A fake anti-malware program billed as a MAC Defender download is targeting Apple Mac users via poisoned search engine results, the security firm Intego reported Monday.
It was not immediately clear whether the bogus MAC Defender application was acting as a virus or as a form of scareware combined with a phishing scam to get Mac users' credit card details, according to TNW's Apple blog, which cited user comments on the Apple Support forum.
But Intego did find that "MAC Defender also opens Web pages for pornographic Web sites in the user's Web browser every few minutes. This is most likely to make users think that they are infected by a virus, and that paying for MAC Defender will relieve them of the problem."
The professional-looking download is reportedly popping up on Google image searchers, according to Mac users who have been targeted.
"When a user clicks on a link after performing a search on a search engine such as Google, this takes them to a Web site whose page contains JavaScript that automatically downloads a file. In this case, the file downloaded is a compressed ZIP archive, which, if a specific option in a Web browser is checked ("open safe files" after downloading in Safari, for example), will open," the Intego blog stated.
The bogus application attaches itself to a computer's launch menu and has no dock icon, making it difficult to quit.
To remove the fake MAC Defender application, TNW recommends going to Activity Monitor in Applications > Utilities and disabling anything that relates to the file. Then find any references to the application in Startup Items, Launch Agents and LaunchDaemons and quit out of anything that's running. In the Applications folder, drag the MAC Defender app to the trash and run a Spotlight search to locate any MAC Defender references you may have missed, trashing whatever you find.
Intego also recommends unchecking "open safe files" options in Safari and other browsers to avoid getting infected in the first place.
The developer of the legitimate MacDefender software has put up a front page notice warning Mac users of the existence of the bogus application.