Macos – How to get rid of Mackeeper.zerobit pop-up from Safari

macmacosmalwaresafari

Whenever I open any link or search for anything that has the word Mac, Computer, Keeper, etc. A new tab opens with an advertisement for MacKeeper. The website is called

http://mackeeperapp.zeobit.com/landings/17/index.php?affid=zzb_198.2691564.1408407869.5.zzb&utm_source=N%2FA&utm_medium=zzb_3059&utm_campaign=mk_nvrbl_us_ff&utm_term=&utm_content=mk_nvrbl_us_ff&userDefiner=zzb_3059&installer=mk_nvrbl_us_ff&trt=29_210312&tid_ext=77856;1928157913

Just to be clear, I have not downloaded anything related to mackeeper or zeobit or mackeeper.zeobit, so deleting files (that won’t be there) won’t help!!

Safari is really more of a nuisance now, that a helpful web browser, and I generally really like Safari… Please help!

Best Answer

MacKeeper is well known ransom-ware. Go to “Applications > Utilities > Activity Monitor” Open Activity Monitor and in the filter box type “kee” Is MacKeeper listed as running?

Also check the file:

/etc/hosts

For any reference to MacKeeper or zeobit

You will need root access to edit the /etc/hosts file.

Does the same thing happen if you use Firefox rather than Safari? If yes, then it is most likely the /etc/hosts file.

Related Solutions

How to Rename the C:\Users\UserName Folder in Windows 10

Most likely (but untested here) reason is that the folder is being guarded/accessed is its designation as a profile folder. The tutorial from TenForums edits the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<*User SID*> path before renaming the folder.

Macos – How to get rid of Community Toolbar in Safari

This seems to have "infected" multiple locations in /Library. First, quit Safari. Might not hurt to also run the following command from a Terminal (it will prompt you for your password):

sudo launchctl unload /Library/LaunchAgents/com.conduit.loader.agent.plist

Then, delete the following files/folders by moving them to Trash and emptying it.

Note that / is your Macintosh HD, and the Library folder might be invisible. To access it, press ⌘⇧G in a Finder window and enter /Library.

/Library/Application Support/Conduit
/Library/InputManagers/CTLoader
/Library/Receipts/ctloader.pkg
/Library/Receipts/<Toolbar name>.pkg
/Library/Application Support/SIMBL/Plugins/CT2285220.bundle
/Users/<User name>/Library/Application Support/Conduit

That should be it, according to forum posts and this cnet.com article.

Best Answer

Related Solutions

How to Rename the C:\Users\UserName Folder in Windows 10

Macos – How to get rid of Community Toolbar in Safari

Related Question