MacDefender and MacProtect – They Don’t.

Lately, I’ve been seeing pop-up ads for MacDefender and MacProtect. Then a few days ago, I had my first “help!” call.

MacDefender and MacProtect are the Mac versions of the (*@#&$ that Windows users have been dealing with for years – scare-ware that tries to convince you that your Mac is infected, even though it isn’t.
These are both ads for malware. If you click on them, they will download an installer. If you ‘Quit’ the installer, you’ll be fine. You can stop here.

If you click through all the pages of the installer, including entering your admin password, you’ll now have a new program which will incessantly tell you that you are infected by 87 gazillion viruses, spyware, and all sorts of evil bits. It’s lying. It will also cause Safari to open up various porn sites just to help convince you.

To remove it is fairly simple – 4 steps.

1. Kill it – Open Activity Viewer – it’s in the /Applications/Utilities folder in your Macintosh HD. To get to it, click on an empty spot on your desktop, or on the Finder icon (Happy Mac face) on the Dock, and then in the menubar, click on Go, then click on Utilities. Then double-click on Activity Viewer in the window that opens up.
Find the macdefender or macprotect process in the list. Click on the “quit process” button. When it asks if you are sure, click on “force quit”.

2. Trash it – Open the Applications folder in the Finder. Find MacDefender /MacProtector and throw it away. Empty the trash.

3. Remove the login item. Open System Preferences from the Apple Menu. Click “Accounts” or “Users & Groups” depending on your system version. Click “Login items”. Find the MacDefender or MacProtect item in the list, click it once, and click the minus sign right below the list. Don’t just check or uncheck the box – that only hides it.

4. Set Safari to not open these files in the future. Open Safari, click on Preferences in the Safari menu, click on General, then uncheck the box at the bottom that says “open safe files after downloading”.

That’s it.

One last thing – to prevent this in the future, watch what you click. If you see an Installer window, don’t proceed with the installation unless you know and trust what you’re installing.