Virus, adware, or nothing to worry about?

[Lefty Loco]

Hello all! So yesterday I opened Safari and the first thing I saw was a medium-sized popup window from MacKeeper saying, "Before you continue, you should check this out" (or clean your Mac, or something along those lines). Quit Safari and re-opened to see the same message again. This window opened alone, not on top of a Safari window--no Safari window opened while this was there. I feel silly for what I'm about to say, but now I can't remember how I bypassed it and got to my Top Sites Screen (the one I have set to be default upon opening Safari). Anyway, so when I did get Safari open, the browser window was re-sized from the normal large size I always have to a medium-sized one, so I maximized it back to normal. That was odd, but then also all of the Top Sites preview icons looked weird too, like when you change the screen resolution and all the icons on the desktop look too big and blurry. Also, some of them would not take me to the site when I clicked on them. It stayed on the Top Sites screen and the address bar had the https: secure site prefix and then just my nickname for that site instead of an actual web address. The ones that did actually take me to the site opened the site in a very strange way, like only part of the image was there and then it was like stretched and blurred from the top down like a barcode or something, then after a few seconds the site would re-focus properly. Needless to say I was very concerned, so the first thing I did was update ClamXav and scan the system. One strange thing here was when it began to scan I got a message that said there was an issue with the quarantine folder and I had to change something in settings or something. I stopped the scan and re-started it and got no message this time. Scan results came up clean. Not quite satisfied, I updated BitDefender and scanned again, and came up clean again. After a while, and after clicking on my Top Sites one by one, the icons went back to normal and finally started taking me to the proper site. It's all very weird and I'm still kind of concerned. Has anyone ever seen something like this?

 

[cradom]

Uninstall Mackeeper. Now. Almost no one here uses it or recommends it (although it's advertised here).
As far as most people here are concerned, it's malware.
http://www.mac-forums.com/forums/apple-rumors-reports/301553-mac-forums-investigates-mackeeper.html

 

[Lifeisabeach]

Have you ever installed MacKeeper? If so, make sure it is gone gone gone. That software is very naggy and if not eradicated completely, it may still be bugging you to buy it.

Also, you really shouldn't be running two different pieces of AV software. Actually, since OS X has built-in malware protection (XProtect, for Snow Leopard and onwards), you have 3 pieces running. This is overkill and if you are running both of those in the background constantly, you can actually cause problems as they fight each other and over-tax your system. I recommend not running any 3rd party AV software in the background. If you like, keep one around to run only on demand once in a while as a "2nd opinion". Otherwise, XProtect is perfectly adequate on its own.

 

[Lefty Loco]

But I've never installed MacKeeper, at least not knowingly, and I never would. I'm well aware of their bad reputation. Maybe I've clicked the "OK" box on one of their popups to make it go away, but I've never actually gone through any installation. And I don't even do that any more. If I ever get one, I quit or force quit Safari.

I understand what your'e saying about more than one AV program, and I'll get rid of one. I don't let them run in the background though--I just use it to scan the system now and then when something looks fishy. I'll search my system to see if anything from MacKeeper exists, but I anticipate I will not find anything.

So, I'm still a bit concerned and perplexed by this whole thing. And wondering if anyone has ever seen their system act like what I described in the previous post.

 

[Lifeisabeach]

But I've never installed MacKeeper, at least not knowingly, and I never would. I'm well aware of their bad reputation. Maybe I've clicked the "OK" box on one of their popups to make it go away, but I've never actually gone through any installation. And I don't even do that any more. If I ever get one, I quit or force quit Safari.

Then more likely than not, it's some form of a pop-up ad. Do you have an adblocker installed? If not, consider doing so.

If it's not that, then you may have some other extension or software installed that is trying to push MacKeeper on you. That's my best guess anyway.

 

[Lefty Loco]

The only popup blocker I have is the one that is native to Safari, though it doesn't always seem very effective. Do you have any suggestions for good ones?

 

[Breitling65]

I am using Sophos, not sure yet if this software is very effective but it is free

Antivirus, Endpoint, Disk Encryption, Mobile, UTM, Email and Web Security | Sophos

 

[Lifeisabeach]

The only popup blocker I have is the one that is native to Safari, though it doesn't always seem very effective. Do you have any suggestions for good ones?

The AdBlock extension is quite excellent.
AdBlock

 

[osxx]

I have seen more problems in the last couple of years with people adding AV software and other add ons without just running the Mac out of the box and giving it a chance.
Read the stickies and the pros and cons before you hit a download button in the long run it will save you time and money.

 

[IWT]

Hi Lefty Loco

To uninstall Mackeeper, you can use this link: Uninstalling MacKeeper

Although this usually works, there can be problems because the app is almost a form of malware itself and leaves a trail of uninstalled files on board. Some have, in addition to the above, used "App cleaner"and/or App Trap.

You are not the first and unlikely to be the last who has unaccountably found this pernicious app on your machine.

It's total removal is paramout—like now!

If you absolutely must have virus protection, this community recommends ClamX which has the added advantage of being free.

If you need to sort out day-today problems, this forum regularly suggests using the free OnyX—just make sure you download the current version for your OS X (Osirix for Leopard, Snow Leopard, Lion & ML are specific to your OS X). Then let it do it's job.

PLease feed back on success or otherwise of getting rid of Mackeeper.

Ian