I've been holding off from writing about this nasty piece of software, but it seems to be spreading. And it's something we're not used to in the world of "virus-free Macs".
If you come across an app called MACDefender, posing as anti-virus software for Macs, don't touch it or even go to a website promoting it. It's in fact malware itself. And it's appearing under different names as it spreads, including Mac Defender and Mac Security.
It gets itself onto your machine automatically by downloading a ZIP file if you visit its website from a Google search with the Safari browser. If "open safe files after downloading" is selected in Safari, it will then automatically decompress the file. You're then presented with the installer above.
If you go ahead and install - or let it do it automatically - all looks genuine even down to a "user agreement" screen. But it's not. It's malware. After installation, users are reporting pop-up screens asking for credit card details for anti-virus software.
It should be noted that MACDefender is in no way connected with MacDefender, makers of geocoaching software.
And it appears if you've installed MACDefender, you'll get no help from Apple to get rid of it.
ZDnet is reporting a "leaked" internal Apple document which advises that if a customer calls to report the mysterious installer screen appearing on their Mac, tell them to delete the installer app which should be in the Downloads Folder. But there's no help if the app has already been installed:
"Explain that Apple does not make recommendations for specific software to assist in removing malware. The customer can be directed to the Apple Online Store and the Mac App Store for antivirus software options."As far as I can gather, it IS possible to get rid of the malware, by searching your machine for all file references to MACDefender (or whatever the app you downloaded was called) and deleting them, but I can't confirm this works.
Here's a guide to deleting it from MacRumours.
1. Open Applications > Utilities > Activity Monitor and quit any processes linked to MACDefender.You can follow IJSMblog on Twitter and Facebook
2. Delete MACDefender from the Applications folder.
3. Check System Preferences > Accounts > Login Items for suspicious entries
4. Run a Spotlight search for "MACDefender" to check for any associated files that might still be lingering.
Comments