Viruses On Os X

Virus on MAC?? A time ago I had a strange problem with my new Powerbook G 4: after starting up a while and working 5 minutes, there came a strange sound from the loudspeaker like fried eggs- and then strange sounds from interior relais and the computer broke down. After restart, the HDD was not recognized. I heard, that "viruses" exist on PC machines, causing the same problem. We also thought it was a thermal breakdown. It was resolved by the LIMA Mac Service by reinstalling the OS X and we had no problems- only with Final Cut Express that crashes constantly with this MAC.
 
Definitely sounds rather like a hardware problem than a virus-related one, inibico.
 
sourcehound said:
ClamAVX is a good open-source alternative, but as it only identifies which files are infected, it's not very useful. ***Sigh***
Click to expand...
ClamXav is a little less than "not very useful" in my estimation.

ClamXav is an OS X port of ClamAV, which is a UNIX server anti-virus application for use with Windows networks. The problem is that ClamXav uses ClamAV's anti-viral database, with no additions in consideration of the Macintosh.
You can search the ClamAV database here:
http://clamav-du.securesites.net/cgi-bin/clamgrok
As a test, do a search for, for instance, "Macintosh", or "Opener", or "Renepo" and see if anything shows up.
What this means is that ClamXav doesn't look for anything that is Macintosh-only, or even anything just because it is Macintosh-related.

In addition, if a Macintosh-only virus were to appear in the wild, there is no indication that the ClamAV database would be updated to deal with it. As far as I can tell, no one is writing and adding virus definitions to the ClamAV database for Macintosh malware. (The developer of ClamXav has admitted that not only has he not contributed any such definitions, but that he doesn't know how to write such definitions.) In other words, ClamXav is practically worthless for use with the Macintosh, and worse, I fear that it lulls Mac users into a false sense that it is protecting them, when in fact it doesn't protect them from much at all. (It does provide protection from cross-platform Word and Excel macro viruses.)

Since ClamXav does not scan for Macintosh-only viruses, if you use Classic, ClamXav does not protect you from any OS 9 viruses, which can also infect Classic. It also does not scan for the three known OS X Trojans in the wild, or the "Concept" Trojan (which is not a real, or malicious, Trojan, but it does sort of provide a model for someone who wants to create one, so it would be nice if your anti-viral software identified derivatives of it.)

Also, ClamXav does not disinfect infected files and software. It can only flag such software for you. You then have to delete such software to be rid of the virus.

ClamXav also does not scan files interactively.

ClamXav *is* good at scanning for, and detecting Windows viruses on your Macintosh, but that is of questionable value, as these are harmless on the Mac, and they are easy to detect and just trash. (Usually they manifest themselves as gibberish e-mail attachments.) A Macintosh is highly unlikely to spread Windows viruses to Windows users, so software to detect Windows viruses resident on a Mac is of little value.

I simply don't see ClamXav as being a substitute for a commercial anti-virus program. (Assuming that you feel that you need one.)

The gentleman who has ported ClamAV to the Mac, and who is providing ClamXav for free, is to be commended for providing a free product to the Macintosh community. However, even though he does not disagree with any of what I have said above (this all came up on Macintouch), he also doesn't clearly state it on his Web site. So folks are lured into thinking that their Macs are completely protected, and will be in the future in the event of a very serious threat, when they aren't. That does the Macintosh community a very serious disservice.
 
I still don't see a NEED for ANY antivirus software on a Mac. It all comes down to why???

We didn't see antivirus software on Windows before there were any viruses, did we? The lame excuse that Mac users should "avoid infecting Windows machines with Win viruses" is silly--Windows machines (should) have their OWN AV software. The ONLY reason people are buying and installing this garbage is because of widespread ignorance. And rigid thinking.

I'll install antivirus software when there is an actual problem.

A few notes:

1. Did you notice Secunia's report of an "extremely critical" vulnerability in Norton's AV? On both platforms! I haven't read the report yet, but it sounds like a good reason NOT to install useless software.

2. I also read today that someone is coming out with ant-spyware software for the Mac. On their page where they list the threats, it lists . . . NONE. It says something like "To be updated after the beta test." Sounds like they're stalling for time.

In fairness, I did find ONE piece of commercial spyware, a keystroke logger, for OS X. So, I suppose if you have reason to believe someone with admin privileges has installed a keystroke logger, you might need anti-spyware software.

