Monday, March 19, 2012

The Only Website That Ever Finally Answered The MacKeeper Malware "Pop up / Pop under" problem

Here's a comment recently made in the Apple forums regarding the appearance of a window like this …

I will need to make time to read through all answers...but I have the same annoying problem with this pop up, normally coming up and freezing my Safari when I'm dowmloading work stuff...which is a lot of work, as I have to force quit and start all over again... 
I am with whoever said in the first pages: I have NOT downloaded this app/program, and can't find anything with the file names … 
I will clear cache and cookies and see what happens…

This particular Apple forum seems to be moderated by trolls that would rather bicker over forum rules and etiquette than truly answer the question straightforward.

I finally found the exact answer ...

This isn't a program that is installed. This particular "pop under" is not a "pop up" ~ so your pop up blocker is ineffective.

I disagree strongly with the use of ad blockers because they actually prevent more than just ads from showing up on several websites. (Although the use of ad blockers don't always prevent "pop unders" anyway.)

I visit a local newspaper website daily called the Greenville News ~ found at:

This site is the sole culprit for the MacKeeper "pop under" for me.

I took the suggestion from another forum to switch to "open all new windows in tabs" in Safari and Firefox.

Make sure that that you have "Block Pop Up Windows" checked in the Safari menu.

In Safari go to Menu > Safari > Tabs > (Highlight "Open pages in tabs instead of windows") to ALWAYS.

As you surf for a day, notice which sites are opening new windows (in your tabs) that say "MacKeeper-05" or something like that.

These websites are the culprit!

The Greenville News happens to be a Gannet/USA Today newspaper website.

I contacted The Greenville News and Gannett regarding the issue.

An IT person from both sources sat on the phone with me and said while it is "annoying to me" (and to us all) it won't change.

This was a high level advertising decision.

Having the MacKeeper window open doesn't harm your computer in any way, nor is it installing anything.

This IS SOMETHING APPLE COULD FIX in an update to Safari as the "pop under" bypasses the "pop up blocker" by telling your computer that MacKeeper is a window you want to open at the website you are currently on.

In other words, the site you're on is serving it.

In my case ~ it looks like MacKeeper is opening from

Take note, that I am not a registered user and don't pay for a subscription to this newspaper website. I was told that subscribers are not confronted with this issue.

So, I confirmed that on my father's computer. He has a subscription and has the same OS X + an iMac.

Sure enough, it never popped up on his. I accessed the website using his internet connection on my computer, and ... it popped up on mine ~ because I wasn't logged in.

The company Zeobit could easily not advertise in this manner, but it seems as if they feel "no press is bad press" here.

My local paper would continue to serve "pop unders" ~ whether from Zeobit or someone else.

On occasion ... this is exactly what happens.

The thing I don't like about this is that the ad is doing more than tracking you ...

1) It is giving Zeobit a hit. They apparently use this data to market their software in box form to retail outlets like Staples. I was able to speak with a human resource director at Staples and they said this Verbatim.She also told me that sales for MacKeeper in store were very low and that they wouldn't be carrying it after this next quarter.

2) Zeobit is doing more than serving up ads. While I understand that every Google page just about is tracking tons of information about you ... this Zeobit "pop under" collects your location, your IP address, your operating system, model name, and where you go two sites ahead and where you've been two clicks before. It continues to track you as long as it is open.

3) Zeobit is using this data to market to other companies.

Research reveals that Zeobit is not a legit programming company. They outsource development and use the MacKeeper software as a front for advertising dollar. They do develop the "pop under" tech and multiple marketing strategies in house.

I cannot stop looking at the Greenville News website for many reasons.

So, stopping to visit sites that deploy the "pop unders" isn't always the solution.

The best method to prevent MacKeeper is to use tabs and close it as soon as it appears in your tabs.

I personally hate tabs, but I'm forcing myself to get used to using them.

To prevent MacKeeper for yourself … you can contact the sources where the "pop unders" are happening and point them to this website.

I will be starting a petition after this post for Apple to prevent "pop unders" in a future update to Safari.

[UPDATE 4/9/2012]

The most common search result for Apple forums is filled with a lot of nonsensical jerks hashing out forum etiquette rather than answering the question. A few of the commenters apprarently stalk the forums just to add their 2¢.

The most recent April 2012 Apple Java Update partially addresses the Zeobit pop-under issue ~ even though the fix is for the "Flashback trojan".

A common misspelling of the culprit Zeobit is Zerobit ... I initially made that mistake myself.

No comments: