Mac Defender

check activity monitor (in applications > utilities) for any processes (daemon, helper) pertaining to the app and kill those.

next, use the instructions in this user tip to find and delete all remnants of the app.

A manual delete is the way to go, unless a program comes with an uninstaller (oviously, not in this case.)

Best way to find all related files is to use EasyFind, and enter the name of the developer, company or anything else that might be related (google for that.) EF will only find what you tell it to search for, but it will catch everything if you enter the right search terms. Even if a program comes with an uninstaller, since it might not be written to catch everything, I still like to run EF on it afterward.

Set to "Scan all files," "Files and Folders," "Ignore case," "Invisible files." Sometimes, including Package contents is useful.

Some files will be able to be deleted from Destroy or Move to Trash, directly from EF. But if a file stays, open it in "Reveal in Finder" and delete it from there, using your password.

Only caveat in using EF is to be careful not to delete a file that might be shared by another process or application. Watch out, especially, when deleting from /System/Library.

WZZZ wrote:

EasyFind

just for info, WZZZ 😉

Interesting. My old Sherlock (from OS 9, but run out of Tiger) even once outperformed both of those! I would think with EF, much depends on the settings one uses.

I never use Finder for system searches, at least for uninstalling. But, I'll have to check that out soon and test.

Same thing happened to my wife's Macbook this morning. Definitely a scam; website to 'register' the software purports to be 'secure' but url is simple ip address without https. A scam to steal credit card info. Will follow directions to clean up as posted here.

Fake Mac Defender entered my computer one hour ago while looking at international web sites on curtain designs

I hope to follow your directions and remove it.

My is also claiming to be open and will not delete easily

None of the suggestions I've read in this thread have worked. I keep getting a message that MacDefender cannot be deleted because it is in use. Any other suggestions, anyone?

See if you can locate it in Activity Monitor in Utilities (it may be running under a different name, so post back if you don't see its real name.) Set to Active Processes and Force quit it from there. Then locate and delete all its ****** files, as per the instructions above.

anne e wrote:

I tried to remove it by dragging the program to the trash from the applications folder, but I cant because the program is open.

Try starting up in Safe Mode to prevent the app from running. Delete the app. Check /System/Library/StartupItems/, /Library/StartupItems/, & System Preferences > Login Items for anything suspicious looking that might reinstall it. (The first two are normally empty so anything in them is a third party addition.)

You're a god. I found it in Activity Monitor and was able to delete it from there. Thanks VERY much!

This is the only suggestion that worked for me. Good luck!

From WZZZ: "See if you can locate it in Activity Monitor in Utilities (it may be running under a different name, so post back if you don't see its real name.) Set to Active Processes and Force quit it from there. Then locate and delete all its ****** files ..."

I found it in All Processes, highlighted it, and clicked on a red stop sign QUIT icon.

wrwoolley wrote:

I found it in Activity Monitor and was able to delete it from there. Thanks VERY much!

Note that you can't delete anything from Activity Monitor. You can quit (or force quit) running processes, but that doesn't delete the app that spawned the process. If there is something installed that will restart it, say on starting up your Mac or logging into your user account, you will just have to quit it again every time you do that.

Interesting, R C-R. I'll keep an eye out for that. I didn't see the application in my finder anymore, so I was hoping everything was cool. I'll report back if I learn anything new. Thanks very much for your responsiveness!

No, as RC-R pointed out, it's not cool. Next time you startup or log out and back in, it'll be back. You have to get rid of all its files. I only told you to force quit it because you were getting an "in use" message and it wasn't letting you trash its files. Force quitting is only a temporary solution.

I've just removed this from a clients computer. I'd be happy to help others as needed (contact me offline).

However, I'd like to know how this "appeared' on these computers. Surely someone downloaded something. If not, this could be a first.