You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

mac protector?

accidentally clicked a button and installed (but did not register) something called "Mac Protector". some sort of anti-virus software. was this put out by mac? should i not buy/register for it? is it a good thing? has it ever messed up someone's macbook/laptop?

MacBook, Mac OS X (10.6.7)

Posted on May 7, 2011 6:17 AM

Reply
Question marked as Top-ranking reply

Posted on May 7, 2011 6:38 AM

You installed a vicious malware product. Never ever install something you know nothing about. Do a search for "MacProtector" and you'll find plenty of threads about it and how to get rid of it.

36 replies

May 7, 2011 10:45 AM in response to tushar marshall

to reboot in safe mode, you hold down the shift key as you start the computer.


this thing was circling through my computer for about 20-30 min before i found the answer from wzzz in this forum. i too would like to know what it may have done, or may still be doing to my macbook. as i said, i do think i originally installed it as well, because it looked like a mac software update or something, but i never gave my credit card info or officially "registered" for it. does that mean i'm only half as dumb as they wanted me to be?


what ARE the effects on the computer if you did make the mistake of installing it and had to trash it from the applications folder? wzzz?

May 7, 2011 11:09 AM in response to anthonyitaliano

People pls check your Safari browser....I had just installed and removed the MacProtector app...I rebooted in safe mode thnx anthonyitaliano....i tried to browse through Safari browser and none of the websites seem to open now...I have done forcequit around 6 times now....the sites which i used to browse doesn seem to open....I just see the browsing circle executing....pls check....I don know whether this is an effect coz of installing the MacProtector icon....I even tried to open this community weblink and Safari wouldnt open...

May 7, 2011 11:39 AM in response to anthonyitaliano

I don't think anyone has yet done a full analysis, but this latest incarnation of MAC Defender, which first appeared last weekend (it has subsequently changed names several times and is now called MacProtector) appears to be no more harmful than its predecessors. The only difference I've been hearing is that it now appears to actually do some kind of fake scan of your drive and then, maybe, "phone home." But with what data, I'm not sure. This I don't like.


I would certainly change my password if I'd been infected. And, another word of advice: don't get into the habit of using the same password for multiple purposes. Never use an ordinary word of any kind, i.e. one that can be found in the dictionary (some exploits will employ a "dictionary attack;" they will try every single word from the dictionary), choose a relatively long password from random letters (upper and lower case) and numbers and characters from all over the keyboard.


As far as I know -- but, as I said, I haven't yet seen a full analysis of this latest variant -- if you've removed the program from your Applications folder and from Login Items, that's it. No lingering after effects. I think they are after money and credit card numbers. If you've given your credit card information, call your credit card company to cancel the charge or place it in dispute. And cancel that card immediately.


You can be much safer, in general, on the Internet with Firefox and the Add-on NoScript. Many exploits employ weaknesses in JavaScript, which is used extensively on web sites. NoScript filters JavaScript.


http://noscript.net/features


If you want even more protection against programs that "phone home," get Little Snitch.


http://www.obdev.at/products/index.html

May 7, 2011 12:55 PM in response to WZZZ

I got hit with this menace, too. I sent the app & the downloaded execute files to the trash & emptied the trash while I was in regular mode, i.e. not safe. Then went to safe & changed my account password & deleted the malware from the Accounts Log In items. Should I do anything further? I'm asking because I didn't delete the app while in safe mode...

May 7, 2011 12:56 PM in response to anthonyitaliano


If any of you RxMeisters and MalwareHunters want to see this malware called MacProtector in action (I don't recommend it, otherwise), you can find it here (after deleting it myself, I found this active URL in my browser history):
FYI, I can CONFIRM previous assertion that this so-called MacProtector malware downloaded to my desktop BY ITSELF -- I didn't even click on anything. Happened around 12:30 PM EST. An original PopUp window (?) "appeared" while I was in Hotmail using Safari browser, (Entourage mail, Word, iCal and iTunes also open at the time,) once it popped up I was looking that PopUp window over trying to figure out what the *&%$ it was (it said something to the effect that "Mac" had detected some number of Viruses and Virus threads, and had some options to select from -- and yes, it "appeared" to be doing a hard drive scan, though that may have been an act). Then, even without doing ANYTHING it started downloading that sucker to my desktop. I never opened the download file -- it went straight into the Trash and was deleted.
Thanks for the Safari Preferences tip to uncheck the "automatically open safe files after downloading" box.

May 7, 2011 1:23 PM in response to tamale

The only purpose of doing a Safe Boot is to be able to trash the components, including the app. Safe Boot disables Login and Startup Items, so the program can be trashed. You can also kill it/force quit it in Activity Monitor and then trash it.


Until now, it was my understanding no one was able to trash the app, or perhaps it was just the Login Item, without getting an "in use" message. If you trashed both the app and the Login Item, that should be it. But, no one, to my knowledge, has yet done a really thorough analysis of this latest variant, MacProtector.


Hotmail is well known as an infestation of spammers and malware. You couldn't pay me to have a hotmail account, and if I didn't know a few people who use it, I would block it completely.

May 7, 2011 4:38 PM in response to rzawu

First, restart in Safe Boot by holding the Shift key down at the chime. This will keep it from running, so you can remove it.


1. Drag the MacSecurity program -- or whatever it's called, MAC Defender, MacProtector (installed in the Applications folder by default) to the Trash. Empty the Trash.

2. Remove item of same name from the Login Items for your Account in the OS X System Preferences (if it exists).

3. Go to your Home folder Library>Preferences and Application Support (may not be one there) and search for any files with one of the above names and trash them. Empty the trash.


You could have found this in this thread, I believe, or in any number of threads here, or by searching with Google.

May 7, 2011 8:03 PM in response to anthonyitaliano

This thing is a nasty bit of business. I was on some website, I don't think I even clicked on anything. On mouseover, it suddenly downloaded the program into my computer and an installer window opened up. I immediately quit the window, found the file in downloads, trashed it and emptied the trash. I also went to accounts in preferences, and didn't notice any new logins. Is there anything else I should do or look for? I'm thinking I got it all.


And thanks for all the helpful information!

May 15, 2011 1:25 PM in response to anthonyitaliano

Hi Guys,


I became one more victim of MAC Protector, but the mistake i did was even severe than all of you guys, I registered with MAC Protector, with my credit card details and everything and now I dont know how to get my money back or rather I should say where to get my money back. I would really appreciate if someone can guide me with this regard.


Thanks,

Nisarg

mac protector?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.