New 'MACDefender' Variant Installs Without Admin Password Requirement

macdefender support note1
Antivirus firm Intego today reported that it has discovered a new variant of the "MACDefender" malware that ups the ante by not requiring an administrator password for installation. The step is accomplished by installing the application only for the current user.

Unlike the previous variants of this fake antivirus, no administrator's password is required to install this program. Since any user with an administrator's account - the default if there is just one user on a Mac - can install software in the Applications folder, a password is not needed. This package installs an application - the downloader - named avRunner, which then launches automatically. At the same time, the installation package deletes itself from the user's Mac, so no traces of the original installer are left behind.

The second part of the malware is a new version of the MacDefender application called MacGuard. This is downloaded by the avRunner application from an IP address that is hidden in an image file in the avRunner application's Resources folder.

Late yesterday, Apple issued its first public notice on the MACDefender malware, providing users with steps for avoiding or removing the software, as well as reporting that a Mac OS X software update to be released in the "coming days" will automatically find and remove MACDefender and its known variants. The update will also alert users if they are about to download one of the malware applications.

It is unknown whether protection against the new "MacGuard" variant will be included in the software update from Apple, but the company will almost certainly have to keep on its toes to address the quickly evolving threat.

Popular Stories

Alleged M4 MacBook Pro Leak Video

Alleged M4 MacBook Pro Unboxing Video Reveals These Four Upgrades

Sunday October 6, 2024 6:10 pm PDT by
An alleged unboxing video for an unannounced 14-inch MacBook Pro with the M4 chip was uploaded to YouTube today by Russian channel Wylsacom. The video was later linked to on social media platform X by Bloomberg's Mark Gurman. It is possible that this is the same MacBook Pro box shown in photos that were shared by leaker ShrimpApplePro in late September, as he claimed that this MacBook Pro...
M4 Real Feature Red

Gurman: Apple to Launch First M4 Macs and Potentially iPad Mini 7 on November 1

Sunday October 6, 2024 6:40 am PDT by
Apple will announce several new M4 Mac models around the end of October, with the company planning to launch at least some of them as soon as Friday, November 1, according to Bloomberg's Mark Gurman. Writing in his latest Power On newsletter, Gurman said that Apple will launch a new M4 version of its low-end 14-inch MacBook Pro, as well as higher-end 14-inch and 16-inch MacBook Pro models...
space black mbp

Apple Potentially Facing Worst Leak Since iPhone 4 Was Left in a Bar

Monday October 7, 2024 3:03 pm PDT by
Alleged photos and videos of an unannounced 14-inch MacBook Pro with an M4 chip continue to surface on social media, in what could be the worst product leak for Apple since an employee accidentally left an iPhone 4 prototype at a bar in California in 2010. The latest video of what could be a next-generation MacBook Pro was shared on YouTube Shorts today by Russian channel Romancev768, just...
top stories 5oct2024

Top Stories: iOS 18.1 Coming Soon, October Apple Event Rumors, and More

Saturday October 5, 2024 6:00 am PDT by
It's hard to believe we're already into October with the iPhone 16 launch behind us, but there's lots more still to come from Apple this year on both the hardware and software fronts. We're still expecting a number of Mac and perhaps some iPad updates in the very near future, while Apple Intelligence features are set to begin rolling out with iOS 18.1 and related operating system updates....
Generic iOS 18

Apple Plans to Release iOS 18.1 With Apple Intelligence on October 28

Sunday October 6, 2024 6:18 am PDT by
Apple intends to launch iOS 18.1 with the first set of much-anticipated Apple Intelligence features on October 28, according to Bloomberg's Mark Gurman. Writing in the latest edition of his Power On newsletter, Gurman says the release date is arriving this month later than initially expected, as Apple is reportedly taking extra time to ensure a smooth rollout and prepare its AI cloud...
watchos 11 vitals

Apple Watch Users Report Vitals App Detecting Illness Before Symptoms Appear

Monday October 7, 2024 5:34 am PDT by
Apple's new Vitals app for watchOS 11 appears to be impressing some users with its ability to detect potential illness days before symptoms manifest, according to recent reports on Reddit. The Apple Watch app, which analyzes key health metrics measured during sleep over the last seven days, appears to be providing early warnings of impending sickness for at least some Apple Watch wearers...
Prime Big Deal Days Hero 3

The Best Early Prime Day Deals on AirPods, Apple Watch, and More

Friday October 4, 2024 10:43 am PDT by
Amazon is hosting another Prime Day event this year, called Amazon Prime Big Deal Days and offering shoppers the first chance to save on holiday shopping from a major retailer. Similar to the first Prime Day, it will last for two days (October 8-9) and you can already find a large selection of early deals across Amazon's storefront, covering savings on tech, clothing, video games, groceries, and...
Generic iOS 18

Apple Releases iOS 18.0.1 With Touch Screen Bug Fix and More

Thursday October 3, 2024 2:22 pm PDT by
Apple today released iOS 18.0.1 and iPadOS 18.0.1, the first updates to the iOS 18 and iPadOS 18 operating systems that debuted earlier in September. iOS 18.0.1 and iPadOS 18.0.1 come two weeks after the launch of iOS 18. The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. According to Apple's release notes, the...
maxresdefault

Two Weeks With the iPhone 16 Pro Max

Friday October 4, 2024 12:04 pm PDT by
Now that it's been two weeks since the iPhone 16 models were released, we've been able to spend enough time with the new devices to share a more in-depth review on their performance, battery life, feature set, and more. Subscribe to the MacRumors YouTube channel for more videos. We've been testing the iPhone 16 Pro and Pro Max, but the gap between the Pro models and the standard iPhone 16...

Top Rated Comments

stridemat Avatar
175 months ago
Perhaps Apple should issue an 'update' the makes Safari not open downloaded files automatically?
Score: 31 Votes (Like | Disagree)
Jolly Jimmy Avatar
175 months ago
One Word:

MACDEFENDER

;)
Not a virus. Honestly there should be a sticky thread or something explaining what a virus is.
Score: 14 Votes (Like | Disagree)
KnightWRX Avatar
175 months ago
Do you like contradicting yourself? We can go back and forth between "virus"/malware argument but what's the point.

I have not contradicted myself. Go back and forth on what ? Virus is a type of malware. Spyware is another. Trojans are yet another.

There are Mac malware out in the wild.
There aren't any Mac viruses out in the wild.

Both statements are true.
Score: 13 Votes (Like | Disagree)
longofest Avatar
175 months ago
the days of malware free macs are over! No surprise that Apple initially failed to acknowledge the problem.

The days of malware-free macs have BEEN over (https://www.macrumors.com/2006/02/16/mac-os-x-virus-trojan-summary/). This appears to be the first malware that is actually getting decent press coverage.
Score: 13 Votes (Like | Disagree)
*LTD* Avatar
175 months ago
apple should start catering to real mac users again, and not to the lowest common demonator = pc users!

Most Mac users used to be Windows users at one time or another. Including yours truly.

WTF is a "demonator"?
Score: 12 Votes (Like | Disagree)
griz Avatar
175 months ago
Uncheck "Open 'safe' files after downloading" in Safari Prefs.
Downloaded apps will not launch automatically if you uncheck this option in Safari. Not sure about other Browsers. So as long as you don't launch the installer, you are fine.
Score: 12 Votes (Like | Disagree)