New Mac Defender Malware Version Installs Itself; Doesn’t Care About Your Admin Password

Tweet

Yesterday we told you that Apple has finally come up with detailed instructions on how to avoid and remove that nasty Mac Defender malware from your Mac. And if that’s not enough, Apple will also issue a Mac OS X update that will help you get rid of this unwanted software for you.

But it looks like the hackers are also busy at work as they have issued a new MacDefender version that will install itself automatically as long as they have tricked you into downloading it. The new malware will not require admin password. So make sure you don’t get tricked into downloading this thing in the first place.

Here’s what antivirus firm Intego had to say about this new Mac Defender version:

Unlike the previous variants of this fake antivirus, no administrator’s password is required to install this program. Since any user with an administrator’s account – the default if there is just one user on a Mac – can install software in the Applications folder, a password is not needed. This package installs an application – the downloader – named avRunner, which then launches automatically. At the same time, the installation package deletes itself from the user’s Mac, so no traces of the original installer are left behind.

The second part of the malware is a new version of the MacDefender application called MacGuard. This is downloaded by the avRunner application from an IP address that is hidden in an image file in the avRunner application’s Resources folder.

We’ll certainly want to hear back from you, especially if you got your Mac infected with this malware thing, and we’re even more interested to hear whether you were able to get rid of it using Apple’s instructions or not. So hit the comments section below and tell us more about it, or get in touch with us via Facebook. Oh and if you got anything else on your Mac, then do let us know more details about it.