Getting Rid of MacKeeper

This is an application you should never install. But if you have, there's a way out.

Get It Try It

MacKeeper: one runs into it all the time. So much so - and in such insidious ways - that the negative publicity forced the people behind the product to do a bit of hide and seek in 2013. MacKeeper is now supposedly sold to KromTech, but nothing has changed - the same servers, the same product, all the way.

MacKeeper is registered in Belize, runs through a network in Canada, but is hosted on servers in Lahore, Pakistan. Sound trustworthy? Probably not.

Getting rid of MacKeeper - should one not have seen all the warnings beforehand - is nigh on impossible. The application is insidious.

Suggestions that applications like AppZapper can get rid of it fall on their own naivety and stupidity. None of those methods work or even come close to working.

There's only one guaranteed way to get rid of MacKeeper. And it's not the new MacKeeper uninstaller, found hidden like all the other MacKeeper files all over your file system. The only guaranteed way is to watch and record everything MacKeeper does and, using a bit of grey matter, get rid of all that junk once and for all.

Make no mistake: MacKeeper gets in everywhere. Everywhere. Launch control files, you name it. Sending all 35 MB of /Applications/MacKeeper.app to the 'trash' is - what's the word? You have to give it your admin password to install and run - so what do you think it's been doing with the full access to your system that you gave it?

Only this app can help you. After all these years and there still isn't a comparable competitive product. Check it out. It's part of the Xfile package. And there's a free Test Drive that runs forever. You can get by in a pinch without spending a penny.

Getting Rid of MacKeeper

But more on that in a bit. Most importantly: here's the download you need to get rid of MacKeeper. Just click the link.

ftp://rixstep.com/getridofmackeeper.tbz

There are two files in that download. One is the Tracker 'playback' so you can use Tracker itself to manage what's happened. The other is the 'export' into plain text (the UTF-8 of your file system) that you can use as a reference.

Together these files are all you need.

More Notes on the Install

It's absolutely amazing what bullshit MacKeeper shovels your way. Behold the status screen that turns up immediately your install is complete. If you believe that, there are some really cheap bridges you can buy.

MacKeeper gets into your launchd settings. (You have to remove a plist from a system area.) This is what keeps the danged thing on your menu bar.

There's a bit of a discussion of MacKeeper at the Apple forums and elsewhere.

http://reedcorner.net/?p=245
https://discussions.apple.com/docs/DOC-3691
http://applehelpwriter.com/2011/09/21/how-to-uninstall-mackeeper-malware/

And MacKeeper seems to have been peddled through Apple's App Store as '911', which makes you really wonder how good those nannies at the walled garden really are.

Here's MacKeeper's admonition to not worry about a manual uninstall. Haha.



Here's the hex dump of .3246584E-0CF8-4153-835D-C7D952862F9D, found for MacKeeper's safety's sake in two locations on your system. Note the 'dot' in the beginning of the file name so the file won't show up in your dear Finder. Note the use of the pseudo 'UUID' format for the name, to give the file the appearance of 'authenticity' so you timid users don't touch it. Of course Tracker will tell you immediately it was planted on your system by MacKeeper. The file is probably used to limit your trial use - note the use of NSDate.

00000000  04 0b 73 74 72 65 61 6d  74 79 70 65 64 81 e8 03  |..streamtyped...|
00000010  84 01 40 84 84 84 13 4e  53 4d 75 74 61 62 6c 65  |..@....NSMutable|
00000020  44 69 63 74 69 6f 6e 61  72 79 00 84 84 0c 4e 53  |Dictionary....NS|
00000030  44 69 63 74 69 6f 6e 61  72 79 00 84 84 08 4e 53  |Dictionary....NS|
00000040  4f 62 6a 65 63 74 00 85  84 01 69 03 92 84 84 84  |Object....i.....|
00000050  08 4e 53 53 74 72 69 6e  67 01 95 84 01 2b 01 36  |.NSString....+.6|
00000060  86 92 84 84 84 06 4e 53  44 61 74 65 00 95 84 01  |......NSDate....|
00000070  64 83 74 7e e6 95 da 74  b7 41 86 92 84 97 98 01  |d.t~...t.A......|
00000080  37 86 92 84 99 9a 83 2a  91 e0 b9 de 74 b7 41 86  |7......*....t.A.|
00000090  92 84 97 98 01 64 86 92  98 86                    |.....d....|

Here's MacKeeper's 'whois'.

Registrant Contact:
   GREGERS PRODUCTIONS CORP.
   ZeoBit Admin ()

   Fax:
   35 Barrack Rd., Third Floor
   Belize City, Belize City 1111
   BZ

The MacKeeper site runs on 174.142.19.46. That's in the Tricastmedia 174.142.19.32 - 174.142.19.47 range which in turn is run by iWeb Technologies. iWeb Technologies are registered in Canada, but Tricastmedia are registered in Lahore, Pakistan.

CustName:       Tricastmedia (pvt) ltd.
Address:        72, Garden Block
Address:        Garden Town
City:           Lahore
StateProv:      PUNJAB
PostalCode:     54000
Country:        PK

That kind of thing happens every day.

MacKeeper Locations

Check out these locations and you should be able to get rid of the worst of it. Note the entry under LaunchAgents is what keeps the danged thing on your menu bar.

/Applications/MacKeeper.app
/Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78
/Library/Receipts/InstallHistory.plist
/private/tmp/com.apple.installer.downloads.Owuu
/private/tmp/com.apple.installer.downloads.Owuu/MacKeeper.pkg
/private/var/db/launchd.db/com.apple.launchd.peruser.501/overrides.plist
/private/var/db/receipts
/private/var/folders/.../MacKeeperUninstaller.app
~/Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist
~/Library/Logs/MacKeeper.log
~/Library/Logs/MacKeeper.log.signed
~/Library/Preferences/.3246584E-0CF8-4153-835D-C7D952862F9D
~/Library/Preferences/com.zeobit.MacKeeper.Helper.plist
~/Library/Preferences/com.zeobit.MacKeeper.plist

MacKeeper brings 2,787 items to your file system, and that might seem intimidating, but 2,683 of them are in /Applications/MacKeeper.app, so that leaves only 104 more. So don't lose heart. Just lose MacKeeper.