killpanda
wants to fondle your manboobs
The latest MacDefender variants require nearly no user intervention/authentication to install, it's literally a drive by thing.
One does have to step through the installer though....so in theory one could cancel if the buttons in the installer UI weren't swapped or all mapped to "next". One could Force Quit it too I guess
MacDefender is apparently dead, it was a company in Russia and most of their people are now under arrest :-d Well, that's if you actually believe the Russian police and press of course.
Some schools use Cisco Clean Access Agent: http://en.wikipedia.org/wiki/Cisco_NAC_Appliance#Clean_Access_Agent to verify that the system's in compliance with their security policy (AV, Windows/OS X patches up to date, firewall status, etc.) before letting them have full network and internet access. If he removes it, he could lose connectivity until he re installs it and re validates his system.
Well, that sucks.