Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Mac Malware Message

Hello;


I have a friend with a Mac that is about 5 years old. In the last 2 weeks she has started seeing a screen pop-up at random times while she is using her e-mail. The screen says something to the effect; "Your computer is infected with 22 pieces of Malware, Click to Remove them now". She has just closed out of the window and has not downloaded or run anything.


To the best of her knowledge, she does not have any type of virus / malware scanner installed.


I know there has been recent talk in the news of some types of mac malware. Does this sound like it could be some type of malware on her system? If so, what do you advise?


Thanks


Jamie Dolan

Neenah, WI

Mac & PC, Mac OS X (10.5.6)

Posted on May 24, 2011 12:44 PM

Reply
Question marked as Top-ranking reply

Posted on May 24, 2011 1:00 PM

Tell her to ignore these messages. They are scams attempting to entice you to download a trojan to your computer. See the following:


Trojan War


If you discover a trojan program is running on your computer then look to the following information for assistance:


1. A recent discussion on the Apple Support Communities: MacDefender Trojan.

2. An excellent site devoted to Mac Malware: Macintosh Virus Guide

3. Another site for removing MacDefende, et.al.: MAC Defender Rogue Anti-Virus analysis and Removal

4. A new removal utility - MacDefenderKiller


Removing strange software can be a task. The following outlines various ways of uninstalling software:


Uninstalling Software: The Basics


Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.


Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.


Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.


Some applications may install a Startup item or a Log In item. Startup items are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the Delete [-] button to delete it from the list.


Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.


If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, Easy Find, instead. Download Easy Find at VersionTracker or MacUpdate.


Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.


There are many utilities that can uninstall applications. Note that you must have this software installed before you install software you may need to uninstall. Uninstallers won't work if you install them after the fact. Here is a selection:


AppZapper

Automaton

Hazel

CleanApp

Yank

SuperPop

Uninstaller

Spring Cleaning


Look for them and others at VersionTracker or MacUpdate.


For more information visit The XLab FAQs and read the FAQs on removing software and dealing with spyware and malware.


After removing all the components of the software you may have to restart the computer to fully disable the software. This will be the case when removing software that has installed a daemon. After the daemon has been removed you need to restart the computer to stop the daemon. Alternatively, you can kill the daemon process using the Terminal application or Activity Monitor.

3 replies
Sort By: 
Question marked as Top-ranking reply

May 24, 2011 1:00 PM in response to jamiedolan

Tell her to ignore these messages. They are scams attempting to entice you to download a trojan to your computer. See the following:


Trojan War


If you discover a trojan program is running on your computer then look to the following information for assistance:


1. A recent discussion on the Apple Support Communities: MacDefender Trojan.

2. An excellent site devoted to Mac Malware: Macintosh Virus Guide

3. Another site for removing MacDefende, et.al.: MAC Defender Rogue Anti-Virus analysis and Removal

4. A new removal utility - MacDefenderKiller


Removing strange software can be a task. The following outlines various ways of uninstalling software:


Uninstalling Software: The Basics


Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.


Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.


Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.


Some applications may install a Startup item or a Log In item. Startup items are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the Delete [-] button to delete it from the list.


Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.


If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, Easy Find, instead. Download Easy Find at VersionTracker or MacUpdate.


Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.


There are many utilities that can uninstall applications. Note that you must have this software installed before you install software you may need to uninstall. Uninstallers won't work if you install them after the fact. Here is a selection:


AppZapper

Automaton

Hazel

CleanApp

Yank

SuperPop

Uninstaller

Spring Cleaning


Look for them and others at VersionTracker or MacUpdate.


For more information visit The XLab FAQs and read the FAQs on removing software and dealing with spyware and malware.


After removing all the components of the software you may have to restart the computer to fully disable the software. This will be the case when removing software that has installed a daemon. After the daemon has been removed you need to restart the computer to stop the daemon. Alternatively, you can kill the daemon process using the Terminal application or Activity Monitor.

Reply

May 24, 2011 1:02 PM in response to jamiedolan

You friend has almost certainly been hit with the malware Macdefender/MacProtector/Apple Security Center (it does use other names as well).


Have a look at this thread for instructions how to remove it: https://discussions.apple.com/thread/3076332?tstart=0

and also, noting Thomas A Reed's comments at the end of the thread, make sure that if she has parted with any credit card details cancel the card immediately.

One thing is certain, your friend hasn't got a virus, this is a scam that's getting a lot of airtime at the moment.

Reply

Mac Malware Message

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.