An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#47834 - 02/05/18 04:13 PM mac keeper
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
OS 10.12.6

Quite often Mackeeper will appear uninvited asking me to download. Today it appeared and said I had 3 viruses and to remove them I should download Mackeeper.

I have ClamXAV and it didn't find anything. What is the story with Mackeeper and is there a way of preventing it from appearing?

Whilst I'm here, is there any way of allowing folders to be located anywhere on the desktop?

jaybass

Top
#47836 - 02/05/18 05:35 PM Re: mac keeper [Re: jaybass]
artie505 Online


Registered: 08/04/09
Not that it's anywhere near guaranteed, but have you got Safari > Preferences > Security > Block pop-up windows checked?

If "Yes", I don't know if there's any way to keep those MacKeeper pop-ups from popping up other than by not visiting the websites at which they pop up, but I do know, not from personal experience, happily, but from any number of past mentions at FTM, that MacKeeper is to be avoided.

I think this will allow you to place folders anywhere on your desktop and have their positions survive a restart: in Finder, hit command-J and select "Sort by: None".

If that works for you as it does for me, newly created folders and other new items will line up along the right edge of your screen from where they can be moved anywhere.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#47842 - 02/06/18 03:27 AM Re: mac keeper [Re: jaybass]
jchuzi Online


Registered: 08/04/09
Loc: New York State
Malwarebytes may be able to detect something. It has a free version, so it won't cost you anything.
_________________________
Jon

OS 10.15.3, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365

Top
#47843 - 02/06/18 04:20 AM Re: mac keeper [Re: artie505]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
Thanks for for that tip i.e. finder>command-J "sort by none" did the trick.

Safari>prefs>Block pop-up windows is already checked.

Jon, I have found ClamXAV has notified me immediately of any malware etc but thanks for the suggestion.

jaybass

Top
#47914 - 02/09/18 08:56 PM Re: mac keeper [Re: jaybass]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
Originally Posted By: jaybass
OS 10.12.6

Quite often Mackeeper will appear uninvited asking me to download. Today it appeared and said I had 3 viruses and to remove them I should download Mackeeper.

I have ClamXAV and it didn't find anything. What is the story with Mackeeper and is there a way of preventing it from appearing?


It appears when you browse the Web because unethical Web owners place ads on their Web sites that open scary-looking but fake virus warnings urging you to download MacKeeper.

You can ignore these warnings; they are phony.

The makers of MacKeeper have already been sued twice, and lost twice, for fake virus warnings. They just pay the fines and move on, because fake virus warnings are a huge, huge moneymaker, and getting sued is simply part of the cost of doing business.
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#47920 - 02/10/18 06:49 AM Re: mac keeper [Re: tacit]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
I read that Safari prefs>privacy>manage website data, type Mackeeper in the small window and it appears in the window below with the option to 'remove' I did that but it returned shortly aferwards. Perhaps whoever does the sueing should increase the fines to make it impracticable...if they have that much authority.

jaybass

Top
#47921 - 02/10/18 07:02 AM Re: mac keeper [Re: jaybass]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: jaybass
I read that Safari prefs>privacy>manage website data, type Mackeeper in the small window and it appears in the window below with the option to 'remove' I did that but it returned shortly afterwards.

Does this mean that the issue is more than MacKeeper pop-ups continually reappearing? Is the problem that you have installed MacKeeper and now need to get rid of it?
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS Mojave 10.14.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 1TB LaCie USB-C
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#47922 - 02/10/18 08:18 AM Re: mac keeper [Re: ryck]
joemikeb Online

Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
MacKeeper is notoriously difficult to delete and unless carefully and thoroughly expunged is reputed to leave bits parts and pieces around that apparently sometimes recreate/redownload/reinstall MacKeeper or at the very least have a deleterious effect on system performance. The removal instructions on MacKeeper's web site are generally conceded to be incomplete at best. A Google or DuckDuskGo search on how to remove MacKeeper will return a LOT of hits from places like OS X Daily, MacWorld, iskeysoft, YouTube, WikiHow, the Official Appple Support Communities, and many more. One of those links should exorcise the demon.
_________________________
joemikeb • moderator

Top
#47923 - 02/10/18 08:35 AM Re: mac keeper [Re: jaybass]
artie505 Online


Registered: 08/04/09
Originally Posted By: jaybass
I read that Safari prefs>privacy>manage website data, type Mackeeper in the small window and it appears in the window below with the option to 'remove' I did that but it returned shortly aferwards. Perhaps whoever does the sueing should increase the fines to make it impracticable...if they have that much authority.

jaybass

All you're doing with that exercise is searching your cookies for MacKeeper cookies and deleting them (only to see them return on their own).

