VueScan software
TM on 1TB LaCie USB-C
Re: Damned MacKeeper
ryck #35066 07/15/15 01:40 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
Originally Posted By: ryck
[quote=artie505]
I opened one with TextEdit and it said:


fJHrQnNdmElH2bXFFhU46ZGWwjDgfpV6sEa31vlxps
+m
+QVKtdIVJSg/VdGE6Gm/lhAzK9L7EiFZKP6wZhS4QQ5oZRWvVbgYG1wzza9l/8n62qOv3Wk05VXXVg1og2tmGCPuIa2J
+n5okwKa/OOy1/UODWwPATPlFW7JXdB1b
+gbVWOnbEVUVC0diWrIrf7iDF7BmfYdRmthrpowqL5c0aeV/QygydFpfoUysdni37qDmmBUPW8Cux
+PhUfzFtIORuqerqRP5PSbNxrBSxplQ9KXjSCxh0Hk3MI7M0+GYjETTSpa6X7hr90
+YrEwrKP+Fhml1glEAw0F/GLVEAmZPA==

NOTE: I put the carriage returns in the above information from TextEdit because it pasted as one long line headed somewhere out the right side of the FTM screen.


unfortunately that mauled it good. those pluses indicate truncation. (data loss) that's base64 encoded text and is normally readable but is easier to deal with when it's complete.

1. open a terminal window and type "cat " (notice the space after the "t", it's important, and don't type the quotes), DON'T hit return yet
2. drag and drop the file into the terminal window so it will enter its path for you
3. type " | openssl base64 -d" and hit return
if the file is legal base64, it will decode it for you. the output may be binary, and unreadable. if it is, close the terminal window and open a new one, and repeat above but for the second part, add this instead:
3. type " | openssl base64 -d | xxd -c 32" and hit return
and see what that gets you

I took a look at a chunk of it though and it looks like binary data

If that doesn't work, try this step three instead:
3. " | while read x ; do echo "$x" | sed 's/.\{64,64\}/& /g' | tr ' ' '\n' | openssl base64 -d ; done | xxd -c 32"




I work for the Department of Redundancy Department
Re: Damned MacKeeper
ryck #35070 07/15/15 02:24 PM
Joined: Aug 2009
Likes: 5
Moderator
Offline
Moderator

Joined: Aug 2009
Likes: 5
It sounds to me like you might have a format error in your attempts to use SUDO RM - RF from the Terminal command line.

...just to clarify the terminal command for removing a file permanently while using ROOT permissions temporarily (as SUDO):

to get the file auto inserted behind the command you need to type the following -

sudo rm -rf

(if you drag your cursor over the above command you will note that there is ONE space between the "rm" and the "-rf" followed by another SINGLE space...)

when you are in the Terminal this will leave your text entry cursor at the exact spot that the path to your file in question needs to be entered in order to complete the command.

NOW is when you use the Finder to drag and drop the file in question onto the Terminal window where it will write the rest of your command and complete it with proper syntax and format.

When you hit return, you will be prompted to enter your admin password (which will NOT display as you type it), then hit return again.....that file should now be gone.

(If you enter an additional sudo command before the internal timer releases your password, the Terminal will execute it without requesting you to type your admin password a second time.....once the internal timer expires, you will be prompted for your password again.)


Freedom is never free....thank a Service member today.
Re: Damned MacKeeper
MacManiac #35075 07/15/15 04:54 PM
Joined: Aug 2009
Likes: 4
Offline

Joined: Aug 2009
Likes: 4
Originally Posted By: MacManiac
to get the file auto inserted behind the command you need to type the following -

sudo rm -rf

(if you drag your cursor over the above command you will note that there is ONE space between the "rm" and the "-rf" followed by another SINGLE space...)

Au contraire: There is no space after the -rf in its presentation in your response; but it does show up when I use the "Quote" option to respond. Obviously a formatting issue within UBB.threads.
The fact that you pointed out the issue should be sufficient.

Re: Damned MacKeeper
grelber #35076 07/15/15 05:34 PM
Joined: Aug 2009
Likes: 3
Moderator
Offline
Moderator

Joined: Aug 2009
Likes: 3

There is a single space after the -rf on my machine (OS X 10.10.3, Safari 8.0.6) when I select the command by dragging across it as instructed by MacManiac:

space.png



dkmarsh—member, FineTunedMac Co-op Board of Directors
Re: Damned MacKeeper
dkmarsh #35077 07/15/15 05:44 PM
Joined: Aug 2009
Likes: 4
Offline

Joined: Aug 2009
Likes: 4
Originally Posted By: dkmarsh
There is a single space after the -rf on my machine (OS X 10.10.3, Safari 8.0.6) when I select the command by dragging across it as instructed by MacManiac:
space.png

Not mine: OS X 10.7.5, Firefox 39.0.

Page 1 of 2 1 2

Moderated by  alternaut, dianne, dkmarsh 

Link Copied to Clipboard
Powered by UBB.threads™ PHP Forum Software 7.7.4
(Release build 20200307)
Responsive Width:

PHP: 7.4.33 Page Time: 0.040s Queries: 65 (0.025s) Memory: 0.7170 MB (Peak: 0.9027 MB) Data Comp: Zlib Server Time: 2024-03-29 10:32:35 UTC
Valid HTML 5 and Valid CSS