Using Sophos Anti-Virus for Mac to Remove MacDefender

posted in: Sage Advice | 0

This is what worked for me, step by step, to remove the MacDefender using Sophos Anti-Virus for Mac Home (which is free):

The 3 threats found after my first full scan on my Macbook were
which needed to be cleaned up manually.

  1. In the Quarantine Manager, click on the blue link file name of the threat to get it’s details.
  2. You need to note the path & file name.
  3. In my example I will use users/myname/library/cache/java……
  4. You will need to make a custom scan.
  5. In the window that’s titled Scan Local Drives, click on the arrow next to Custom Scans
  6. Click on the + sign.  You will see a message untitled – No items in scan, this scan has never been run.
  7. Double click on it and another window will open asking for a Scan Name (can fill in later).  At the bottom of this window, click the + sign – this will open a finder window called Open.
  8. Double click on the file called Users (another window opens)
  9. Double click on the home file with your name on it (another window opens)
  10. Double click on the Library folder (another window opens)
  11. Single click on the Caches folder and then click on the Open button bottom right
  12. You should now see the folder Caches with a tick next to it in the window described in step 3.
  13. Type in whatever name you want to call the custom scan.  I called mine Caches.
  14. Under the title you’ve just typed are 3 buttons. Click on the Options button.
  15. Click on the drop down menu where it says log only and choose Delete threat.  So it now says When a threat is found: Delete threat.
  16. Click on the Done button.
  17. In the customs scan window from step 1. you should see a new custom scan called Caches (or whatever you named it).  Click on the Play button next to the pencil button.
  18. A drop down dialogue box asks you to Scan with privileges, Cancel or Scan All.
  19. Click on the Scan All button & type in your administrator password & click OK.
  20. The scan is performed.  If you Open Quarantine Manager, the threats should be gone.

Leave a Reply