Monday, March 19, 2012

The Only Website That Ever Finally Answered The MacKeeper Malware "Pop up / Pop under" problem

Here's a comment recently made in the Apple forums regarding the appearance of a window like this …

I will need to make time to read through all answers...but I have the same annoying problem with this pop up, normally coming up and freezing my Safari when I'm dowmloading work stuff...which is a lot of work, as I have to force quit and start all over again... 
I am with whoever said in the first pages: I have NOT downloaded this app/program, and can't find anything with the file names … 
I will clear cache and cookies and see what happens…

This particular Apple forum seems to be moderated by trolls that would rather bicker over forum rules and etiquette than truly answer the question straightforward.

I finally found the exact answer ...

This isn't a program that is installed. This particular "pop under" is not a "pop up" ~ so your pop up blocker is ineffective.

I disagree strongly with the use of ad blockers because they actually prevent more than just ads from showing up on several websites. (Although the use of ad blockers don't always prevent "pop unders" anyway.)

I visit a local newspaper website daily called the Greenville News ~ found at:


This site is the sole culprit for the MacKeeper "pop under" for me.

I took the suggestion from another forum to switch to "open all new windows in tabs" in Safari and Firefox.

Make sure that that you have "Block Pop Up Windows" checked in the Safari menu.



In Safari go to Menu > Safari > Tabs > (Highlight "Open pages in tabs instead of windows") to ALWAYS.



As you surf for a day, notice which sites are opening new windows (in your tabs) that say "MacKeeper-05" or something like that.

These websites are the culprit!

The Greenville News happens to be a Gannet/USA Today newspaper website.

I contacted The Greenville News and Gannett regarding the issue.

An IT person from both sources sat on the phone with me and said while it is "annoying to me" (and to us all) it won't change.

This was a high level advertising decision.

Having the MacKeeper window open doesn't harm your computer in any way, nor is it installing anything.

This IS SOMETHING APPLE COULD FIX in an update to Safari as the "pop under" bypasses the "pop up blocker" by telling your computer that MacKeeper is a window you want to open at the website you are currently on.

In other words, the site you're on is serving it.

In my case ~ it looks like MacKeeper is opening from http://www.greenvilleonline.com.

Take note, that I am not a registered user and don't pay for a subscription to this newspaper website. I was told that subscribers are not confronted with this issue.

So, I confirmed that on my father's computer. He has a subscription and has the same OS X + an iMac.

Sure enough, it never popped up on his. I accessed the website using his internet connection on my computer, and ... it popped up on mine ~ because I wasn't logged in.

The company Zeobit could easily not advertise in this manner, but it seems as if they feel "no press is bad press" here.

My local paper would continue to serve "pop unders" ~ whether from Zeobit or someone else.

On occasion ... this is exactly what happens.

The thing I don't like about this is that the ad is doing more than tracking you ...

1) It is giving Zeobit a hit. They apparently use this data to market their software in box form to retail outlets like Staples. I was able to speak with a human resource director at Staples and they said this Verbatim.She also told me that sales for MacKeeper in store were very low and that they wouldn't be carrying it after this next quarter.

2) Zeobit is doing more than serving up ads. While I understand that every Google page just about is tracking tons of information about you ... this Zeobit "pop under" collects your location, your IP address, your operating system, model name, and where you go two sites ahead and where you've been two clicks before. It continues to track you as long as it is open.

3) Zeobit is using this data to market to other companies.

Research reveals that Zeobit is not a legit programming company. They outsource development and use the MacKeeper software as a front for advertising dollar. They do develop the "pop under" tech and multiple marketing strategies in house.

I cannot stop looking at the Greenville News website for many reasons.

So, stopping to visit sites that deploy the "pop unders" isn't always the solution.

The best method to prevent MacKeeper is to use tabs and close it as soon as it appears in your tabs.

I personally hate tabs, but I'm forcing myself to get used to using them.

To prevent MacKeeper for yourself … you can contact the sources where the "pop unders" are happening and point them to this website.

I will be starting a petition after this post for Apple to prevent "pop unders" in a future update to Safari.

[UPDATE 4/9/2012]

The most common search result for Apple forums is filled with a lot of nonsensical jerks hashing out forum etiquette rather than answering the question. A few of the commenters apprarently stalk the forums just to add their 2¢.

The most recent April 2012 Apple Java Update partially addresses the Zeobit pop-under issue ~ even though the fix is for the "Flashback trojan".

A common misspelling of the culprit Zeobit is Zerobit ... I initially made that mistake myself.

5 comments:

Joanna said...

This is the best answer I've seen yet. It appears that we are stuck with this until somebody does something about it. So far, which is less than 24 hours into the problem for me, there is only one website where I get the pop up.

At that website I noticed that if I close the window of any pop up ad powered by "clicksor", that the mackeeper pop up takes control again.

I have contacted the website owner.

[sigh] In the meantime, it works for me to disable Javascript before visiting that website. That's an annoyance, but not as annoying as having to force quit Safari AND restart the computer.


Anonymous said...

"I cannot stop looking at the Greenville News website for many reasons."
And you don't have a subscription? Way to go!

fixyourthinking said...

Hello previous anonymous dolt …

The portion I look at is a free part that the Gville news organizes well.

I also only care about headlines anyway!

No subscription needed for that!

Dirty Laundry said...

I have a friend who has this issue, but I'm not sure it's the same. I made sure his popup blocker was on, and yet he gets the ads in both safari and chrome. I ran clamavx but it found nothing. I cleared cookies, cache, everything, and he still gets the add. One of the sites was macupdate.com When he clicks on the search box, it makes the popunder open. But I tried it from my computer with the same system and I didn't get it. He also gets it several times per day just surfing the web. While I do get it once in a while from sites that are pretty shady and covered with ads in general, I don't get them very often anywhere else. My friend seems to get it on almost every site he goes to. This makes me wonder if there is something else that was installed that we haven't been able to find yet?

Anonymous said...

We're having the same problem with my son's MacBook Air. Darn MacKeeper pop behind from all browsers. This doesn't happen on any of our other Macs. Uninstalled MacKeeper and still have the problem. Very frustrating!! I hate MacKeeper and plan to report them to my state Attorney General.