MacDefender trojan

* use your router firewall to filter and block instead of software

* some programs (TechTool Pro comes to mind) slide in startup and background processes that will remain - and require an uninstaller almost always.

The clamav signature database has been updated to include two variants of the MacDefender Trojan, so ClamXav will detect all known versions of the .zip, .pkg and .app files associated with it.

-Al-

MadMacs0 wrote:

The clamav signature database has been updated to include two variants of the MacDefender Trojan, so ClamXav will detect all known versions of the .zip, .pkg and .app files associated with it.

-Al-

Thanks Al,

Be sending people your way.

ou may a trojan called Mac Defender / Protector / Security

Check you downloads folder and apps folder to see if it is there If you not find it

-If go to safari, preferences, general, deselect - open all safe downloads ( may not be exact wording)

If you find it go to DO NOT SIGN UP or GIVE CREDIT CARD INFO....

Go to acitivity monitor in ultilies - quit the program.

trash it from downloads, app folder, remove for Login Item in accouns (sys. pref)

Boot into safe mode - hold the option key down and when you restart the mac

look at these locations to see if remains.... if found try removing them again

Uncheck the safari pref as above

I advise getting security software or wait for Apple to come up with a security fix

Mine came through on Firefox... not Safari.

ronaldz wrote:

I advise getting security software or wait for Apple to come up with a security fix

There is no way for security software to reliably detect this trojan. It can be easily changed and already has been. There is also no Apple security fix to address it.

Mac trojans are fundamentally unlike Windows malware. Because MacOS X is secure to begin with. You, the user, must install the malware. That is the only way to get infected. The only reliable defense is to just not click the "install" button.

When you install software and hand over your admin password, the software can do anything it wants. Because MacOS X is secure and malware must be installed by the user, there is no way for anti-virus software to stop it.

Don't put your faith in anti-virus software, don't wait for Apple to release a security fix, just don't install it. Apple has created the Mac App store as a way to distribute legitimate, trusted software to end users. Most legitimate software can, and should, use the Mac App store. Being safe from malware on MacOS X is very easy - if you don't trust the installer, don't provide your password. When in doubt, just select "Quit Installer" from the "Installer" menu.

To back up etresoft, I and several other folks who tested AV software against these trojans saw a several day delay before the first was recognized by any AV software, by which point many people were already affected, and then another delay when MacDefender morphed into MacSecurity. I'm sure some of the folks fooled by this malware were running AV software at the time.

Over-reliance on AV software can produce a complacent attitude that results in an easy infection. After all, the software must be okay if the AV software didn't catch it, right?

That said, though, I do hope that Apple removes .mpkg files from the "safe" file list in Safari and adds them to the list of things to be held in Quarantine. That would go much further towards preventing such outbreaks than any malware-specific protection.

Kaspersky for Mac

4.05.2011 16:10

It is detected as either "not-a-virus:FraudTool.OSX.Defma.a." or "HOAX.OSX.FakeAVDefma.a".

Kaspersky for Mac: MACDEFENDER

Thomas A Reed wrote:

That said, though, I do hope that Apple removes .mpkg files from the "safe" file list in Safari and adds them to the list of things to be held in Quarantine. That would go much further towards preventing such outbreaks than any malware-specific protection.

I wish Apple would get rid of that option altogether. It serves no useful purpose to anyone except malware authors.

flash8898 wrote:

Mine came through on Firefox... not Safari.

To prevent further infections, install NoScript Add:on for Firefox, use the toolbar customization to drag NoScript button to the Toolbar for easy enabling and disabling of scripts on a per site basis.

Also if you install Public Fox, you can set a password on the downloads.

Use the free ClamXav to remove your present infection first though. 🙂

http://www.clamxav.com/

I have just sent an email to the mentioned email address, any help would be welcome 🙂

Pr0digy V. wrote:

I have just sent an email to the mentioned email address, any help would be welcome 🙂

Note that the address Linc posted was just a way to send him a link to the trojan. Did you need assistance beyond what has been offered here?

Hi Thomas,

I was hoping Linc could provide me with a link to the file or the file itself as i am researching this subject and am very eager to get my hands on it.

Pr0digy V. wrote:

Hi Thomas,

I was hoping Linc could provide me with a link to the file or the file itself as i am researching this subject and am very eager to get my hands on it.

Somebody posted it on one of the other threads this morning, might still be active.

This is it (don't click unless your a security professional)

http://jackerst.com/?id=541682

I have been through all of them and have not found anything that worked. Got a link to the specific post you are referring to?