Mac Defender downloader discovered with new variant
The downloader arrives on your computer using the same mechanism that MacDefender and earlier versions of the trojans used. Namely, whilst browsing a compromised website users will see what appears to be a scan of their computer occurring within their web browser. The JavaScript on the website downloads a small zip file to the Applications folder containing the downloader application, avRunner.
The malicious application then runs and downloads a MacDefender variant called MacGuard and installs this into the Applications folder. An item is also added the user's Login Items in System preferences so that MacGuard runs each time on startup.
Web traffic is hijacked, too, such that users are sent to pornographic and phishing websites to further encourage them to license the fake software to eliminate this additional problem.
ProtectMac AntiVirus customers are protected against these threats OSX.MacDefender, Trojan-Downloader.OSX.Fav.A
How to manually removal MacDefender and any variants
Manual removal instructions
Mac users can prevent downloaded archives and files from being opened automatically by disabling the ‘Open “safe”files after downloading’ option in their General Safari preferences.
