MacKeeper Uninstaller

Can anyone explain to me why that when I request support for various new issues (account creation hang ups, QuickAdd failures, reboot loops, and many other issues that are totally unrelated according to JAMF), I am asked why I restrict Mackeeper and clean only to find this in my logs? Why on earth do they need access to Mackeeper and MKCleanService to communicate with Casper?

2017-09-02 13:00:36,237 [ERROR] [duledPool-4] [VppCommService ] - Error managing licenses. ErrorNumber: 9628 , ErrorMessage:License not eligible for device assignment.
2017-09-02 13:00:36,238 [INFO ] [Tomcat-45 ] [BlacklistNotification ] - The following blacklisted process was killed on device machinename (ID - 6184):
ID: 59
Process: clean
Owner: root
PID: 22773
2017-09-02 13:00:36,378 [INFO ] [Tomcat-51 ] [BlacklistNotification ] - The following blacklisted process was killed on device machinename (ID - 8435):
ID: 59
Process: clean
Owner: root
PID: 61529
PID: 4918
2017-09-02 13:57:58,131 [INFO ] [Tomcat-25 ] [BlacklistNotification ] - The following blacklisted process was killed on device machinename (ID - 4949):
ID: 41
Process: MacKeeper
Owner: root
PID: 18376

This is why it's on my blocked software list to save it going ON in the first place.

I cannot get any of these scripts to work. They all fail - I started with the most recent and worked backwards. Any suggestions on what I'm doing wrong?

Thank you.

What's the policy result in your JSS when it fails? What's failing?

Nowadays you can just run Malwarebytes for Mac but you have to be on the computer, not from the JSS, unless you bought the business edition which includes a command line remediation for malware.

My script worked at the time I posted it however I had had to do some digging by installing it to see what changes they had made. Blocking prevents it being installed in the first place

It just says "Failed."

What processes do you block to keep it from installing? Blocked software has never worked like that for me - it's always allowed the software to install, just not run.

you have to block the installer to stop it being installed. download it, find the installer name and block that

@micah002 Look at the policy logs next to the failed button. a failed policy could just be one command failed and the rest worked which will happen with a catch all script because some bits will never work.

I like to check whether a file or directory exists before I attempt to remove it. A long list of commands to remove files or directories without any prior checks for their existence always triggers a thumbs down in me.

I've had a look at the scripts listed above and noticed something that may have been missed. A lot of companies do not allow admin access but Mackeeper will still install.

./Users/$USER/Applications/MacKeeper.app

Might want to do a find / -iname mackeeper just to see what gets left behind by the script. You could also use this to generate the files to delete.

I downloaded MacKeeper and fired up Composer as I installed it on a Mac VM. I then looked at where it installed all of its crapware, and I wrote a script to remove it. I have had some success with it. Also, Malwarebytes will remove MacKeeper, and a lot of other crapware.

#!/bin/sh

currentuser=`/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'`
echo $currentuser

killall "MacKeeper Helper";
rm -rf /Applications/MacKeeper.app;
rm /Library/LaunchDaemons/com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper.plist;
rm /Library/LaunchDaemons/com.mackeeper.MacKeeper.MacKeeperPrivilegedHelper.plist;
rm /Library/PrivilegedHelperTools/com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper;
rm /Library/PrivilegedHelperTools/com.mackeeper.MacKeeper.MacKeeperPrivilegedHelper;
rm -rf $currentuser $HOME/Library/Application Support/com.mackeeper.AdwareAnalyzer;
rm -rf $currentuser $HOME/Library/Application Support/com.mackeeper.MacKeeper;
rm -rf $currentuser $HOME/Library/Application Support/com.mackeeper.MacKeeper.Helper;
rm -rf $currentuser $HOME/Library/Application Support/com.mackeeper.MacKeeper.MKCleanService;
rm -rf $currentuser $HOME/Library/Application Support/MacKeeper;
rm -rf $currentuser $HOME/Library/Application Support/MacKeeper 3;
rm -rf $currentuser $HOME/Library/LaunchAgents/com.mackeeper.AdwareAnalyzer.plist;
rm -rf $currentuser $HOME/Library/LaunchAgents/com.mackeeper.MacKeeper.Helper.plist;
rm -rf $currentuser $HOME/"MacKeeper Backups";

I have tried everything you suggested to clean out my computer from MacKeeper but it keeps coming back the virus What should I do? Thanks ShowBox Lucky Patcher Kodi

@zimou13 I ran Malware Bytes (free for 14 days) and it removed it. Also ran a free software called Maintenance.

https://www.titanium-software.fr/en/maintenance.html
https://www.malwarebytes.com

@howie_isaacks I think there's a mistake in your script's rm commands like this:

rm -rf $currentuser $HOME/"MacKeeper Backups";

This is deleting a folder called $currentuser in the current working directory, then also deleting $HOME/MacKeeper Backups. I don't think you intend to delete (repeatedly!) a mystery folder named after the current logged in user, but that's what it's doing. You might want to do something like this instead:

eval 'rm -rf "~$currentuser/MacKeeper Backups"'

Or possibly

rm -rf "$HOME/MacKeeper Backups"

I don't remember off the top of my head whether $HOME works in the context of a Casper script. I think it will return root's home, not the logged in user's, which is not especially useful.

You might want to go a step further and also do this:

rm -rf /Users/*/"MacKeeper Backups"

I found a quite good solution for me looking at clients with more than one users working on it.

I tested it successfully in a VM therefore try it yourself.

