Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

New 'MACDefender' Variant Installs Without Admin Password Requirement

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
68,105
38,857



macdefender_support_note1.jpg



Antivirus firm Intego today reported that it has discovered a new variant of the "MACDefender" malware that ups the ante by not requiring an administrator password for installation. The step is accomplished by installing the application only for the current user.
Unlike the previous variants of this fake antivirus, no administrator's password is required to install this program. Since any user with an administrator's account - the default if there is just one user on a Mac - can install software in the Applications folder, a password is not needed. This package installs an application - the downloader - named avRunner, which then launches automatically. At the same time, the installation package deletes itself from the user's Mac, so no traces of the original installer are left behind.

The second part of the malware is a new version of the MacDefender application called MacGuard. This is downloaded by the avRunner application from an IP address that is hidden in an image file in the avRunner application's Resources folder.
Click to expand...
Late yesterday, Apple issued its first public notice on the MACDefender malware, providing users with steps for avoiding or removing the software, as well as reporting that a Mac OS X software update to be released in the "coming days" will automatically find and remove MACDefender and its known variants. The update will also alert users if they are about to download one of the malware applications.

It is unknown whether protection against the new "MacGuard" variant will be included in the software update from Apple, but the company will almost certainly have to keep on its toes to address the quickly evolving threat.

Article Link: New 'MACDefender' Variant Installs Without Admin Password Requirement
 
Article Link
https://www.macrumors.com/2011/05/25/new-macdefender-variant-installs-without-admin-password-requirement/
Wow, whomever is behind MACDefender doesn't seem like it's going to give up anytime soon!
 
my guess is it is only going to get a lot worse from here. It is pretty common trick of the "virus" writing to use one that worked and slightly modify it to work another way or do something else and it gets counted as a different virus using the same hole or same trick.

I am willing to bet in the future some of theses things like MACDefender are going to install and not do anything real to get themselves noticed for weeks on end and leave a huge hole to allow other stuff to get installed. You can kill off the other stuff installed but because the hole is never plugged new things will keep coming in.
 
You probably don't have to click through the installer, but you do have to be running as an administrator. Something that no one should ever do on a day to day basis, for any reason.
 
the days of malware free macs are over! No surprise that Apple initially failed to acknowledge the problem.
 
Perhaps Apple should issue an 'update' the makes Safari not open downloaded files automatically?
 
Uncheck "Open 'safe' files after downloading" in Safari Prefs.
Downloaded apps will not launch automatically if you uncheck this option in Safari. Not sure about other Browsers. So as long as you don't launch the installer, you are fine.
 
supmango said:
You probably don't have to click through the installer, but you do have to be running as an administrator. Something that no one should ever do on a day to day basis, for any reason.
Click to expand...

That's not correct. It's installing the malware just for the current user. It won't matter whether that user is an Admin or not, it won't need a password in either case.
 
JonKean said:
the days of malware free macs are over! No surprise that Apple initially failed to acknowledge the problem.
Click to expand...

They've been over for a quite a long time, this is far from the first Mac OS X based trojan.

Where did you get the impression the days of malware free macs were not over ?
 
Does that phony Finder window still pop up before MACDefender begins to download itself or does it go straight to the download?
 
It's a package, guys. You still have to click "Next" 4 or 5 times and select the destination drive.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back