Viruses On Os X

[lenco12]

...it should be noted that any Windows virii/spyware that you get in VirtualPC will be limited to the VirtualPC operating system, and cannot, in any way, damage or affect your Mac OS X system. At the worst, your Virtual OS will be kaput and will have to be deleted and re-installed, but OS X and your hardware will be absolutely fine.

The virus can also attack any file that can be accessed from the VPC environment, and this can be your whole Mac if you open it to VPC. Of course the virus will not reproduce on MacOS, but it still can delete files.

Another "agonstic" virus type is made of the M$ Office macro viruses. These are based on Office and not on the underlying OS.

_________________

 

[Randy Singer]

On Sep 16, 2010, at 6:47 AM, macosx.com wrote:

>>Another "agonstic" virus type is made of the M$ Office macro viruses.
>>These are based on Office and not on the underlying OS.

Microsoft macro viruses are dead easy to avoid. One just has to turn on "Macro Virus Protection" in Word and Excel.

If you have Office 2008 you don't even have to do that. Since that version of Office doesn't include Visual Basic, it can't run Visual Basic macros.

More information:
http://kb.iu.edu/data/agzk.html

Also, there are perfectly good versions of Word and Excel for the Macintosh. There is little to no reason to run them on your Macintosh under Windows.
http://www.mactopia.com

 

[Rhisiart]

Do I need anti-virus software on my Mac OS?

I am a sober user of the Internet (no porn, bit-torrent, illegal software downloads etc).

P.S. I have anti-virus for Windows 7 when using Bootcamp.

I suppose I am looking for a simple No or Yes answer.

 

[ElDiabloConCaca]

No.

 

[Randy Singer]

Do I need anti-virus software on my Mac OS?

I am a sober user of the Internet (no porn, bit-torrent, illegal software downloads etc).

P.S. I have anti-virus for Windows 7 when using Bootcamp.

I suppose I am looking for a simple No or Yes answer.

The overwhelming majority of Macintosh users don't use anti-virus software.

Here is an excellent up to date Web site on the topic of Macintosh malware 
that you might find illuminating:

http://www.reedcorner.net/thomas/guides/macvirus/

...and an associated Macintosh Malware Catalog
http://www.reedcorner.net/thomas/guides/macvirus/malware_catalog.shtml

You will note that, in the* list of malware for the Mac, above, there are no actual "viruses" (malware that is self-replicating and/or self installing), and there are only a couple of threats that make it as high as achieving a "Low" risk rating.* Those risks are handled by anti-malware software that is included in OS X 10.6:
http://www.macworld.com/article/142457/2009/08/snowleopard_malware.html

Until there is a serious threat to the Macintosh, using anti-virus software is likely to be more problematic on your Macintosh than any malware you might come across. Your best defense for now is to have a good archival backup for your data.

 

[fryke]

... which is taken care of if you use TimeMachine.

 

[ElDiabloConCaca]

The Macarena virus never got past "proof of concept" stage and was first reported almost 4 years ago. In total, it affected less than 50 computers worldwide. It is not, nor will it be, a threat to OS X.

Not only that, but it is not a "very harmful Mac virus" -- Symantec lists it as having "low" damage level with "easy" containment and "easy" removal.

http://www.symantec.com/security_response/writeup.jsp?docid=2006-110217-1331-99

By the way, loved you on "Charles in Charge." Whatever happened to your sister?

 

[Dyldjian]

Hi, this might be a stupid question, but today when I switched on my mac (Leopard 10.5.8 Power Mac G5) a little partially transparent rectangle opened up with a big yellow triangle with an exlamation mark in it, and next to it it says, "Your Mac's disk space is being wasted by junk files. Clean your mac now!" with the option to "ignore", "Ok", or the little "X" in the corner.

Ive been a mac user for a couple of years now and never seen it before. Is this built into Leopard? or is it from another program, or malware? any ideas? just seems a little suspicious to me...

 

[Doctor X]

You know, I do not have an answer, but you may wish to open Activity and see what is running/what programs are running. Make a list. A proper Guru may then be able to tell you is something is running that should not be running. I am not aware of that at all, but I tended to keep my Mac clean

--J.D.

