Welcome Guest (Log In | Create Account)
New Member? Join for free.

Remove Mac Shield (Uninstall Guide)

By on June 2, 2011 @ 11:12 AM | Read 50,071 times.
  • Print this page

Mac Shield is a fake rogue anti-spyware program that for the Mac OS operating system from the same family as Mac Guard. This infection is spread through spam, hacked sites that have poisoned the search results for image search engines such as Google Images, and hacked sites that infect you when you visit them. When you click on images belonging to the hacked sites, you will automatically be redirected to a page that shows an advertisement that pretends to be a fake online scanner. When these fake scans are finished, it will state that your computer is infected and then automatically download the Mac Shield program onto your computer. Once the program has finished downloading, the installer will start and prompt you to install the program.

Once the program is installed it will be configured to start up automatically when you login to your Mac. Once running it will pretend to scan your computer and then state that there are numerous files on your computer that are infected. If you attempt to clean these fake infections, though, the program will state that you must first purchase a license before it will allow you to do so. After the scan, the Control Center screen for Mac Shield will be updated to state that your computer is infected and at Risk. Regardless of the information presented by this program, you should not purchase this program as all of this information is false.

Unfortunately, when MacShield is installed on your computer it will also be added to your accounts Login Items so that the program is launched every time you login to your Mac. As there is no Dock icon for this application, it is also not easily closed and will instead require you to terminate its process through the Activity Monitor before you are able to remove the application from your computer.

 

Mac Shield screen shot
Mac Shield screen shot
For more screen shots of this infection click on the image above.
There are a total of 6 images you can view.

 

While the program is running it will also display fake security alerts that are further used to scare you into thinking that your computer has a serious problem. Some of these alerts include:

The system is infected
Your system is infected. It's highly recommended to cleanup your system to protect critical information like credit card numbers, etc.

Unregistered Copy
Sorry, the copy of your program is unregistered. Register to have an ability to cleanup your system.

Virus Found
Infected file detected:
Virus: Malware
File: SelfTest.dist

Virus Found
Infected file detected:
Virus: Spyware
File: Terminal

Just like the fake scan results, these alerts are also fake and are only being used to scare you into purchasing the program. Therefore, please ignore them and do not purchase the program. Last, but not least, while the program is running it will also open up Safari and display various pornographic sites. These sites include gay.porn.com, buy-viagra-now.net, fitish.com, www.gay.com, www.porn.com, and www.freebdsmgalleries.com.

As you can see, MacShield was created to scare you into thinking your computer has a severe security problem so that you will then purchase this program. For no reason should you purchase Mac Shield , and if you already have, you should contact your credit card company and dispute the charges stating that the program is a computer infection. Finally, to remove this infection, and any related malware, please use the removal guide below.

 

Threat Classification:

 

Advanced information:

View Mac Shield files.

 

Tools Needed for this fix:

 

Guide Updates:

06/02/11 - Initial guide creation.

 


Choose the removal method you would like to use:


Automated Removal Instructions for Mac Shield using the Mac Rogue Remover Tool:

 

  1. Print out these instructions so it will be easier to reference it as you follow these steps.

  2. As Mac Shield will stay on top of any other programs that are running, we first want to close the program so that we can see the other screens that we need to open during this cleaning process. Please close this window by clicking on the red close (X) button in the top left of the Mac Shield Windows. The button that you need to click in order to close the window is shown below:


    Mac Shield Start Screen


  3. Next you should open Safari, or other web browser, and download the BleepingComputer Mac Rogue Remover Tool from the following link:

    Mac Rogue Remover Tool Download Link (http://download.bleepingcomputer.com/mac-rogue-remover-tool/mac-rogue-remover.zip)


  4. Once the program has finished downloading, open up the folder that you downloaded the program to. If you have Open "safe" files after downloading enabled in Safari, then the application will automatically have been extracted. Otherwise double-click on the mac-rogue-remover.zip file to extract it. Once it is extracted you should see an icon similar to the one below in your folder.



    Mac Rogue Remover Icon


  5. Please double-click on the mac-rogue-remover icon to start the program. Mac OS will now prompt you as to whether or not you wish to run the program.




    Open Program Confirmation


    Please press the Open button to run the program.


  6. Mac Rogue Remover will now start and you will see a message box that displays the End User License Agreement for this program. If you agree to this EULA, click on the I Agree button to start the program. Otherwise, click on the Cancel button to not use Mac Rogue Remover.


  7. If you agreed to the license agreement, Mac Rogue Remover will start to scan your computer for the MacShield infection. When it has finished it will display another message stating what it has found and removed. You can press the OK button to close the program. While Mac Rogue Remover was running it also created a file on your Mac OS desktop called mac-rogue-remover.txt that contains a log of what the program removed from your computer. Please review this file as if it found that MacShield was installed under a different user account, it will prompt you to run Mac Rogue Remover while logged in as that account to completely remove the infection.

