MacKeeper has hijacked my Safari Browser

Question

MacKeeper (http:// mackeeperapp.zeobit.com) has hijacked my Safari browser. I have had to open Firefox, in order to get to the internet. I would rather use Safari, since that is where my bookmarks and favorite links are on the toolbar.

A MacKeeper ad was in the sidebar, of the page I was on. I clicked on a link, to go to a website (not MacKeeper), and the window opened for MacKeeper, with a pop-up to let MacKeeper clean my Mac.

The ONLY option is to click "OK", which I refuse to do, because I know almost all of these "cleaner" apps are malware, with hidden stroke counting codes.

The box says

> > > RECOMMENDED DOWNLOAD < < <

We recommend to clean your Mac with MacKeeper - award-winning system utility.

There is an "OK" button, but no way to close out of the box.

Now, there is no way to get out of the website either. When it first started, I panicked, and pushed the power button, because it froze all the tabs and Safari functions, and I didn’t want it to download to my hard drive. I thought if I shut down the computer, it would stop the app from running, which would prevent it from downloading on my hard drive.

I also thought when I turned my computer back on, The MacKeeper pop-up window would be gone, and then I could close the MacKeeper website. But it wasn't gone. I can't do anything in Safari now. I am guessing MacKeeper figures people will eventually get frustrated, and give in, clicking the button, allowing MacKeeper onto the hard drive.

All of my tabs have the rotating circle, indicating something is happening, but the websites, on those tabs, can’t be opened. I tried clicking on the black “x”, one the tabs, but there is no black “x”. I also can’t close the pop-up window, because there is no black “x” on it either.

I went to Finder, to see if MacKeeper had installed itself on my hard drive, and it is not in my /Applications folder. If I go to the application Library, it is not there either. So essentially, MacKeeper has hijacked my browser, but apparently hasn't installed itself on my hard drive.

---

I found a question, here on Super User, about essentially the same thing:

How can I safely close this window and forever avoid seeing similar pop-ups from Mackeeper Zeobit's malware and spyware?

That user had intentionally installed MacKeeper, and uninstalled it, but missed a file in the uninstall, and was able to delete it in the Library. That is not the case here. I did not want anything to do with MacKeeper. It came onto my browser without being invited.

On that discussion, a couple people said that clicking the “OK” button, won’t allow MacKeeper to be installed on my hard drive, but I don’t trust MacKeeper, to not do it behind the scenes. I have heard of other cleaner apps, that have done the same thing, so I don’t trust any of them.

Also on the same discussion, someone from MacKeeper answered, saying that it is totally safe, and clicking on “OK” wouldn’t do anything. How can I trust him, when others, have had problems with MacKeeper, and some experts have called it “malware”? I have a hard time trusting a company that has a reputation for selling malware.

---

Can anyone tell me how to get rid of the pop-up box, without clicking on the “OK” button? I can’t use my Safari, until it is gone. I really don’t want to recreate all the bookmarks and favorite links, that I have on Safari, to Firefox. I just did that last Fall, when my hard drive crashed, and it is a real pain!

Answer 1

Per slhck's request, I will try to explain what I did.

As several people suggested, I tried to "Force Quit", to get out of Safari, and get the MacKeeper tab to close that way, but was not able to do that, because Force Quit was grayed out, and unclickable, while MacKeeper had the JavaScript requiring me to click OK was on the screen.

After asking questions on two forums, I decided to install an antivirus (AV) app on my computer. Prior to that I had not done so, because I had read that Apples were safe from viruses. Well, now I am not so sure, since MacKeeper was able to hijack my Safari browser, after it opened a tab, without my permission.

The AV that was recommended to me was AVAST. Once I had installed the most current version, of AVAST, there was a message, on the confirmation page, that my computer was now protected. Given my recent experience, I am not sure I can believe any of that type of app, but decided I had to take a chance, since my Safari was unusable, unless I went ahead and clicked on OK, in the JavaScript box.

I checked my app list in Finder, and there wasn't anything for MacKeeper listed. Someone had suggested to click on the hard drive in Finder, and then open the Library, to see if there were any MacKeeper files there. I checked and there were none.

I ran the virus scan. and it didn't appear to have found any viruses, so I finally clicked on OK, with the intention of closing the MacKeeper tab immediately. When I clicked OK, it was like it had a mind of it's own. It all happened so fast, it was a bit confusing. The appearance of the website page change, but I was so shocked by what I saw in the address box, I didn't really see what it looked like. What I saw in the address box, was that mackeeper. ziobit. com/ instantly changed to a long string of numbers and letters and symbols. I panicked and immediately tried to close the tab, by clicking on the black "x" in the left corner of the tab. It took three tries to finally get the tab to close the page.

Once I had calmed down, I went back to Finder and checked for MacKeeper again, both in my App folder and in the hard drive Library, but didn't find it.

