Over the years I’ve been asked hundreds of times whether it’s necessary to protect a Mac with anti-malware software and have been comfortable is saying “No, it’s not necessary.” Unfortunately, it’s no longer possible to be so dismissive.
It’s come to my attention that there is a malware out there that goes by a number of different names: it started with MacDefender, then MacProtector, MacSecurity and now MacGuard. They are not strictly viruses, insofar as they don’t reproduce, and mostly they’re there to separate you from your money – not only for the purchase of the fake virus protection but also by stealing your credit card number.
The first variants required you to deliberately enter your administrator password, but the newest version does not require the admin password andif you click install, it will install itself into your computer, download its payload, and start popping up and bothering you at every opportunity. (And your credit card is compromised). I want to emphasize again – even though you don’t have to put in the admin password,you have to voluntarily install this program.
So here’s what is being recommended:
- The first thing to do is make sure that when seeing a web page that looks like a Finder window, and purports to be scanning your Mac, you know that this is bogus.
- Leave the page, and quit your web browser.
- If anything has downloaded, and the Installer application has opened, quit it right away; look in your Downloads folder for the file, then delete it.
- Next, users should uncheck the “Open ‘safe’ files after downloading” option in Safari’s General preferences.
- Or switch to Firefox, as it gives you the alternative to direct it what to do about every downloaded file.
- Never, EVER, give out your credit card number in response to a solicitation, unless you are absolutely sure you know who it is. Check the URL in the address bar and make sure it is exactly the URL you expect. For instance, www.apple.com is different from www.apples.com, though www.apple.com is the same as apple.com . Pay attention. If there is an option for Paypal that may be the better alternative. But you still have to pay attention to the URL of the Paypal site.
- Next, I recommend creating a second account on the computer, that is a standard account, that is, it has NO privileges to install software, either with a package or by drag and drop to the Applications folder. Using a standard account instead of an admin account for daily operations adds to your safety. You can always still install software and updates but you actually have to enterboth the admin name and password and that prevents the kind of mischief we’re seeing here. If you’re running your computer without a password this is a good time to re-evaluate that plan.
- Also, Apple has released a software update to address this issue. So when Software Update pops up and asks if you want to update, please say YES!
- Then, you can install malware protection like the free ClamXAV or Sophos AntiVirus (both for “home use”). Or buy the more complete VirusBarrier v6, that does so much more. Frankly, at this point, if you do the things I suggest above, this may not be necessary, but it is probably advisable.
- If you think you’ve been infected AND you use Time Machine, we will need to do some special cleansing, so please call me.
Still the best protection is using what’s between your ears. If you get a popup that says your computer is infected and it advertises the solution,be immediately suspicious. Don’t click on banners that you don’t recognize, don’t start installers unless you were intending to install something, and if an installer runs that you didn’t start, stop it, quit it and then remove it.
Again this is an opportunity to clean up security practices, and not a cause to panic. This malware won’t wipe your drive or send tens of thousands of emails to unsuspecting friends. The remedies are fairly simple things to do and if you feel uncertain about how to do them, feel free to call me. Also if you have seen this popup, I’d like to hear about it. Thus far I haven’t heard from anyone so it is NOT completely ubiquitous, but it is out there. If you think you’re infected, let me know and I can help you get uninfected. Here are some links you can read for more information:
http://themacxperts.com/blog/files/3fd69a946e0ef101152b95b6088ff2a7-4 .html
http://support.apple.com/kb/HT4650
http://download.cnet.com/8301-20074-20064445-12.html
http://blog.intego.com/2011/05/02/intego-security-memo-macdefender-fa ke-antivirus/
http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for- mac-home-edition/download.aspx
