Our First Mac Malware Infected Computer

Our first Mac infected computer arrived in our shop this week. The IMac was infected with the Mac Defender malware program . With market share and smugness running rampant in Apple land, it was only a matter of time.

The included photos show the user trying awful hard to download the malware. The owner supposedly said his children were using the PC.

Some prevention tips include :
PLEASE BACKUP your user directory if you're not sure of what you are doing, or if in the area, stop by the shop if you need assistance.

1. Turn off Open Safe Files after Downloading in Safari
2. Do not type in your password when asked.
3. And if you get past all that and the bell still doesn't go off, please don't type in your credit card info when asked by the malware program. If you did, call your credit card company and dispute the charge or cancel the card.
4. Download Sophos for Macs and Virus Barrier. Update each and scan your computer.
5. Delete the found quarantine of each anti-virus program.
6. Delete your browsing history
7. Check your DNS settings in system preferences, networking, your connection, properties, DNS tab to see if they're not compromised. If possible, change them to OpenDNS. add the following 208.67.222.222 and 208.67.220.220 for better more secure surfing.

This type of malware is of the social engineering bunch. It scams you into installing itself on the Mac computer, then asks for money or invites other nefarious programs into the compromised system. The MacDefender Malware we encountered adds a nice variety of  porn pop-ups in the browser. This will rattle parents and cause Apples phone to ring off the hook.

I was amazed how it spread itself into the entire system. We scanned with Virus Barrier which found most traces of the program, but we also scanned with the free Sophos Anti Virus for Mac which also found additional files in the java cache folder. After all scanning finished, we went over the system with a fine tooth comb checking for any remnants of the malware in the file system.


These programs all have an extremely convincing pop up to start the process. The click starts the install, which triggers the password box pop up. Users are so convinced , that they type their password and the rest ins history.

Now from what we're hearing the developers have found away around the OS/X password mechanics. Most Mac users don't have any anti-virus on their computers. This could be trouble for Apple as this is a major selling point for the pricey Apple products.

I still have a gut feeling that Iphones and Ipads with an install base of millions, could be next.

all trademarks respected