That has nothing to do with MacKeeper's possible presence on your Mac. (Evercookies?)
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#47924 - 02/10/18 08:43 AM Re: mac keeper [Re: joemikeb]
grelber Offline


Registered: 08/05/09
Loc: North of 49th ||
Originally Posted By: joemikeb
MacKeeper is notoriously difficult to delete and unless carefully and thoroughly expunged ...

I've been impressed by AppCleaner's ability to isolate and eliminate an app and most if not all its associated bits and pieces which one might not otherwise be able to isolate. On a couple of occasions there have been several residual items which a careful search can isolate and one can deal with them on an individual basis.

AppCleaner may still have a free version available. Check it out. It's available via the App Store or directly from FreeMacSoft.

Top
#47927 - 02/10/18 08:53 AM Re: mac keeper [Re: grelber]
joemikeb Online

Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
Originally Posted By: grelber
I've been impressed by AppCleaner's ability to isolate and eliminate an app and most if not all its associated bits and pieces which one might not otherwise be able to isolate. On a couple of occasions there have been several residual items which a careful search can isolate and one can deal with them on an individual basis.
AppCleaner is excellent but, in the name of protecting itself from malware, MacKeeper intentionally hides or disguises some components and others are a hodge podge of bits parts and pieces of other apps so conventional app removal techniques, even installation tracking daemons, are know to fail. mad
_________________________
joemikeb • moderator

Top
#48077 - 03/01/18 05:44 AM Re: mac keeper [Re: joemikeb]
Virtual1 Offline


Registered: 08/04/09
Loc: Iowa
Like most other malware, it is known to pick random filenames when installing its components, to make them difficult to find and remove. And yes, it can sometimes "grow back" things you have deleted.

Some of the more virulent varieties require a reboot in safe mode to pull out the bits.

It has a lot of variations, I suspect the producers of the app have business arrangements with some of their clients, on a "find a creative way to install us and keep us installed and we'll pay you more" basis, and that's lead to an unusually large number of creative and persistent varieties of installations.

Not all web pages that push it are in on the joke though. Most ad banner pushing services have a rotating and changing catalog of ads, you don't see the same ad in the same spot on the page every time you load it. Businesses buy slots from the advertisers and get themselves into the rotation, and are billed by the number of "impressions" they are given - i.e. the number of times your ad is displayed on someone's screen. The advertisers have little incentive to police their ads because they're making money displaying them, malware isn't affecting their client (the web site) or their other client (the malware maker) so they're somewhat insulated from complaints.

Eventually a website owner will get enough complaints to threaten or drop the banner provider (who is paying the web site to display their banners, that's one way websites cover their operating costs) but they just move on to another web site, there's a lot of suckers to pick from. It's not a problem that's going to go away anytime soon.

Bigger sites get in the news for serving up malware, because they've got a much larger audience, the audience expects better from them, and as such they tend to keep a close eye on their advertisers. (and if they drop one, that's a major loss of business for the advertiser, so they are more likely to watch what they provide also) But it still happens from time to time.
_________________________
I work for the Department of Redundancy Department

Top
#48137 - 03/05/18 02:52 PM Re: mac keeper [Re: artie505]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
artie, I don't think I mentioned that I downloaded DetectX Swift and have not had a pop-up since.

That was Feb18th so it has proved itself so far and the price is very reasonable.

jaybass

Top
#48142 - 03/05/18 10:58 PM Re: mac keeper [Re: jaybass]
artie505 Online


Registered: 08/04/09
Thanks for the update, jaybass.

Can you tell us how DetectX Swift silenced those Mackeeper pop-ups?

