Mac Cracked: Hostageware for the lose.

[jesse_the_k]

today I learned that the shareware software distribution sites like Versiontracker and MacUpdate are no longer reliable places to download trial software. They've moved to a "get $$$ to inject malware into our downloads" business model.

Can't prove which one did it, but something loaded MacKeeper in Safari, and now my Mac is yelling at me to buy something from them to get ride of itself.

So now I need to erase and restore my Mac. I backed up last night, hope the backup isn't infected, I may be offline for a few days.

If you have any wisdom, feel free to email my username at his domain!

Comments

[isis]

Oh, SUCK. I hope you get it figured out and cleaned up.

[luzula]

I think that is the case for most software distribution sites. /o\ Linux is the easiest way to avoid it, I guess.

Best of luck!

[jiawen]

Yeah, I feel like it'd be annoying to say "try Linux", but that may really be the best solution. :( I'm happy to help if I can...

[jesse_the_k]

I did try Linux (on an HP netbook) and found it an "OS construction kit" rather than "an OS".

IOW, I didn't want to add yet another computer rabbit-hole to my life. Does look interesting, and I know it undergirds much of the web. Thank heavens for power types (like yourself) who make it happen.

[jiawen]

Yeah, Linux has its fair share of frustrations. Probably more. I've managed to push past a lot of the initial confusion, so it's now a lot less troublesome, but still has its frustrations. And yeah, learning it can be a huge time sink.

[umadoshi]

That is VILE. Good luck getting it taken care of. :/

[firecat]

Ew. Thanks for the heads up.

[j00j]

GROSS. Hope the Mac returns in good health!

[green_knight]

(Hi - seen you on jadelennox's friending meme).

I'm not familiar with MacKeeper other than its super-annoying ads. I've had a quick read up on it, and it looks like your backup will contain the app as well.

This article has nothing nice to say, and says just search for anything with zeobit or MacKeeper in the name, and you'll turn up files

In my experience, 'find' often doesn't show files in the library.

Usual places to look are

Applications
users/yourname/Library/Application Support (the file here might well start with com.zeobit)
users/yourname/Library/Preferences
users/yourname/Library/Safari/Extensions
users/yourname/Library/LaunchAgents

as well as Library/StartupItems

I cannot guarantee that this will remove all traces of MacKeeper - and it's good that you have a backup - but that should go a fair way.

[jesse_the_k]

Thanks for the links.

Thank heavens, also for a function iPad mini, which let me get access to the tools which helped.

See next post for tools.