#MACREVIVER HOW TO#
#MACREVIVER INSTALL#
#MACREVIVER PATCH#

An anonymous AppleCare support employee said that Apple instituted the policy in order to prevent users from relying on technical support instead of anti-virus programs.

#MACREVIVER HOW TO#

Specifically, support employees were told not to instruct callers on how to use Force Quit and Activity Monitor to stop Mac Defender, as well as not to direct callers to any discussions pertaining to the problems caused by Mac Defender.

AppleCare employees were told not to assist callers in removing the software.

Apple response Īccording to Sophos, by 24 May, 2011, there had been sixty thousand calls to AppleCare technical support about Mac Defender-related issues, and Ed Bott of ZDNet reported that the number of calls to AppleCare increased in volume due to Mac Defender and that a majority of the calls at that time pertained to Mac Defender. ChronoPay had earlier been linked to another scam in which users involved in file sharing were asked to pay a fine. The web sites were hosted in Germany and were suspended by Czech registrar Webpoint.name. ChronoPay is Russia's largest online payment processor. The email address appeared in domain registration for and, two web sites Mac users are directed to in order to purchase the security software. Mac Defender was traced to ChronoPay by the email address of ChronoPay financial controller Alexandra Volkova. The software has been traced through German websites, which have been closed down, to the Russian online payment ChronoPay. All variants require the user to actively click through an installer to complete installation even if a password is not required. A newer variant installs itself without needing the user to enter a password. Rather than protect against viruses, Mac Defender hijacks the user's Internet browser to display sites related to pornography, and also exposes the user to identity theft (by passing on credit card information to the cracker). The user is then prompted to download a file that installs Mac Defender, and is then asked to pay US$59.95 to US$79.95 for a license for the software. The program falsely appears to scan the system's hard drive. When a user accesses such a malicious link, a fake scanning window appears, originally in the style of a Windows XP application, but later in the form of an 'Apple-type interface'. The program appears in malicious links spread by search engine optimization poisoning on sites such as Google Image Search.

It appears as a pop-up indicating that viruses have been detected on the users' computer and suggests they download a program which, if installed, provides the users' personal information to unauthorized third parties. Users typically encounter the program when opening an image found on a search engine.

#MACREVIVER INSTALL#

However, it is not the first Mac-specific Trojan, and is not self-propagating.Ī variant of the program, known as Mac Guard, has been reported which does not require the user to enter a password to install the program, although one still does have to run the installer. The software has been described as the first major malware threat to the Macintosh platform (although it does not attach to or damage any part of OS X).

#MACREVIVER PATCH#

The Mac security firm Intego discovered the fake antivirus software on, with a patch not being provided by Apple until 31 May. Mac Defender (also known as Mac Protector, Mac Security, Mac Guard, Mac Shield, and FakeMacDef) is an internet rogue security program that targets computers running macOS.

Macreviver