As you have probably heard, the mighty Mac has finally fallen foul of a Malware Attack.
The software, tricks unsuspecting users into installing it, by claiming to be a free, legitimate, security software, but is actually a scam that attempts to get you part with your credit card details to fix fictitious ‘infections’.
If you are unfortunate enough to install this malware, there are several methods of removal:
1) The easiest and safest method is to install an antivirus product for Mac – I personally use Sophos (link to free version of Sophos Anti-Virus for Mac is here). This will detect and remove the program.
2) Manual Removal :
- As Mac Defender will stay on top of any other programs that are running, we first want to close the program so that we can see the other screens that we need to open during this cleaning process. Please close this window by clicking on the red close (X) button in the top left of the Mac Defender Windows. The button that you need to click in order to close the window is shown below:
- Next you should click on empty portion of your desktop so that the Finder is selected. Once it is selected, click on the Go button and select Utilities as shown in the image below.
- The Utilities folder should now appear as shown in the image below.
Locate the Activity Monitor icon and double-click on it.
- The Activity Monitor should now be displayed on your screen. This program lists all the processes that are currently running on your Mac OS and allows us to terminate specific programs that may be running. Scroll through the list of processes and left click on the process named MacDefender as shown in the image below.
Once the process is selected click on the Quit Process button. When a prompt appears asking if you are sure you want to quit the MacDefender process, please click on the Force Quit button. When you have finished, Mac Defender should no longer be running on your Mac and you can now close the Activity Monitor and the Utilities window.
- While still at the Finder, click on the Go button and select the Applications menu option. When the Applications folder is displayed, scroll through the list of programs until you see a program named MacDefender. When you find the program, right-click on it and select the Move to Trash menu option. If MacOS prompts you for your password, please enter it. The MacDefender application will now be removed from the operating system.
- Now click on the Apple Menu () and select the System Preferences menu option. When the System Preferences screen opens, select the Accounts option under the System category. When the Accounts screen opens, click on the Login Items button. This will open a screen, similar to the one below, that displays a list of programs that will automatically start for this particular user when they login to the operating system.
Look through the list of programs that are starting automatically, and single click on the entry named MacDefender. Once it is selected, click on the minus (-) sign button, as indicated by the red arrow in the image above. Once you click on the minus button the Mac Defender entry will be removed and MacOS will no longer attempt to start it when you login.
- Now that Mac Defender is no longer running, we need to change a setting in Safari so that these types of programs are not automatically run on your computer in the future. By default Safari opens and launches programs that it considers safe to run. These programs include movies, pictures, sounds, PDFs, text documents, archives, and disk images. Due to this, these types of infections are able to be downloaded and automatically run on your Mac. To fix this, start the Safari program and then click on the Safari menu option. From the Safari drop down menu, select Preferences. This will open the Preferences screen as shown below. When the screen opens, if you are not on the General settings screen, please click on the General button.
You should now uncheck the checkbox labeled Open “safe” files after downloading as shown in the image above. After unchecking this box you can close the Preferences screen and Safari.
Your computer should now be free of the MacDefender program and Safari should be secure so that it does not automatically launch these types of programs.
If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below: