MacKeeper Unwanted Application (Mac)

What is MacKeeper?

Developed by Zeobit and then acquired by Kromtech, MacKeeper is a legitimate and useful application for Mac users. It provides functionality that allows users to optimize and increase system performance.

Despite this, some MacKeeper affiliates employ dubious/unacceptable measures to proliferate this software. Therefore, it can be classed as potentially unwanted program (PUP).

This application is proliferated in various ways. It has an official download website, which is fine as a legitimate app, however, as mentioned above, some criminals proliferate this program in dubious ways. For example, they develop malicious websites that display fake error messages claiming that the system is corrupted.

To resolve these "issues" (that do not exist), users are encouraged to download MacKeeper. The list of dubious sites includes (but is not limited to) Virus Found and We Have Detected A Trojan Virus. Criminals also proliferate this application using intrusive advertisements (pop-ups, banners, etc.) and a deceptive marketing method called "bundling".

If you feel that MacKeeper has infiltrated systems without your consent, follow the guide below and remove this application.

The aforementioned methods are also used to proliferate other PUPs that are not legitimate (e.g., adware, browser hijackers, etc.) Most generate intrusive advertisements and record various sensitive data. The ads are delivered using various tools that enable placement of third party graphical content on any site.

Therefore, they often conceal underlying website content, thereby diminishing the web browsing experience. Most PUPs are also designed to gather various information that typically includes personal details.

Internet Protocol (IP) addresses, Internet service providers (ISPs), geographic locations, URLs visited, pages viewed, queries entered into search engines, keystrokes, and other collected data is later sold to third parties (potentially, cyber criminals). These people generate revenue by misusing private information.

Therefore, the presence of information-tracking apps can lead to serious privacy issues or even identity theft. We highly recommend that you remove all dubious applications and browser plug-ins.

Threat Summary:

Name	MacKeeper potentially unwanted program
Threat Type	PUP (potentially unwanted program), PUA (potentially unwanted application)
Detection Names (MacKeeper.4.6.2(1).pkg)	DrWeb (Program.Mac.Unwanted.MacKeeper.60), BitDefender (Application.MAC.Paza.BLE), ESET-NOD32 (OSX/Mackeeper.CL Potentially Unwanted), McAfee (OSX/Mackeeper.g), Full List (VirusTotal)
Symptoms	A program that you don't recall installing suddenly appeared on your computer. New application is performing computer scans and displays warning messages about found issues. Asks for payment in order to eliminate the supposedly found errors.
Distribution methods	Deceptive pop-up ads, free software installers (bundling), fake flash player installers.
Damage	Monetary loss (unnecessary purchase of fake software), unwanted warning pop-ups, slow computer performance.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

All potentially unwanted programs are very similar. By offering a number of features, PUPs such as MyShopcoupon, TURBOMAC, and others, attempt to give the impression of legitimacy, however, their only purpose is to generate revenue for the developers.

Only a small percentage give the features promised - most are useless. Rather than (or together with) enabling the functionality promised, potentially unwanted programs pose a direct threat to your privacy and Internet browsing safety.

How did MacKeeper install on my computer?

As mentioned above, MacKeeper is proliferated using intrusive ads, together with the "bundling" method. Intrusive ads redirect users to malicious websites and/or run scripts that download/install PUPs. Therefore, even a single click might result in inadvertent installation of certain applications.

"Bundling" is stealth installation of PUPs together with regular software. Developers hide "bundled" apps within "Custom/Advanced" settings (or other sections) of the download/installation processes.

Many users rush these procedures and skip steps. In doing so, they expose their systems to risk of various infections. The main reasons for computer infections are poor knowledge and careless behavior.

How to avoid installation of potentially unwanted applications?

To prevent this situation, pay close attention when browsing the Internet and, especially when downloading/installing software. Bear in mind that criminals invest many resources into developing intrusive ads. They often seem legitimate, but are distinguishable, since most lead to survey, gambling, pornography, and other dubious websites.

As mentioned before, intrusive ads are typically delivered by PUPs and, thus, if you encounter them, immediately remove all suspicious applications and browser plug-ins. Select "Custom/Advanced" settings, carefully analyze each window of the download/installation procedures, and opt-out of all additionally-included programs.

You are advised to download software from official sources only, using direct download links, since criminals employ third party downloaders/installers to proliferate ("bundle") PUPs. Using a legitimate anti-virus/anti-spyware suite is also paramount. The key to computer safety is caution.

Screenshot of the MacKeeper application:

Appearance of the MacKeeper application (GIF):

Screenshot of the official MacKeeper download website:

Screenshot of the official MacKeeper installation setup:

Rogue software installers used to distribute MacKeeper unwanted application:

Another website used to promote MacKeeper PUA:

Update May 6, 2020: Since 4/1/2020 MacKeeper became certified by AppEsteem Corporation and is no longer considered a potentially unwanted application. The company that now owns this brand (Clario Tech Limited) no longer participates in shady software distribution tactics. Also, since 4/1/2020 Combo Cleaner no longer detects this application as potentially unwanted.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is MacKeeper?
• STEP 1. Remove MacKeeper related files and folders from OSX.
• STEP 2. Remove MacKeeper ads from Safari.
• STEP 3. Remove MacKeeper adware from Google Chrome.
• STEP 4. Remove MacKeeper ads from Mozilla Firefox.

Video showing how to remove adware and browser hijackers from a Mac computer:

MacKeeper adware removal:

Remove MacKeeper-related potentially unwanted applications from your "Applications" folder:

Click the Finder icon. In the Finder window, select “Applications”. In the applications folder, look for “MPlayerX”,“NicePlayer”, or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Remove adware-related files and folders

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

Check for adware generated files in the /Library/LaunchAgents/ folder:

In the Go to Folder... bar, type: /Library/LaunchAgents/

In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.

Check for adware generated files in the ~/Library/Application Support/ folder:

In the Go to Folder... bar, type: ~/Library/Application Support/

In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.

Check for adware generated files in the ~/Library/LaunchAgents/ folder:

In the Go to Folder... bar, type: ~/Library/LaunchAgents/

In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.

Check for adware generated files in the /Library/LaunchDaemons/ folder:

In the "Go to Folder..." bar, type: /Library/LaunchDaemons/

In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.

Scan your Mac with Combo Cleaner:

If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.

Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

Remove malicious extensions from Internet browsers

Remove malicious Safari extensions:

Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".

In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.

• If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

Remove malicious extensions from Google Chrome:

Click the Chrome menu icon (at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".

• If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.

Remove malicious extensions from Mozilla Firefox:

Click the Firefox menu (at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".

• If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

▼ Show Discussion