Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

what is macdefender and is it needed for macbook pro

What is Macdefender? This software tried to download on my computer by itself and during that process said I had viruses on my computer including a trojan. Is it necessary to have a virus software on my Macbook pro? Should I be concerned that several viruses were noted and if so, what should I do? Thanks.

MacBook Pro, Mac OS X (10.6.7), virus ware, spy ware questions

Posted on Apr 30, 2011 9:49 AM

Reply
52 replies

May 2, 2011 5:50 AM in response to cynthiafromkingscliff

I don't know how you can get rid of MacDefender because I haven't been able to find a copy to test it. From what others have reported, it installs a background application and a login item. You first have to find the running process in Activity Monitor and quit it, then delete the application, and then remove the login item in the Accounts preference pane. I don't know whether that gets rid of it completely.


As for MacKeeper, it's not actually malware as far as I know, just useless software and unscrupulous marketing. It seems to be just an application. Drag it to the trash.

May 2, 2011 6:03 AM in response to cynthiafromkingscliff

Cynthia


If you followed Linc's suggestions you should have gotten it off your computer. To clarify, open activity monitor look for the process MacDefender and double click on it and force quit the process. Go to your applications folder and drag Macdefender to the trash. Also to system preferencses, go to accounts, look at the login items, if you see Macdefender there highlight it and hit the minus sign to remove it. Open finder and do a search for MacDefender and drag anything you find for MacDefender to the trash. You can do a search in Spotlight as well for same. Spotlight is the little magnifying glass in the upper right corner of your menubar. I would suggest restarting your computer and then emptying the trash. ANother step you can do is to open finder and in the sidebar you will see your target disk and user disk. You can open both and go to library and then to preferences and look for MacDefender in there. Just be careful you don't delete any other preferences. Hope this helps.


Joseph

May 2, 2011 6:21 AM in response to Linc Davis

Linc Davis wrote:


I don't know how you can get rid of MacDefender because I haven't been able to find a copy to test it.


Linc, testing malware on Mac isn't such a good idea, not that you can boot from the installer disk and zero your hard drive and revert from TimeMachine or a clone, there is a *cough* extra sort of hidden area *cough* that nasties can do a Empire Strikes Back and is not addressed by scanners.


The exploit potential has been well documented and in widespread circulation since 2009, but given some certain knee jerk reactions lately, seems it hasn't been properly addressed, likely because it was deemed OS X security was pretty darn good.


If the eggshell security was cracked, that area is a prime target for permanently pawning the machine with little user recourse.


If the scammers don't get $99, they certainly will get something for millions of Mac's they now control.


The only way to "test" this OS X malware would be to virtualize OS X on a Linux box with a flashable BIOS.

May 2, 2011 6:33 AM in response to ds store

DS


I was wondering if the open source Chromium browser is any more secure than Chrome? I know you advocate FF, and I do love FF4 but right know there seems to be a memory leak with it. They have released FF 4.01 I don't know for sure whether it addresses the memory leak. When I was using FF4 it was eating more than 400MB of RAM after a time. Any suggestions would be greatly appreciated.


Joseph

May 2, 2011 10:18 AM in response to Linc Davis

Linc Davis wrote:


does Mackeeper will keep my computer clean and safe?


No, it's worthless, and the developer is just a cut above the "MacDefender" level on the ethics scale.



Care to elaborate on this? i.e. reasoning and evidence.


FWIW, I purposefully went to the 'paid rubber stamp' page to check this out and I'm amazed that anyone is falling for it. The biggest clue is that the fake scan screen you see in your web browser shows Windows being scanned, not OS X. Seriously guys, take responsibility for yourselves and clue up.

May 2, 2011 10:32 AM in response to zygote0

Link-

Thanks for all your expertise. I for one am trying to do just that, that's why these discussions are helpful for those of us who are a little older and didn't grow up with a computer like my son and perhaps you? So patience for those of us who are trying to learn....even if late.. is appreciated. Many thanks for all the help and advice from you and from Joseph!


PS Yes I saw that when it was trying to download but it was unexpected and happened so fast. I have Windows Office on my computer and the application was open and so thought at the first instant that it had to do with that somehow. In retrospect, I realize that it couldn't.

May 2, 2011 1:12 PM in response to Linc Davis

Linc Davis wrote:


Go to the site "clamxav DOT org" (not to be confused with clamxav.com) and draw your own conclusions. Note especially the big "Download Now" buttons. Think you're downoading ClamXav? Look again.


Nah, this is no worse than your average computer magazine allowing several pages to be used as an "advertising feature" (in small letters) made to look like bonafide editorial, happens all the time. The download button doesn't imply that you're downloading ClamXav, just "Mac AntiVirus" and to top it all there's a very clear link below it that says "Download ClamXav"


The point I was making is that everyone who is going to have a computer and participate, however passively, in the internet, has an obligation to themselves and everyone else to gain a reasonable amount of knowledge about what they're doing. By doing this they narrow the available opportunity for the scam artists. I hate hearing Mac users spraffing on about how they don't need AV since Mac's don't get viruses. This is akin to the idiots who drive at dusk or dawn without their headlights on because 'they can see where they're going'. Us Mac users should be running AV as we still pass files and documents around, and without AV we run the risk of unknowingly spreading viruses on to our fellow Windows users. Mac users have no excuse for not running AV now as there are a widening choice of free ones, including Sophos AV, which scans for all threats not just Mac ones.


Let's all do our bit folks.

May 2, 2011 1:35 PM in response to zygote0

Mac users have no excuse for not running AV now as there are a widening choice of free ones, including Sophos AV, which scans for all threats not just Mac ones.


I couldn't agree less with this and most of the rest of what you say, but if one does feel such an obligation, there's no reason to use anything other than ClamXav, which is also free, and, unlike the Sophos product, doesn't install a kernel extension and doesn't cause system instability.

May 2, 2011 1:49 PM in response to MacJoseph

MacJoseph wrote:


DS


I was wondering if the open source Chromium browser is any more secure than Chrome? I know you advocate FF, and I do love FF4 but right know there seems to be a memory leak with it. They have released FF 4.01 I don't know for sure whether it addresses the memory leak. When I was using FF4 it was eating more than 400MB of RAM after a time. Any suggestions would be greatly appreciated.


Joseph


It seems to be functioning much better now since the update.


The Firefox add-on: Public Fox can be set to require a password on all downloads.


Keeps the MacDefender malware out of the downloads folder.

May 2, 2011 10:28 PM in response to ds store

Even tho in my settings I have it where FF can not put a update without my knowledge and subsequent okay, Today I found out they did just that. My computer was updated to 4.01. There was quite a bit of security concerns along with this memory leak you are all writing about. I just thought I would let you all know. It was quite by accident that I even found out this was done.

May 11, 2011 10:25 AM in response to judyfromspring

I have made an Automator workflow to remove all the known variants.

You can get it here: http://bit.ly/k5O8Ux


Alternatively you can follow the manual steps:

  1. Open Applications > Utilities > Activity Monitor and quit any processes linked to MACDefender.
  2. Delete MACDefender from the Applications folder.
  3. Check System Preferences > Accounts > Login Items for suspicious entries.
  4. Run a Spotlight search for "MACDefender" to check for any associated files that might still be lingering

Substitue "Defender" for "Security" or "Protect" depending on the variant you have.

what is macdefender and is it needed for macbook pro

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.