 

[Randy Singer]

Hi, this might be a stupid question, but today when I switched on my mac (Leopard 10.5.8 Power Mac G5) a little partially transparent rectangle opened up with a big yellow triangle with an exlamation mark in it, and next to it it says, "Your Mac's disk space is being wasted by junk files. Clean your mac now!" with the option to "ignore", "Ok", or the little "X" in the corner.

Ive been a mac user for a couple of years now and never seen it before. Is this built into Leopard? or is it from another program, or malware? any ideas? just seems a little suspicious to me...

I don't think that this is part of Leopard, and I don't think that it is malware. I think that it is a pop-up ad. And I'm willing to bet that you had a Web browser open. Correct?

To stop this from happening in the future, if you are using the Safari browser, do this:
In Safari:
Safari menu --> Block Pop-Up Windows (Make sure that it is checked.)

Here is a list of all of the malware for Mac OS X:
http://www.reedcorner.net/thomas/guides/macvirus/malware_catalog.shtml
You don't have anything there.

 

[Dyldjian]

Hi, no I didnt have a web browser opened, it appeared as soon as leopard loaded up. it looks nothing like a window. ive attached images of it, it changes slightly with a mouse rollover.

heres all my processes. Can anyone decipher this?

ID Process Name User CPU RSIZE VSIZE
0 kernel_task root 3.0 142.07 MB 1.12 GB
1 launchd root 0.0 584.00 KB 586.72 MB
12 kextd root 0.0 1.25 MB 586.16 MB
13 DirectoryService root 0.0 3.35 MB 588.79 MB
14 notifyd root 0.0 488.00 KB 586.14 MB
15 syslogd root 0.0 480.00 KB 587.21 MB
16 configd root 0.0 1.92 MB 587.69 MB
17 mDNSResponder _mdnsrespo 0.0 1.21 MB 587.47 MB
21 securityd root 0.0 1.72 MB 587.28 MB
22 distnoted daemon 0.0 760.00 KB 585.56 MB
26 coreservicesd root 0.0 13.05 MB 600.48 MB
27 diskarbitrationd root 0.0 1.00 MB 585.66 MB
43 ntpd root 0.0 868.00 KB 586.11 MB
44 usbmuxd _usbmuxd 0.0 1.43 MB 6.57 GB
45 update root 0.0 292.00 KB 585.54 MB
46 SystemStarter root 0.0 684.00 KB 585.58 MB
50 mds root 0.0 133.10 MB 830.30 MB
51 loginwindow apple 0.0 5.54 MB 679.15 MB
52 KernelEventAgent root 0.0 652.00 KB 585.65 MB
53 kdcmond root 0.0 996.00 KB 585.70 MB
55 hidd root 0.0 600.00 KB 586.09 MB
56 fseventsd root 0.0 1.65 MB 593.67 MB
58 dynamic_pager root 0.0 700.00 KB 585.58 MB
64 autofsd root 0.0 676.00 KB 585.59 MB
65 socketfilterfw root 0.0 1.56 MB 585.91 MB
66 WDDriveManagerSe root 0.0 976.00 KB 586.27 MB
71 krb5kdc root 0.0 1.38 MB 586.03 MB
74 WindowServer _windowser 24.5 79.12 MB 883.16 MB
79 launchd apple 0.0 544.00 KB 585.72 MB
91 HWPortCfg root 0.0 1.02 MB 586.59 MB
92 HWNetCfg root 0.0 1,020.00 KB 586.66 MB
93 EmagicA26A62mFW root 0.0 612.00 KB 586.96 MB
94 qmasterd root 0.0 4.02 MB 602.60 MB
101 qmasterd root 0.0 4.27 MB 602.67 MB
105 Helper apple 0.0 14.05 MB 727.71 MB
107 AirPort Base Station Agen apple 0.0 2.86 MB 700.08 MB
111 Spotlight apple 0.0 4.80 MB 672.80 MB
112 UserEventAgent apple 0.0 3.47 MB 592.58 MB
114 Dock apple 1.1 14.54 MB 723.83 MB
115 ATSServer apple 0.0 6.33 MB 644.90 MB
116 pboard apple 0.0 580.00 KB 586.59 MB
117 SystemUIServer apple 0.0 9.24 MB 733.54 MB
118 Finder apple 0.0 12.66 MB 743.85 MB
130 coreaudiod root 0.0 3.11 MB 590.05 MB
138 WDDriveManagerStatusMenu apple 0.1 9.88 MB 730.84 MB
139 iTunes Helper apple 0.0 2.29 MB 656.96 MB
141 RealPlayer Downloader Age apple 0.2 2.93 MB 667.98 MB
143 RPDLAgentHelperJ root 0.0 12.88 MB 598.78 MB
158 DashboardClient apple 0.0 16.53 MB 737.83 MB
159 DashboardClient apple 0.0 14.10 MB 719.82 MB
160 DashboardClient apple 0.0 12.17 MB 735.16 MB
168 Firefox apple 9.7 164.82 MB 955.38 MB
231 RealPlayer Downloader apple 1.1 17.19 MB 747.82 MB
425 mdworker apple 0.0 6.39 MB 652.21 MB
459 Photoshop apple 1.7 136.26 MB 1.03 GB
460 AdobeCrashDaemon apple 0.0 1.42 MB 586.61 MB
474 Activity Monitor apple 14.0 12.32 MB 753.50 MB
475 pmTool root 1.6 1.28 MB 595.66 MB
477 Stickies apple 0.0 6.86 MB 731.28 MB
481 AppleSpell.service apple 0.0 1.90 MB 601.67 MB
487 nmblookup apple 0.0 1,008.00 KB 19.54 MB