    When using Mac Rogue Remover, if you have any questions on how to use it or would just like to tell us how the program worked, please leave a post in this topic:

    Introducing the BleepingComputer Mac Rogue Remover Tool


  8. Now that Mac Shield has been removed, we need to change a setting in Safari so that these types of programs are not automatically run on your computer in the future. By default Safari opens and launches programs that it considers safe to run. These programs include movies, pictures, sounds, PDFs, text documents, archives, and disk images. Due to this, these types of infections are able to be downloaded and automatically run on your Mac. To fix this, start the Safari program and then click on the Safari menu option. From the Safari drop down menu, select Preferences. This will open the Preferences screen as shown below. When the screen opens, if you are not on the General settings screen, please click on the General button.


    Safari Preferences screen


    You should now uncheck the checkbox labeled Open "safe" files after downloading as shown in the image above. After unchecking this box you can close the Preferences screen and Safari.


Your computer should now be free of the MacShield program and Safari should be secure so that it does not automatically launch these types of programs again in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

 


Manual Removal Instructions for Mac Shield:

 

  1. Print out these instructions so it will be easier to reference it as you follow these steps.

  2. As Mac Shield will stay on top of any other programs that are running, we first want to close the program so that we can see the other screens that we need to open during this cleaning process. Please close this window by clicking on the red close (X) button in the top left of the Mac Shield Windows. The button that you need to click in order to close the window is shown below:


    Mac Shield Start Screen


  3. Next you should click on empty portion of your desktop so that the Finder is selected. Once it is selected, click on the Go button and select Utilities as shown in the image below.


    Mac OS Go Menu


  4. The Utilities folder should now appear as shown in the image below.


    Mac OS Utilities Folder


    Locate the Activity Monitor icon and double-click on it.

  5. The Activity Monitor should now be displayed on your screen. This program lists all the processes that are currently running on your Mac OS and allows us to terminate specific programs that may be running. Scroll through the list of processes and left click on the process named MacShield as shown in the image below.


    Mac Shield process in Activity Monitor


    Once the process is selected click on the Quit Process button. When a prompt appears asking if you are sure you want to quit the MacShield process, please click on the Force Quit button. When you have finished, Mac Shield should no longer be running on your Mac and you can now close the Activity Monitor and the Utilities window.


  6. While still at the Finder, click on the Go button and select the Applications menu option. When the Applications folder is displayed, scroll through the list of programs until you see a program named MacShield. When you find the program, right-click on it and select the Move to Trash menu option. If MacOS prompts you for your password, please enter it. The MacShield application will now be removed from the operating system.


  7. Now click on the Apple Menu (Apple Menu) and select the System Preferences menu option. When the System Preferences screen opens, select the Accounts option under the System category. When the Accounts screen opens, click on the Login Items button. This will open a screen, similar to the one below, that displays a list of programs that will automatically start for this particular user when they login to the operating system.


    Account Login Items


    Look through the list of programs that are starting automatically, and single click on the entry named MacShield. Once it is selected, click on the minus (-) sign button, as indicated by the red arrow in the image above. Once you click on the minus button the Mac Shield entry will be removed and MacOS will no longer attempt to start it when you login.


  8. Now that Mac Shield is no longer running, we need to change a setting in Safari so that these types of programs are not automatically run on your computer in the future. By default Safari opens and launches programs that it considers safe to run. These programs include movies, pictures, sounds, PDFs, text documents, archives, and disk images. Due to this, these types of infections are able to be downloaded and automatically run on your Mac. To fix this, start the Safari program and then click on the Safari menu option. From the Safari drop down menu, select Preferences. This will open the Preferences screen as shown below. When the screen opens, if you are not on the General settings screen, please click on the General button.


    Safari Preferences screen


    You should now uncheck the checkbox labeled Open "safe" files after downloading as shown in the image above. After unchecking this box you can close the Preferences screen and Safari.


Your computer should now be free of the MacShield program and Safari should be secure so that it does not automatically launch these types of programs again in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

 


 

Associated Mac Shield Files:

./MacShield.app
./MacShield.app/Contents
./MacShield.app/Contents/Info.plist
./MacShield.app/Contents/MacOS
./MacShield.app/Contents/MacOS/MacShield
./MacShield.app/Contents/PkgInfo
./MacShield.app/Contents/Resources
./MacShield.app/Contents/Resources/About-Back.png
./MacShield.app/Contents/Resources/About-Mail.png
./MacShield.app/Contents/Resources/About-Phone32x32.png
./MacShield.app/Contents/Resources/About-Ticket.png
./MacShield.app/Contents/Resources/AboutD.nib
./MacShield.app/Contents/Resources/AboutMBMI.png
./MacShield.app/Contents/Resources/CC-Back.png
./MacShield.app/Contents/Resources/CC-BigOptions.png
./MacShield.app/Contents/Resources/CC-BigOptionsHover.png
./MacShield.app/Contents/Resources/CC-BigOptionsPressed.png
./MacShield.app/Contents/Resources/CC-BigScan.png
... <numerous other media and image files>

 


 

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus, Trojan, Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.


Advertise   |   About Us   |   User Agreement   |   Privacy Policy   |   Contact Us   |   Sitemap   |   Chat   |   Tutorials   |   Uninstall List
Tech Support Forums   |   The Computer Glossary   |   RSS Feeds   |   Startups   |   The File Database   |   Virus Removal Guides   |   Downloads


© 2003-2014 All Rights Reserved Bleeping Computer LLC.
Site Changelog