Q: mac protector?

Hello Everyone, I have a mac and I had the same thing today....I was watching a movie online suddenly a program downloaded and asked me for a password to install..I checked and looked like a mac application and I installed it...Once it started it began to run something and it looked like a scan....immediately i shut it down and i trashed it...i did exactly what was mentioned....I removed app from application folder and trashed it...removed the downloaded program and trashed it....went to the Accounts and pane and removed from the login items tab as well...I didn know how to reboot in safe mode...can you pls let me know how to do it.....I have shut the mac down 3 times and re-booted as normal.....also would this coz any harm once installed....

Regards,

Tushar

People pls check your Safari browser....I had just installed and removed the MacProtector app...I rebooted in safe mode thnx anthonyitaliano....i tried to browse through Safari browser and none of the websites seem to open now...I have done forcequit around 6 times now....the sites which i used to browse doesn seem to open....I just see the browsing circle executing....pls check....I don know whether this is an effect coz of installing the MacProtector icon....I even tried to open this community weblink and Safari wouldnt open...

I don't think anyone has yet done a full analysis, but this latest incarnation of MAC Defender, which first appeared last weekend (it has subsequently changed names several times and is now called MacProtector) appears to be no more harmful than its predecessors. The only difference I've been hearing is that it now appears to actually do some kind of fake scan of your drive and then, maybe, "phone home." But with what data, I'm not sure. This I don't like.

I would certainly change my password if I'd been infected. And, another word of advice: don't get into the habit of using the same password for multiple purposes. Never use an ordinary word of any kind, i.e. one that can be found in the dictionary (some exploits will employ a "dictionary attack;" they will try every single word from the dictionary), choose a relatively long password from random letters (upper and lower case) and numbers and characters from all over the keyboard.

As far as I know -- but, as I said, I haven't yet seen a full analysis of this latest variant -- if you've removed the program from your Applications folder and from Login Items, that's it. No lingering after effects. I think they are after money and credit card numbers. If you've given your credit card information, call your credit card company to cancel the charge or place it in dispute. And cancel that card immediately.

You can be much safer, in general, on the Internet with Firefox and the Add-on NoScript. Many exploits employ weaknesses in JavaScript, which is used extensively on web sites. NoScript filters JavaScript.

http://noscript.net/features

If you want even more protection against programs that "phone home," get Little Snitch.

http://www.obdev.at/products/index.html

It is embedded in an ad on Hotmail.com. You don't even have to click on anything for it to automatically download and forward you to related site. Pretty lame.

I got hit with this menace, too.  I sent the app & the downloaded execute files to the trash & emptied the trash while I was in regular mode, i.e. not safe.  Then went to safe & changed my account password & deleted the malware from the Accounts Log In items.  Should I do anything further?  I'm asking because I didn't delete the app while in safe mode...

•  

  If any of you RxMeisters and MalwareHunters want to see this malware called MacProtector in action (I don't recommend it, otherwise), you can find it here (after deleting it myself, I found this active URL in my browser history):

  http://jackerst.com/?id=541682

  FYI, I can CONFIRM previous assertion that this so-called MacProtector malware downloaded to my desktop BY ITSELF -- I didn't even click on anything. Happened around 12:30 PM EST. An original PopUp window (?) "appeared" while I was in Hotmail using Safari browser, (Entourage mail, Word, iCal and iTunes also open at the time,) once it popped up I was looking that PopUp window over trying to figure out what the *&%$ it was (it said something to the effect that "Mac" had detected some number of Viruses and Virus threads, and had some options to select from -- and yes, it "appeared" to be doing a hard drive scan, though that may have been an act). Then, even without doing ANYTHING it started downloading that sucker to my desktop. I never opened the download file -- it went straight into the Trash and was deleted.

  Thanks for the Safari Preferences tip to uncheck the "automatically open safe files after downloading" box.

The only purpose of doing a Safe Boot is to be able to trash the components, including the app. Safe Boot disables Login and Startup Items, so the program can be trashed. You can also kill it/force quit it in Activity Monitor and then trash it.

Until now, it was my understanding no one was able to trash the app, or perhaps it was just the Login Item, without getting an "in use" message. If you trashed both the app and the Login Item, that should be it. But, no one, to my knowledge, has yet done a really thorough analysis of this latest variant, MacProtector.

Hotmail is well known as an infestation of spammers and malware. You couldn't pay me to have a hotmail account, and if I didn't know a few people who use it, I would block it completely.

someone please help, this macprotector program just got onto my mac book pro and i cant drag it into the trash because it says its "open" how do i close the program or get it off my computer its screwing with and up everything.

First, restart in Safe Boot by holding the Shift key down at the chime. This will keep it from running, so you can remove it.

    1.    Drag the MacSecurity program -- or whatever it's called, MAC Defender, MacProtector (installed in the Applications folder by default) to the Trash. Empty the Trash.

    2.    Remove item of same name from the Login Items for your Account in the OS X System Preferences (if it exists).

    3.    Go to your Home folder Library>Preferences and Application Support (may not be one there) and search for any files with one of the above names and trash them. Empty the trash.

You could have found this in this thread, I believe, or in any number of threads here, or by searching with Google.

http://support.apple.com/kb/ht1274

See 

Resetting the original administrator account password

This thing is a nasty bit of business.  I was on some website, I don't think I even clicked on anything.  On mouseover, it suddenly downloaded the program into my computer and an installer window opened up.  I immediately quit the window, found the file in downloads, trashed it and emptied the trash.  I also went to accounts in preferences, and didn't notice any new logins.  Is there anything else I should do or look for?  I'm thinking I got it all.

And thanks for all the helpful information!

Hi Guys,

I became one more victim of MAC Protector, but the mistake i did was even severe than all of you guys, I registered with MAC Protector, with my credit card details and everything and now I dont know how to get my money back or rather I should say where to get my money back. I would really appreciate if someone can guide me with this regard.

Thanks,

Nisarg