After I had done all that, I was told that ClamXAV was better than AVAST. So, I did some research and decided it wouldn't hurt to double check AVAST by running another AV app. Well, ClamXAV actually found about 50 Trojan Horses and other viruses, that AVAST had not found. Since I am not well versed in the different types of viruses, I don't remember which ones now. Interestingly enough, a split second after ClamXAV found the Trojan Horses and other viruses, AVAST found them, and alerted with a pop-up. I figured if ClamXAV had found all those viruses, and AVAST didn't find them until ClamXAV had already found them, I didn't need AVAST. So, I uninstalled it.

I was finally able to spend some time on the phone with my daughter, who said she hasn't used Safari, for about eight months. And here I was using it, because she said she was using it and liked it better than Firefox. She said she changed because she found that Chrome worked better for her, with her web design other technical web applications. She said I probably didn't need Chrome, but that Opera might work better for me, and she thought it might be a bit more secure than Safari. She was thinking that since Safari is the official Apple browser, hackers might be working a little harder to crack that nut. So, I downloaded Opera, and have been learning all the ins and outs. It seems to be a good browser, and in some ways it is better. For instance: On Safari, I haven't been able to find a way to have sub-folders to folders in my bookmarks. Opera is a bit different in the way you set up your bookmarks, but I like the way you can set up sub-folders within sub-folders. That is important to me, since I do a lot of medical research, and need to be able to finely delineate modalities.

All in all this has been a nightmarish experience. I know Apple sells MacKeeper on their App Store, but for the life of me, I can't understand why they would sell an app, that has such a wide reputation for being malware. Given my experience with MacKeeper attaching itself to my browser, when I never wanted anything to do with "cleaner apps", and never clicked on anything, to even look at it, it is just devious. Besides, from what I have read it doesn't do anything that Apple hasn't already installed on the OSX.

Before I go, I would like to give a shout out to the IT geeks that tried to help me with my problem (especially slhck). I wouldn't have had the courage to go ahead and try to work through this without their help. Thanks Guys!!!

Answer 2

As the other sources (and comments here) have said, clicking OK isn't enough to cause trouble. Even if they get you to download the MacKeeper installer, you still cannot be forced to actually install the software. But if you really don't want to even click OK, there are a few ways out. Here's one:

1. Quit (or force quit if necessary) Safari
2. In the Finder, hold Option while pulling down the Go menu and select Library. (Note that the Library choice only appears while Option is held down.) This opens your user Library folder, which contains all sorts of settings and config files.
3. In the your Library folder, open the Saved Application State subfolder.
4. Inside Saved Application State, find the com.apple.Safari.savedState subfolder. This folder contains information about open windows and tabs, to allow Safari to reopen them automatically.
5. Move the com.apple.Safari.savedState folder (and only that folder) to the trash.
6. Reopen Safari. It should come up with a single window, showing your default start page (if any). Your bookmarks etc should be intact, just the open windows and tabs (including the obnoxious MacKeeper one) should be gone.

Answer 3

After you Force Quit, when you reopen Safari hold down alt when clicking on Safari — this stops any previous sessions from loading up. You will start a brand new session.

Once back into safari you can go into your Preferences to ensure home pages etc. are all intact. I have contacted Apple about this and provided them with sites that are causing this, like MacKeeper etc.

Answer 4

As the other sources (and comments here) have said, clicking OK isn't enough to cause trouble. Even if they get you to download the MacKeeper installer, you still cannot be forced to actually install the software.

This is potentialy false.

THe current revision of this particular peice of malware attempts to install itself, and only AFTER failing to do so automatically prompts the user for help, if you hava Java installed you can be automatically infected.

It sounds like the author is infected despite what they might think happen.

Answer 5

I think you are able to use a little workaround for this - simply deny any one (or all) of your applications access to the »mackeeperapp.zeobit.com« domain.

I've just made this rule myself and it seems to work though I can't be fully sure whether I've encountered the particular javascript that triggers the alert or not.

Answer 6

The dialog that is shown is simply a JavaScript alert. This is not an answer on how to close an abusive page on Safari, but for Chrome there are some ways. As they're not obvious at all and might work in other browsers too, here goes:

• Click the browser window to give it focus (rather than the popup dialog) and use Chrome's File menu. (One cannot close the tab using the mouse, nor using any keyboard shortcuts. But once the browser window has focus, its File menu does work. As long as the dialog has focus, all menu items are grayed-out.)

• Or: type a different URL in the abusive tab to simply go to another page.

• Or: focus the browser window and use the Chrome task manager (menu Window, Task Manager) to kill the tab. After that, the dialog will still be visible, but clicking OK won't do anything.

Try for yourself here.

(As an aside: Firefox shows that with an overlay on the source page only, and then shows that page with full control. Firefox itself does not take focus, nor makes its dock icon bounce though. Internet Explorer shows a close icon, which is effectively the same as clicking OK. And I very much agree that there's no security issue with such dialogs—anything that can be done after the dialog was shown, could be done without it as well. So: simply clicking OK might be easiest, maybe quickly followed by pressing Esc to stop loading whatever page is loaded next.)