 

[Doctor X]

Not to appear a complete thickie, but if you have no browser open, why is Firefox running? Are you sure the program is not running and you just have windows closed/minimized?

--J.D.

 

[Dyldjian]

ok, firefox is running in that list because I was on this forum at the time.
this wierd junk files thing started as soon as my mac booted up, before I loaded firefox.

 

[ElDiabloConCaca]

Have you installed any software like MacKeeper, or any kind of useless "maintenance" software that claimed to "optimize," "speed up," "defragment," or "clean" your Mac?

 

[Dyldjian]

well, I think its pretty fair to say that I'm an idiot. yes macKeeper was installed, and yes that's exactly what it was. I just didn't think of it because it was installed weeks ago and only just started doing this yesterday. sorry for wasting everyones time.

 

[Satcomer]

Well SecureMac has is a warning called Boonana Trojan Horse
trojan.osx.boonana.a and then released a free removable tool called Boonana Trojan Horse Removable Tool.

I however have never heard of this in the wild.

 

[Randy Singer]

There is a new tool that allows anyone to easily hack into your Web accounts (e.g. Facebook) when you use an open Wi-Fi network, such as at Starbucks or an airport. It is called FireSheep. FireSheep is effective when you use your Macintosh, your iPhone, your iPad, or your iPod Touch:
<http://www.usaliveheadlines.com/1708/firesheep-allows-anyone-to-hack-facebook-twitter-over-wifi.htm>

There are two ways to deal with this. The first is to use a VPN (virtual private network). The second is to use a free Firefox add-on called BlackSheep to alert you to the presence of FireSheep. Here are two articles that will give you details on both:
http://mashable.com/tag/firesheep/


People using any browser are susceptible:
<http://dailyator.com/how-to-guard-yourself-and-your-mac-from-firesheep-and-wi-fi-snooping/74248/>
or
http://is.gd/gSOeN

How to protect yourself:
<http://www.tuaw.com/2010/10/26/how-to-guard-yourself-and-your-mac-from-firesheep-and-wi-fi-snoo/>
or
http://is.gd/gSOpH

 

[jenny433]

You may also considere this article about Mac security
http://www.informit.com/articles/article.asp?p=335882

You can get the same Windows viruses in VPC but I'd consider that a really rare occurence. For the useage that VPC gets, there's a lot less risk of infection. You don't normally use it all day surfing the net, checking email etc. The usual usage pattern of VPC is to run some niche program for a few hours at a time.

 

[Satcomer]

New MACDefender malware discovered for OS X

Also if you read the article MAC Defender Rogue Anti-Virus Analysis and Removal (even though they spelt Mac wrong!)

 

[Satcomer]

Yet another turn: Intego: New variant of Mac Trojan horse doesn't require a password.

To help protect your self to this Trojan run is to open Safari, then go to Safari's Preferences - General tab and uncheck the box for "Open Safe files after downloading ...". The Trojans exploit this box being checked.