Users are scammed into providing a credit card number to purchase the antivirus software. The scareware also launches pop-up windows with adult content ads every few minutes to perpetuate the impression that the user has been infected. Then the site warns users that their Macs have been infected and they should download an antivirus scanner to clean the infection. When users stumble upon MacDefender rogue sites, their computers display a window that resembles a Finder window that claims to be “scanning” their system. ZDNet’s Ed Bott estimated that the total number of customers affected could be between 60,000 and 125,000, “and growing.” The scam has been pretty widespread, with poisoned links appearing on Google image searches and other legitimate pages, although it appears that Google has been able to track down and remove a number of malicious links. Considering that fake AV scams tend to change their names and user interface almost continuously, Apple will have to regularly update File Quarantine to ensure it stays ahead of future MacDefender variants. Users can opt out of the scan by unchecking the “Automatically update safe downloads list” option in Security Preferences.Įven if a user didn’t have MacDefender installed initially, File Quarantine will kick in and block the program from being downloaded if the user happens to come across it at a later time.
The system will check daily for updates to the File Quarantine malware definition list. With the latest update, Apple has added an auto-update capability that runs in the background. Up until now, the list was stored locally and updated infrequently. When the user opens or downloads a file, the system quickly checks the list of known malicious software to determine if the file contains known malicious software, according to a support note.
The company also promised an automatic malicious software removal tool, which was included in this security update.īeginning with Snow Leopard, Apple included a way to block “unsafe file types” and malicious software via its File Quarantine feature. If a known variant is found and deleted, the user will be notified via an alert after the update finishes installation.Īfter almost three weeks of near-silence as fake antivirus programs targeting Mac OS X first emerged in early May, Apple acknowledged the problem and provided instructions on how to manually remove scareware in a support note on May 24. Once the update has been installed, the system will search for and remove known variants for the MacDefender malware, including MacDefender, MacProtector, MacSecurity and MacGuard.
The definition was added to the quarantine list in Apple’s Security Update 2011-003, released May 31. Apple rolled out its MacDefender removal tool in its latest security update to detect and remove the fake antivirus for Mac OS X from affected systems.
0 kommentar(er)
