The Safe Mac

Ongoing MacKeeper fraud

Controversy about MacKeeper has been around almost as long as MacKeeper has existed. It is one of the most aggressively-marketed products in the Mac world, and there are numerous accusations that it isn’t useful or even that it is fraudulent. At the same time, you will find a number of positive reviews out there. How do you know what’s true? In this article, I will make the case that MacKeeper, and the company behind it (ZeoBIT/Kromtech), are not to be trusted.

First, a little history. MacKeeper first caught my attention in 2011, when ZeoBIT set up a fake ClamXav site. (The real ClamXav site is clamxav.com, while the fake site set up by ZeoBIT was clamxav.org. At right is a screenshot of the original clamxav.org site, pulled from the Internet Archive Wayback Machine.)

This fake ClamXav site included an overview of ClamXav, making it sound like the page was an official ClamXav page, yet at the bottom, the green Download button would take the user to the MacKeeper site. This persisted for some time, until eventually the tide of public opinion caused ZeoBIT to change the site. They obfuscated their ownership of the site, using the WhoisGuard service, and changed the content.

There is no proof today that ZeoBIT (aka Kromtech) still owns the clamxav.org domain. That domain’s ownership is still hidden behind the WhoisGuard service. However, it’s probably not coincidence that the clamxav.org, mackeeper.com, zeobit.com and kromtech.net sites all are registered with eNom, Inc.

Around that time, I wrote an article titled Beware MacKeeper. Soon after, I was contacted by a ZeoBIT representative named Mike Clark, offering to pay me for some unnamed consulting work, and giving an explanation for the unethical advertising that I would hear many times over the intervening years: an affiliate was to blame. As he told me at the time, “We pay a 50% affiliate commission and sometimes our affiliates go wild and have a lapse in judgement with the way Mackeeper is promoted.”

In March of 2012, a colleague of mine (Derek Currie) spotted hundreds of fake MacKeeper reviews being posted on VersionTracker and MacUpdate. This went on for some time before it finally stopped. It is still unclear whether this was the result of astroturfing (ie, posting of fake reviews under numerous fake aliases) or whether it was caused by a rumored ZeoBIT rewards program offering free upgrades in exchange for reviews. Of course, those are both unethical, so it doesn’t really matter much which was the cause.

This year has seen two separate class action lawsuits filed against ZeoBIT, alleging fraud. The first was filed by Gregory Ward of Chicago, claiming that, “ZeoBIT uses a common deceptive scheme to trick consumers into purchasing its MacKeeper software, which ultimately fails to deliver the utility ZeoBIT promises.” The second was filed by Holly Yencha, of Pennsylvania, against ZeoBIT, seeking a sum of $5 million.

More recently, MacKeeper ads have been the bane of the Mac world, being one of the most prominent ads displayed by adware that sneaks onto people’s systems. As the author of a utility designed to help remove adware, called AdwareMedic, I have seen countless complaints from people about having MacKeeper pop-ups caused by various adware programs. I’ve actually seen these ads myself in testing adware. Seeing uninvited MacKeeper ads has almost become synonymous with being infected with adware in the Mac community. (For example, see the results of a search for “MacKeeper ads” on Apple’s discussion forums.)

Some of these ads have been extremely unethical. For example, one particular piece of adware was recently known to change the Download link on the AdwareMedic site to redirect to the MacKeeper site. (This affected machines that were already infected with the Downlite adware, and did not involve a compromise of the AdwareMedic site itself.)

Most recently, it has come to my attention that MacKeeper has come full circle, and is repeating the behavior that originally brought them to my attention: using a fake website for advertising. The malwarebytesmac.org site currently is nothing more than an ad for MacKeeper, making it appear that it is affiliated with the Malwarebytes anti-virus software, found at malwarebytes.org. (Note the slight difference in the domain names!)

Unfortunately, I’m sure that we are due of a recurrence of the same old excuse: an affiliate did it! The malwarebytesmac.org site’s registration cannot be traced to ZeoBIT or Kromtech. It is registered to someone named Robert Burke, at an address in China, through a registrar named Hichina Zhicheng Technology Limited. The e-mail address given for Mr. Burke is currently sunymore@126.com.

Looking at a history of the domain, it looks like Mr. Burke has recently updated the domain information, changing from a US-based location:

Registrant Organization:Robert Burke 
Registrant Street: 2658 Better Street 
Registrant City:Kansas City 
Registrant State/Province:KS 
Registrant Postal Code:66215 
Registrant Country:US 
Registrant Phone:+1.9132847547 
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email:wiseshare@yahoo.com

It’s certainly possible – even likely – that Mr. Burke is simply a MacKeeper affiliate, and not in any way employed by ZeoBIT or Krometch. This fraud may be entirely the fault of Mr. Burke, and not the direct result of ZeoBIT’s actions. However, in the best case scenario from ZeoBIT’s point of view, there is an ongoing serious problem with their affiliate program that is allowing and encouraging these kinds of fraudulent ads to continue to be perpetuated over the years.

The software

Besides the ongoing unethical behaviors of ZeoBIT/Krometch, what are the benefits of the MacKeeper software itself? In short, there are none. The numerous “critical” issues that it will identify on even a brand-new, out-of-the-box Mac, are not real. This is simply a scare tactic to encourage users to purchase the software while evaluating the trial version.

Few of the functions of MacKeeper are worthwhile. Of those that are, they can be done better by free or cheaper software. One of the most significant features of MacKeeper – the anti-virus protection – isn’t actually part of MacKeeper at all. ZeoBIT has simply licensed the Avira anti-virus engine for use by MacKeeper, so you could obtain the same protection by simply downloading the Avira’s free anti-virus software. (Not that I necessarily recommend doing that, mind you! See my Mac Malware Guide for recommendations along those lines.)

Worse, some people have reported that their systems have been damaged to the point of needing to be reinstalled by MacKeeper. Many people also report that MacKeeper has had a negative impact on their system’s performance.

Some people do swear by MacKeeper, claiming that it has helped them keep their systems clean and running well. However, such claims are never backed up with concrete information, such as objective performance comparison data collected pre- and post-MacKeeper, and cannot be relied on given the history of fake reviews.

Conclusion

The bottom line is that MacKeeper should not be used. The company behind it has shown a long history of unethical behavior, and the software isn’t worthwhile. If you have it installed, you should remove it immediately.

If you are suffering from MacKeeper ads or redirects popping up on sites where they should not appear, my AdwareMedic app should help you solve that problem. If you are prevented from accessing the AdwareMedic site, turn off JavaScript in your web browser or restart the computer in safe mode to download the app, or download it on another computer, or try the manual removal instructions in my Adware Removal Guide.


Posted

in

,

by