FacebookTwitterLinkedIn

MacKeeper Unwanted Application (Mac)

Also Known As: MacKeeper potentially unwanted program
Damage level: Medium

What is MacKeeper?

Developed by Zeobit and then acquired by Kromtech, MacKeeper is a legitimate and useful application for Mac users. It provides functionality that allows users to optimize and increase system performance.

Despite this, some MacKeeper affiliates employ dubious/unacceptable measures to proliferate this software. Therefore, it can be classed as potentially unwanted program (PUP).

MacKeeper unwanted application

This application is proliferated in various ways. It has an official download website, which is fine as a legitimate app, however, as mentioned above, some criminals proliferate this program in dubious ways. For example, they develop malicious websites that display fake error messages claiming that the system is corrupted.

To resolve these "issues" (that do not exist), users are encouraged to download MacKeeper. The list of dubious sites includes (but is not limited to) Virus Found and We Have Detected A Trojan Virus. Criminals also proliferate this application using intrusive advertisements (pop-ups, banners, etc.) and a deceptive marketing method called "bundling".

If you feel that MacKeeper has infiltrated systems without your consent, follow the guide below and remove this application.

The aforementioned methods are also used to proliferate other PUPs that are not legitimate (e.g., adware, browser hijackers, etc.) Most generate intrusive advertisements and record various sensitive data. The ads are delivered using various tools that enable placement of third party graphical content on any site.

Therefore, they often conceal underlying website content, thereby diminishing the web browsing experience. Most PUPs are also designed to gather various information that typically includes personal details.

Internet Protocol (IP) addresses, Internet service providers (ISPs), geographic locations, URLs visited, pages viewed, queries entered into search engines, keystrokes, and other collected data is later sold to third parties (potentially, cyber criminals). These people generate revenue by misusing private information.

Therefore, the presence of information-tracking apps can lead to serious privacy issues or even identity theft. We highly recommend that you remove all dubious applications and browser plug-ins.

Threat Summary:
Name MacKeeper potentially unwanted program
Threat Type PUP (potentially unwanted program), PUA (potentially unwanted application)
Detection Names (MacKeeper.4.6.2(1).pkg) DrWeb (Program.Mac.Unwanted.MacKeeper.60), BitDefender (Application.MAC.Paza.BLE), ESET-NOD32 (OSX/Mackeeper.CL Potentially Unwanted), McAfee (OSX/Mackeeper.g), Full List (VirusTotal)
Symptoms A program that you don't recall installing suddenly appeared on your computer. New application is performing computer scans and displays warning messages about found issues. Asks for payment in order to eliminate the supposedly found errors.
Distribution methods Deceptive pop-up ads, free software installers (bundling), fake flash player installers.
Damage Monetary loss (unnecessary purchase of fake software), unwanted warning pop-ups, slow computer performance.
Malware Removal (Windows)

To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner.
▼ Download Combo Cleaner
To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

All potentially unwanted programs are very similar. By offering a number of features, PUPs such as MyShopcoupon, TURBOMAC, and others, attempt to give the impression of legitimacy, however, their only purpose is to generate revenue for the developers.

Only a small percentage give the features promised - most are useless. Rather than (or together with) enabling the functionality promised, potentially unwanted programs pose a direct threat to your privacy and Internet browsing safety.

How did MacKeeper install on my computer?

As mentioned above, MacKeeper is proliferated using intrusive ads, together with the "bundling" method. Intrusive ads redirect users to malicious websites and/or run scripts that download/install PUPs. Therefore, even a single click might result in inadvertent installation of certain applications.

"Bundling" is stealth installation of PUPs together with regular software. Developers hide "bundled" apps within "Custom/Advanced" settings (or other sections) of the download/installation processes.

Many users rush these procedures and skip steps. In doing so, they expose their systems to risk of various infections. The main reasons for computer infections are poor knowledge and careless behavior.

How to avoid installation of potentially unwanted applications?

To prevent this situation, pay close attention when browsing the Internet and, especially when downloading/installing software. Bear in mind that criminals invest many resources into developing intrusive ads. They often seem legitimate, but are distinguishable, since most lead to survey, gambling, pornography, and other dubious websites.

