Safari Problem

[StarShot]

Not sure where this post should be since I can't find a Safari thread. When I load Safari, I get a popup that says it's from MacKeeper. See below. I don't see "MacKeeper" in my applications folder.

I'm running Malwarebytes. I DON'T see this message on FireFox, Chrome or Opera. I have NOT clicked on "Start Scan" in this popup, nor does Malwarebytes find anything to do with MacKeeper. I'm wondering if this popup is imbeded in Safari.

I thought about just deleting Safari and then reinstalling it. Anyone have a input as to whether this would allow the operation of Safari WITHOUT this annoying MacKeeper popup?


https://www.apple.com/safari/

 

[DeltaMac]

Probably some plugin in Safari that found its way to your system.
If you go to Safari Preferences, then the Extensions tab - do you see any extension listed there that might look related to MacKeeper?
If Malwarebytes doesn't find anything, you could try a report with EtreCheck. That's pretty good about digging out software that starts up with your Mac. Maybe there will be something suspicious from that. EtreCheck gives you the choice to remove it - or at least shows you a path a file that you may think is part of the problem, so you can remove it manually.

 

[revmacian]

Not sure where this post should be since I can't find a Safari thread. When I load Safari, I get a popup that says it's from MacKeeper. See below. I don't see "MacKeeper" in my applications folder.

I'm running Malwarebytes. I DON'T see this message on FireFox, Chrome or Opera. I have NOT clicked on "Start Scan" in this popup, nor does Malwarebytes find anything to do with MacKeeper. I'm wondering if this popup is imbeded in Safari.

I thought about just deleting Safari and then reinstalling it. Anyone have a input as to whether this would allow the operation of Safari WITHOUT this annoying MacKeeper popup?


https://www.apple.com/safari/

I wonder if that is an advert that uses javascript to create a popup hoping you'll click on it - this is how a lot of phishing attempts begin.

 

[StarShot]

I wonder if that is an advert that uses javascript to create a popup hoping you'll click on it - this is how a lot of phishing attempts begin.

You might be right, but I'm afraid if I click on it, it will install on my MBA.

 

[revmacian]

You might be right, but I'm afraid if I click on it, it will install on my MBA.

Well, don't click on it. If it only happens on that site, then I am likely correct in my suspicion. Many websites allow adverts without ever investigating what the adverts actually do. This is why this type of phishing is effective and also why adblockers are so popular. If it does only happen on that site, I would avoid that site going forward.

 

[StarShot]

I downloaded EtreCheck and ran it. The report it generated didn't mention MacKeeper, but did have a lot of other stuff I didn't understand. I then tossed EtreCheck in the garbage can, rebooted and now when I load Safari, I don't get the MacKeeper popup.

Well, that's not true. I thought it was so, but then I reloaded Safari once again and the popup reappeared.

I almost never use Safari so am thinking of deleting it and then reinstaling it one more time. If MacKeeper pops up again, I will garbage can Safair for good.

A POX on MacKeeper...

 

[DeltaMac]

If you don't do anything to fix Safari's settings/preferences, then reinstalling will not accomplish anything.
Trashing Safari forever - kinda like "throwing the baby out with the bathwater."

Some of those that lurk here can figure out EtreCheck reports, or at least steer you in a better direction with that.

 

[Fishrrman]

Try this:

Download "EasyFind". It's free:
https://www.devontechnologies.com/download/products.html

Open EasyFind.
On the left, set it up this way:
Search for -- files & folders
Operator -- phrase
Comparison -- ignore case
Include -- invisible files and folders

In the text bar, enter "easyfind"
Go to the right and click the magnifying glass icon.

Does it find anything?

 

[revmacian]

I downloaded EtreCheck and ran it. The report it generated didn't mention MacKeeper, but did have a lot of other stuff I didn't understand. I then tossed EtreCheck in the garbage can, rebooted and now when I load Safari, I don't get the MacKeeper popup.

Well, that's not true. I thought it was so, but then I reloaded Safari once again and the popup reappeared.

I almost never use Safari so am thinking of deleting it and then reinstaling it one more time. If MacKeeper pops up again, I will garbage can Safair for good.

A POX on MacKeeper...

Have you tried clearing all data and cookies from Safari and starting over? This may remove the problem. I know it can be a pain to start over, but it's worth a shot.

 

[etresoft]

I downloaded EtreCheck and ran it. The report it generated didn't mention MacKeeper, but did have a lot of other stuff I didn't understand. I then tossed EtreCheck in the garbage can, rebooted and now when I load Safari, I don't get the MacKeeper popup.

Well, that's not true. I thought it was so, but then I reloaded Safari once again and the popup reappeared.

The idea is to post your EtreCheck report on a place like MacRumors before deleting it. I do try to make it as easy as possible to understand, but often it is quite complicated and it simply isn’t possible to make it simple. Post your report to give other people a chance to look at it.

There is a worldwide network of scamware and “affiliates”. Just because you don’t have MacKeeper installed doesn’t mean you don’t have some other adware installed that it displaying those ads. My hunch is that you have a configuration profile installed that has reset your search page. You could also have more traditional adware too.

 

[StarShot]

Re my Safari problem with the "MacKeeper" popup, I took a look at Safari Preferences and noticed my default page was set to something that said something about marketing. The default homepage was www.weknow.ac/..... When I changed it to msnbc.com, the annoying message about MacKeeper disappeared. I assume ...ac is Canadian.

I almost never use Safari (my choices of browsers are Opera and Chrome). Have no idea as to how the default Safari was changed other than some malware programs. I DEFINITELY did not chose weknow/ac/... as my Safari home page.

Thanks for all the help that was posted here.

 

[etresoft]

Re my Safari problem with the "MacKeeper" popup, I took a look at Safari Preferences and noticed my default page was set to something that said something about marketing. The default homepage was www.weknow.ac/..... When I changed it to msnbc.com, the annoying message about MacKeeper disappeared. I assume ...ac is Canadian.

I almost never use Safari (my choices of browsers are Opera and Chrome). Have no idea as to how the default Safari was changed other than some malware programs. I DEFINITELY did not chose weknow/ac/... as my Safari home page.

Thanks for all the help that was posted here.

Canada is “.ca”. “.ac” stands for Saint Helena, Ascension and Tristan da Cunha - apparently part of the UK.

I’m sure it was changed by some malware program. Go to System Preferences > Profiles and see if you have an override listed there. You will only have a Profiles pane if you have configuration profiles. If not, it could be a Safari extension or one of a couple of thousand different kinds of adware.

There is a long thread on Apple Support Communities about this particular adware: https://discussions.apple.com/thread/8501039

The title refers to Chrome. I normally only worry about Safari. The solution in that thread will not help with Safari. Your problem is most like a configuration profile or some other adware running in the background.