How do you remove the Virus Mac Protector?
I haven't heard of this "virus", with the definition of a virus including the ability to spread virally - from computer to computer without the infected user's knowledge. No such animal exists for OS X - not one.
Malware yes, a virus, no.
Here is a link to a free antivirus application for OS X which has good reviews.
Trojan War
If you discover a trojan program is running on your computer then look to the following information for assistance:
1. A recent discussion on the Apple Support Communities: MacDefender Trojan.
2. An excellent site devoted to Mac Malware: Macintosh Virus Guide
Removing strange software can be a task. The following outlines various ways of uninstalling software:
Uninstalling Software: The Basics
Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.
Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.
Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.
Some applications may install a Startup item or a Log In item. Startup items are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the Delete [-] button to delete it from the list.
Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.
If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, Easy Find, instead. Download Easy Find at VersionTracker or MacUpdate.
Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.
There are many utilities that can uninstall applications. Note that you must have this software installed before you install software you may need to uninstall. Uninstallers won't work if you install them after the fact. Here is a selection:
AppZapper
Automaton
Hazel
CleanApp
Yank
SuperPop
Uninstaller
Spring Cleaning
Look for them and others at VersionTracker or MacUpdate.
For more information visit The XLab FAQs and read the FAQs on removing software and dealing with spyware and malware.
After removing all the components of the software you may have to restart the computer to fully disable the software. This will be the case when removing software that has installed a daemon. After the daemon has been removed you need to restart the computer to stop the daemon. Alternatively, you can kill the daemon process using the Terminal application or Activity Monitor.
These are the instructions for removing it:
Open Applications > Utilities > Activity Monitor and quit any processes linked to MACDefender.
Delete MACDefender from the Applications folder.
Check System Preferences > Accounts > Login Items for suspicious entries.
Run a Spotlight search for "MACDefender" to check for any associated files that might still be lingering.
You might need to put macprotector instead or MACDefender but it should work anyway.
Along with the other links, I just found this one which has been updated with the latest information:
babowa-
that is excellent. hats off to the author of it!
Agreed - that's why Thomas' article gets linked to a lot (and he immediately updated it for the latest garbage-ware).
I went to some news story "Spain hit by Earthquake" at Today News - Today.com and a popup came up saying it was the "APPLE SECURITY CENTER" it looked like it wanted me to run a scan of some kind. I didn't do it, so I don't know if that was another source for "Mac Protector" or not. The "automatic" URL that the news story took me to was http://joyawpan.com?id=541894
I know the Apple Support Center has been looking to find out where these auto-downloads are coming from.
I know the Apple Support Center has been looking to find out where these auto-downloads are coming from.
What "Apple Support Center" are you referring to?
It's also best if you do NOT post links to questionable sites in these forums.
I appreciate your comment (i.e., ...do NOT post links...) and in-fact tried to highlight the hypertext and change it to plain text like I would on a PC, but couldn't figure out how to do that once I had already posted the message. Also, I actually don't know how I would know "what "Apple Support Center" I was talking to yesterday, but that is what they told me when I was on the phone with them about an issue that I thought might have been linked to the Mac Protector malware. They said they thought it was coming from sights with older equipment and mentioned Sequel Server.
Try to avoid that site, it tried to convince me that my home folder was full of viruses, and now google has flagged it as malware. I (stupidly) clicked on the page, and it downloaded "anti-malware.zip", unzipped to "MacProtector.mpkg", and tried to run. I pulled the power cord first 😀.
The Mac Defender and Mac Protector are apparently Malware from the same authors. Many folks that have received these applications do not know what they did to acquire them. In-fact some say they absolutely did nothing at all and the download just occurred and suddenly they had the Application in their Applications Folder.
In any case once the program is activated it appears to run sporadically as if it were running a virus scan. If you find these Applications in your Application Folder, you need to follow the instructions in this discussion thread above and move them to the trash and empty the trash. Also, as pointed out above remove and "linked" Application Support files that are "specifically" shown to support Mac Defender and/or Mac Protector.
Absolutely don't give it your credit card number!
<Link Edited by Host>
If this is a questionable site, you should NOT be posting a clickable link to it! If it is, please see if you can edit it into regular text.
I think I have a virus called Mac Protector? I do I remove it?
