Skip navigation

Mac Defender

51207 Views 176 Replies Latest reply: Jun 8, 2011 4:37 AM by casperfromdubai RSS Branched to a new discussion.
1 2 3 ... 12 Previous Next
anne e Calculating status...
Currently Being Moderated
Apr 30, 2011 8:41 AM

Mac Defender has appeared in my iMac (OS X 10.6.7)

I tried to remove it by dragging the program to the trash from the applications folder, but I cant because the program is open.

The program is pretending to be an antivirus program send $$, obviously a scam.

I re-started but I cat stop it from loading.

 

There is very little info on this program out there (MacDefender.app)

 

Any ideas?

iMac, Mac OS X (10.6.7)
  • Jolly Giant Level 7 Level 7 (25,430 points)
    Currently Being Moderated
    Apr 30, 2011 9:06 AM (in response to anne e)

    check activity monitor (in applications > utilities) for any processes (daemon, helper) pertaining to the app and kill those.

     

    next, use the instructions in this user tip to find and delete all remnants of the app.

    iMac, Mac OS X (10.6.7), 11,127"Core i72,8 GHz12 GB RAM
  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Apr 30, 2011 10:35 AM (in response to anne e)

    A manual delete is the way to go, unless a program comes with an uninstaller (oviously, not in this case.)

     

    Best way to find all related files is to use EasyFind, and enter the name of the developer, company or anything else that might be related (google for that.) EF will only find what you tell it to search for, but it will catch everything if you enter the right search terms. Even if a program comes with an uninstaller, since it might not be written to catch everything, I still like to run EF on it afterward.

     

    Set to "Scan all files," "Files and Folders," "Ignore case," "Invisible files." Sometimes, including Package contents is useful.

     

    Some files will be able to be deleted from Destroy or Move to Trash, directly from EF. But if a file stays, open it in "Reveal in Finder" and delete it from there, using your password.

     

    Only caveat in using EF is to be careful not to delete a file that might be shared by another process or application. Watch out, especially, when deleting from /System/Library.

  • Jolly Giant Level 7 Level 7 (25,430 points)
    Currently Being Moderated
    Apr 30, 2011 10:42 AM (in response to WZZZ)

    WZZZ wrote:

     

    EasyFind

     

    just for info, WZZZ

    iMac, Mac OS X (10.6.7), 11,127"Core i72,8 GHz12 GB RAM
  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Apr 30, 2011 10:51 AM (in response to Jolly Giant)

    Interesting. My old Sherlock (from OS 9, but run out of Tiger) even once outperformed both of those! I would think with EF, much depends on the settings one uses.

     

    I never use Finder for system searches, at least for uninstalling. But, I'll have to check that out soon and test.

  • careylj Calculating status...
    Currently Being Moderated
    Apr 30, 2011 1:28 PM (in response to anne e)

    Same thing happened to my wife's Macbook this morning. Definitely a scam; website to 'register' the software purports to be 'secure' but url is simple ip address without https. A scam to steal credit card info. Will follow directions to clean up as posted here.

  • bobfromeugene Calculating status...
    Currently Being Moderated
    Apr 30, 2011 2:33 PM (in response to anne e)

    Fake Mac Defender entered my computer one hour ago while looking at international web sites on curtain designs

    I hope to follow your directions and remove it.

    My is also claiming to be open and will not delete easily

  • wrwoolley Calculating status...
    Currently Being Moderated
    Apr 30, 2011 2:52 PM (in response to anne e)

    None of the suggestions I've read in this thread have worked. I keep getting a message that MacDefender cannot be deleted because it is in use. Any other suggestions, anyone?

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Apr 30, 2011 2:59 PM (in response to wrwoolley)

    See if you can locate it in Activity Monitor in Utilities (it may be running under a different name, so post back if you don't see its real name.) Set to Active Processes and Force quit it from there. Then locate and delete all its damned files, as per the instructions above.

  • R C-R Level 6 Level 6 (13,855 points)
    Currently Being Moderated
    Apr 30, 2011 3:05 PM (in response to anne e)

    anne e wrote:

     

    I tried to remove it by dragging the program to the trash from the applications folder, but I cant because the program is open.

    Try starting up in Safe Mode to prevent the app from running. Delete the app. Check /System/Library/StartupItems/, /Library/StartupItems/, & System Preferences > Login Items for anything suspicious looking that might reinstall it. (The first two are normally empty so anything in them is a third party addition.)

  • wrwoolley Level 1 Level 1 (0 points)
    Currently Being Moderated
    Apr 30, 2011 3:16 PM (in response to WZZZ)

    You're a god. I found it in Activity Monitor and was able to delete it from there. Thanks VERY much!

  • wrwoolley Level 1 Level 1 (0 points)
    Currently Being Moderated
    Apr 30, 2011 3:21 PM (in response to anne e)

    This is the only suggestion that worked for me. Good luck!

     

    From WZZZ: "See if you can locate it in Activity Monitor in Utilities (it may be running under a different name, so post back if you don't see its real name.) Set to Active Processes and Force quit it from there. Then locate and delete all its damned files ..."

     

    I found it in All Processes, highlighted it, and clicked on a red stop sign QUIT icon.

  • R C-R Level 6 Level 6 (13,855 points)
    Currently Being Moderated
    Apr 30, 2011 3:26 PM (in response to wrwoolley)

    wrwoolley wrote:

    I found it in Activity Monitor and was able to delete it from there. Thanks VERY much!

    Note that you can't delete anything from Activity Monitor. You can quit (or force quit) running processes, but that doesn't delete the app that spawned the process. If there is something installed that will restart it, say on starting up your Mac or logging into your user account, you will just have to quit it again every time you do that.

  • wrwoolley Level 1 Level 1 (0 points)
    Currently Being Moderated
    Apr 30, 2011 3:40 PM (in response to R C-R)

    Interesting, R C-R. I'll keep an eye out for that. I didn't see the application in my finder anymore, so I was hoping everything was cool. I'll report back if I learn anything new. Thanks very much for your responsiveness!

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Apr 30, 2011 3:48 PM (in response to wrwoolley)

    No, as RC-R pointed out, it's not cool. Next time you startup or log out and back in, it'll be back. You have to get rid of all its files. I only told you to force quit it because you were getting an "in use" message and it wasn't letting you trash its files. Force quitting is only a temporary solution.

1 2 3 ... 12 Previous Next

Actions

More Like This

  • Retrieving data ...

Bookmarked By (4)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.