As mentioned before, intrusive ads are typically delivered by PUPs and, thus, if you encounter them, immediately remove all suspicious applications and browser plug-ins. Select "Custom/Advanced" settings, carefully analyze each window of the download/installation procedures, and opt-out of all additionally-included programs.

You are advised to download software from official sources only, using direct download links, since criminals employ third party downloaders/installers to proliferate ("bundle") PUPs. Using a legitimate anti-virus/anti-spyware suite is also paramount. The key to computer safety is caution.

Screenshot of the MacKeeper application:

MacKeeper unwanted application

Appearance of the MacKeeper application (GIF):

MacKeeper unwanted application (GIF)

Screenshot of the official MacKeeper download website:

Official MacKeeper download website

Screenshot of the official MacKeeper installation setup:

Official MacKeeper installation setup

Rogue software installers used to distribute MacKeeper unwanted application:

Rogue installer promoting MacKeeper unwanted application (sample 1) Rogue installer promoting MacKeeper unwanted application (sample 2) Rogue installer promoting MacKeeper unwanted application (sample 3)

Another website used to promote MacKeeper PUA:

Website promoting MacKeeper unwanted application

Update May 6, 2020: Since 4/1/2020 MacKeeper became certified by AppEsteem Corporation and is no longer considered a potentially unwanted application. The company that now owns this brand (Clario Tech Limited) no longer participates in shady software distribution tactics. Also, since 4/1/2020 Combo Cleaner no longer detects this application as potentially unwanted.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

Video showing how to remove adware and browser hijackers from a Mac computer:

MacKeeper adware removal:

Remove MacKeeper-related potentially unwanted applications from your "Applications" folder:

mac adware removal from applications folder

Click the Finder icon. In the Finder window, select “Applications”. In the applications folder, look for “MPlayerX”,“NicePlayer”, or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Remove adware-related files and folders

Mac Go To Folder step

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

Mac removing related files and folders - step 1Check for adware generated files in the /Library/LaunchAgents/ folder:

Mac go to /Library/LaunchAgents - step 1

In the Go to Folder... bar, type: /Library/LaunchAgents/

Mac go to /Library/LaunchAgents - step 2

In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.

Mac removing related files and folders - step 2Check for adware generated files in the ~/Library/Application Support/ folder:

Mac go to /Library/Application Support - step 1

In the Go to Folder... bar, type: ~/Library/Application Support/

Mac go to /Library/Application Support - step 2

In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.

Mac removing related files and folders - step 3Check for adware generated files in the ~/Library/LaunchAgents/ folder:

Mac go to ~/Library/LaunchAgents - step 1

In the Go to Folder... bar, type: ~/Library/LaunchAgents/

Mac go to ~/Library/LaunchAgents - step 2

In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.

Mac removing related files and folders - step 4Check for adware generated files in the /Library/LaunchDaemons/ folder:

Mac go to /Library/LaunchDaemons - step 1

In the "Go to Folder..." bar, type: /Library/LaunchDaemons/

Mac go to /Library/LaunchDaemons - step 2

In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.

Mac removing malware related files and folders - step 5Scan your Mac with Combo Cleaner:

If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.

Mac remove malware with Combo Cleaner - step 1

Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.

Mac remove malware with Combo Cleaner - step 2

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

Remove malicious extensions from Internet browsers

Safari iconRemove malicious Safari extensions:

Removal of malicious extensions in Safari - step 1

Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".

Removal of malicious extensions in Safari - step 2

In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

Google Chrome logoRemove malicious extensions from Google Chrome:

Removal of malicious extensions in Google Chrome - step 1

Click the Chrome menu icon Google Chrome menu icon (at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".

Removal of malicious extensions in Google Chrome - step 2

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.

Mozilla Firefox logoRemove malicious extensions from Mozilla Firefox:

Removal of malicious extensions in Mozilla Firefox - step 1

Click the Firefox menu firefox menu icon (at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".

Removal of malicious extensions in Mozilla Firefox - step 2

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Removal Instructions in other languages
Software uninstall instructions
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
MacKeeper potentially unwanted program QR code
Scan this QR code to have an easy access removal guide of MacKeeper potentially unwanted program on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

▼ REMOVE IT NOW
Download Combo Cleaner

Platform: Windows

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.