#!/bin/sh

#stopping MacKeeper 
killall "MacKeeper Helper"
killall MKCleanService
killall MacKeeper

#stopping the daemons
launchctl unload com.mackeeper.MacKeeper.MacKeeperPrivilegedHelper
launchctl unload com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper
launchctl unload com.mackeeper.Cerberus

#remove main app
rm -Rf /Applications/MacKeeper.app

# remove mackeeper from HomeDirectories
rm -Rf /Users/*/Library/Application Support/*mackeeper*
rm -Rf /Users/*/Library/Application Support/*MacKeeper*
rm -Rf /Users/*/Library/LaunchAgents/com.mackeeper*
rm -Rf /Users/*/Library/Logs/MacKeeper*
rm -Rf /Users/*/Library/Preferences/com.mackeeper*
rm -Rf /Users/*/MacKeeper*
rm -Rf /Users/*/Library/Saved Application State/com.zeobit.MacKeeper.savedState
rm -Rf /Users/*/Library/Preferences/com.zeobit.MacKeeper*
rm -Rf /Users/*/Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78

#remove mackeeper from systemdirectories
rm -Rf /Library/LaunchDaemons/com.mackeeper*
rm -Rf /Library/PrivilegedHelperTools/com.mackeeper*
rm -Rf /Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78

Main app is in /Users/*/Applications on the ones I've done.

I've actually started to see some success on this one. I had 4 computers report back in that its completely gone (we'll see). This is a combo of a few different scripts above. Right now i'm at a 50% success rate (sometimes it takes two tries).

#!/bin/sh

#Determine User
user=`ls -l /dev/console | cut -d " " -f 4`

if [ -d /Applications/MacKeeper.app/ ];then
    rm -r /Applications/MacKeeper.app/
    echo "Removed MacKeeper from Applications"
else
    echo "MacKeeper not found"
fi


#stopping MacKeeper 
killall "MacKeeper Helper"
killall MKCleanService
killall MacKeeper

#stopping the daemons
launchctl unload com.mackeeper.MacKeeper.MacKeeperPrivilegedHelper
launchctl unload com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper
launchctl unload com.mackeeper.Cerberus

#remove main app
rm -Rf /Applications/MacKeeper.app

# remove mackeeper from HomeDirectories
rm -Rf /Users/$user/Library/Application Support/*mackeeper*
rm -Rf /Users/$user/Library/Application Support/*MacKeeper*
rm -Rf /Users/$user/Library/LaunchAgents/com.mackeeper*
rm -Rf /Users/$user/Library/Logs/MacKeeper*
rm -Rf /Users/$user/Library/Preferences/com.mackeeper*
rm -Rf /Users/$user/MacKeeper*
rm -Rf /Users/$user/Library/Saved Application State/com.zeobit.MacKeeper.savedState
rm -Rf /Users/$user/Library/Preferences/com.zeobit.MacKeeper*
rm -Rf /Users/$user/Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78

# Files Outside Home Folder

rm -rf /Applications/MacKeeper.app
rm -rf /Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78
rm -rf /private/var/folders/mh/yprf0vxs3mx_n2lg3tjgqddm0000gn/T/MacKeeper*
rm -rf /private/tmp/MacKeeper*

# Files inside home folder
rm -rf /Users/$user/Library/Application Support/MacKeeper Helper
rm -rf /Users/$user/Library/Launch Agents/com.zeobit.MacKeeper.Helper.plist
rm -rf /Users/$user/Library/Logs/MacKeeper.log
rm -rf /Users/$user/Library/Logs/MacKeeper.log.signed
rm -rf /Users/$user/Library/Logs/SparkleUpdateLog.log
rm -rf /Users/$user/Library/Preferences/.3246584E-0CF8-4153-835D-C7D952862F9D
rm -rf /Users/$user/Library/Preferences/com.zeobit.MacKeeper.Helper.plist
rm -rf /Users/$user/Library/Preferences/com.zeobit.MacKeeper.plist
rm -rf /Users/$user/Library/Saved Application State/com.zeobit.MacKeeper.savedState
rm -rf /Users/$user/Downloads/MacKeeper*
rm -rf /Users/$user/Documents/MacKeeper*

#remove mackeeper from systemdirectories
rm -Rf /Users/$user/Library/LaunchDaemons/com.mackeeper*
rm -Rf /Users/$user/Library/PrivilegedHelperTools/com.mackeeper*
rm -Rf /Users/$user/Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78

killall "MacKeeper Helper";
rm -rf /Users/$user/Applications/MacKeeper.app;
rm -rf /Users/$user/Library/LaunchDaemons/com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper.plist;
rm -rf /Users/$user/Library/LaunchDaemons/com.mackeeper.MacKeeper.MacKeeperPrivilegedHelper.plist;
rm -rf /Users/$user/Library/PrivilegedHelperTools/com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper;
rm -rf /Users/$user/Library/PrivilegedHelperTools/com.mackeeper.MacKeeper.MacKeeperPrivilegedHelper;
rm -rf /Users/$user/Library/Application Support/com.mackeeper.AdwareAnalyzer;
rm -rf /Users/$user/Library/Application Support/com.mackeeper.MacKeeper;
rm -rf /Users/$user/Library/Application Support/com.mackeeper.MacKeeper.Helper;
rm -rf /Users/$user/Library/Application Support/com.mackeeper.MacKeeper.MKCleanService;
rm -rf /Users/$user/Library/Application Support/MacKeeper;
rm -rf /Users/$user/Library/Application Support/MacKeeper 3;
rm -rf /Users/$user/Library/LaunchAgents/com.mackeeper.AdwareAnalyzer.plist;
rm -rf /Users/$user/Library/LaunchAgents/com.mackeeper.MacKeeper.Helper.plist;
rm -rf /Users/$user/"MacKeeper Backups";