- Close the trojan by clicking the red close button at the top-left of the application.
- Quit your web browser application e.g. Safari.
- Run Apple's Activity Monitor in the Utilities folder
- Highlight the trojan in the running process list e.g. MacDefender, MacSecurity, MacProtector, MacGuard and select the Quit Process button.
- Quit Activity Monitor.
- Open the Applications folder and locate the trojan application e.g. MacDefender, MacProtector, MacSecurity, MacGuard etc
- Drag the trojan application to the trash.
- Check also for the presence of an application called avRunner or mdDownloader. If either of these files are present then drag them to the Trash too.
- Empty trash.
The trojan will also install an entry in the users login items in ~/Library/Preferences/loginwindow.plist to ensure that it automatically runs on startup. This can be tidied up by:
- Opening System Preferences, selecting Accounts and choosing the Login Items tab
- Highlight the trojan in the item list and click the minus button.
To prevent any further downloads from being opened automatically disable the ‘Open “safe”files after downloading’ option in the General Safari preferences. Note, this will affect all downloads not just trojans!