Did it locate a rogue file or function or was it something else altogether?
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#48153 - 03/06/18 04:14 PM Re: mac keeper [Re: artie505]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada

Top
#48156 - 03/07/18 07:43 AM Re: mac keeper [Re: jaybass]
joemikeb Online

Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
I just attempted to go to the DetectX web site and ran into this warning either from Safari Technology Preview or OpenDNS (I couldn't tell which) based on the WOT (Web Of Trust) rating for the site. I read the developers comments in jaybass' link but those are self serving and therefore not necessarily trustworthy. Until the developer can clear this up with WOT and others, I won't be installing DetectX. That's a shame as it looks like an interesting tool.
_________________________
joemikeb • moderator

Top
#48157 - 03/07/18 07:53 AM Re: mac keeper [Re: joemikeb]
artie505 Online


Registered: 08/04/09
I just followed the links to the dev's website on MacUpdate's DetectX and DetectX Swift pages (OpenDNS) and didn't get your pop-up.

Same with links provided by Google.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#48162 - 03/07/18 11:29 AM Re: mac keeper [Re: artie505]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
To change the subject, Do I need SIP enabled?
jaybass.

Top
#48163 - 03/07/18 11:49 AM Re: mac keeper [Re: joemikeb]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
I just went to DetectX web site (twice) using safari and I never received any warning.

Considering this software is about 5 years old, unsupported, and free, why would the

developer make remarks that could be contrued as seIf serving?

Reviews are good.

jaybass

Top
#48165 - 03/07/18 12:53 PM Re: mac keeper [Re: artie505]
joemikeb Online

Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
Originally Posted By: artie505
I just followed the links to the dev's website on MacUpdate's DetectX and DetectX Swift pages (OpenDNS) and didn't get your pop-up.

Same with links provided by Google.

Are you using OpenDNS? That could be the source, I didn't take the time to go exploring to find out where the message originated. It could also be originating with Safari Technology Preview Release 50 (Safari 11.2, WebKit 13606.1.5) as Apple is always testing new security options. The WOT rating is current.
_________________________
joemikeb • moderator

Top
#48166 - 03/07/18 12:56 PM Re: mac keeper [Re: jaybass]
joemikeb Online

Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
Originally Posted By: jaybass
To change the subject, Do I need SIP enabled?

SIP is intended to protect your computer from viruses and other exploits modifying the OS to open it up for installing malware without your knowledge. If you disable SIP and your computer catches a virus or other exploit you have only yourself to blame. If you do disable SIP I would have a clean copy of MacOS available on a drive not connected to your computer available just in case.
_________________________
joemikeb • moderator

Top
#48167 - 03/07/18 02:23 PM Re: mac keeper [Re: joemikeb]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
I read conflicting opinions on a forum and apparently, it only needs disabling when installing certain kinds of software...did I get thay right?

It is now enabled.

jaybass

Top
#48169 - 03/08/18 01:11 AM Re: mac keeper [Re: joemikeb]
artie505 Online


Registered: 08/04/09
Originally Posted By: joemikeb
Originally Posted By: artie505
I just followed the links to the dev's website on MacUpdate's DetectX and DetectX Swift pages (OpenDNS) and didn't get your pop-up.

Same with links provided by Google.

Are you using OpenDNS? That could be the source, I didn't take the time to go exploring to find out where the message originated. It could also be originating with Safari Technology Preview Release 50 (Safari 11.2, WebKit 13606.1.5) as Apple is always testing new security options. The WOT rating is current.

I'm using OpenDNS and DID NOT get your pop-up, and since jaybass - same 10.12.6 as me - didn't either, STP looks to be "at fault". (I'm in Safari 11.0.3 as compared to your 11.2.x)

More: I just switched from OpenDNS to Google's servers and still didn't get the pop-up.


Edited by artie505 (03/08/18 01:42 AM)
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#48170 - 03/08/18 01:19 AM Re: mac keeper [Re: jaybass]
artie505 Online


Registered: 08/04/09
Originally Posted By: jaybass

I'm confused, jaybass.

Your initial post sounded like your problem was that you were getting MacKeeper pop-ups soliciting you to download it while you were browsing, but now it sounds like you used DetectX to uninstall it.

Did I misunderstand you?
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#48171 - 03/08/18 06:13 AM Re: mac keeper [Re: artie505]
jaybass Offline


Registered: 08/04/09
Loc: toronto Canada
Yes, Mackeeper was continually popping up asking to be downloaded.

Whether or not I trashed/uninstaled it I can't remember but after downloading

DetectX Swift, I have not had a pop up since. If MacKeeper keeps popping up on

your computer, give it a try. I'm sure you have back ups.

That's quite a comprehensive explanation the developer gives.

jaybass

Top

Moderator:  alternaut, dkmarsh, joemikeb