But, come on. Symmantec et al are making money on ignorance.

Doug
 
dktrickey said:
I still don't see a NEED for ANY antivirus software on a Mac. It all comes down to why???
Click to expand...
Most Mac users do without anti-virus software, and for most users that is what I would recommend. However, the threat from Macintosh malware is not zero. And users who use their Macs in a business context may prefer to be protected from a threat that is currently miniscule, or from a future threat. (A good anti-virus program can recognize virus-like activity and block it.)

There are *zero* viruses that can infect OS X itself. There is no
spyware that can be installed remotely on a Mac running OS X. There is
no adware that works by being resident on a Mac running OS X.

However, there *is* some malware that targets the Mac. There are hundreds
of Word and Excel macro viruses that are cross-platform, some of which are very seriously malicious. (While you can block these in Word and Excel by setting "Macro Virus Protection", this feature doesn't tell you whether a macro virus is legitimate or malicious...a problem if you frequently receive Office documents with legitmate macros). There are two
or three Trojans, though they are very rare (because they are not
self-propogating),

http://www.sophos.com/virusinfo/analyses/maccowhanda.html
http://www.macintouch.com/opener02.html
http://securityresponse.symantec.com/avcenter/venc/data/macos.mw2004.trojan.htm
http://www.macworld.co.uk/news/index.cfm?NewsID=8406
http://www.intego.com/news/pr41.asp
http://www.securityfocus.com/archive/1/395107/2005-04-03/2005-04-09/0

and the handful of viruses that could infect OS 8/9
can still infect Classic running under OS X, but they have become very
rare also, and are mostly non-malicious.

Note that Apple's security updates have never included anti-virus abilities.

Also note that in some business contexts, not having anti-virus software is considered to be below minimal standards of due care. If a malicious virus were to hit, your liability exposure could be huge. Good anti-virus programs have an auto-update feature, and registered users will be protected as soon as a new virus is identified, not after a number of folks have been infected.

About a year ago I tested all of the then-available popular anti-virus software programs, and I found Intego's Virus Barrier to be far superior to all of the others. It extracts no performance penalty, it never makes your mac unstable, and it never interrupts your work with a virus scan. It is entirely seamless.

There is an extended discussion about the need for Macintosh anti-virus software at:

http://db.tidbits.com/getbits.acgi?tlkthrd=2795
http://emperor.tidbits.com/TidBITS/Talk/640/
 
dktrickey said:
1. Did you notice Secunia's report of an "extremely critical" vulnerability in Norton's AV? On both platforms! I haven't read the report yet, but it sounds like a good reason NOT to install useless software.
Click to expand...

It certainly is a reason to avoid Symantec Norton products. But I think that anyone who has been frequenting Macintosh discussion lists already knows that.

dktrickey said:
2. I also read today that someone is coming out with ant-spyware software for the Mac.
Click to expand...

There are already several anti-spyware programs for the Macintosh:

Little Snitch
http://www.obdev.at/products/littlesnitch/

MacScan
http://macscan.securemac.com/

Internet Cleanup
http://www.allume.com/mac/cleanup/index.html

dktrickey said:
On their page where they list the threats, it lists . . . NONE. It says something like "To be updated after the beta test." Sounds like they're stalling for time....

In fairness, I did find ONE piece of commercial spyware, a keystroke logger, for OS X. So, I suppose if you have reason to believe someone with admin privileges has installed a keystroke logger, you might need anti-spyware software.
Click to expand...
I know of about four spyware programs for the Macintosh. They are all quite effective, but none of them can be installed without administrative priviledges. However, it isn't very hard to get around that.

I'd give you a list of the spyware that is available, and where to find it, but for obvious reasons I don't think that is a good idea.

One of the legitimate Trojans for OS X attempts to install spyware. No one knows yet if it is capable of doing so successfully. But we do know that there are folks trying to make it work.

dktrickey said:
But, come on. Symmantec et al are making money on ignorance.
Click to expand...
No they aren't. If you work for the government, there are government standards that require that users have anti-virus software installed. If you are using your Mac in a business context, as a business practice you have to protect your data from any threat, no matter how small, or any potential threat that that might develop in the future. If you are a professional you are required to take all reasonable steps to protect client records and information. The threat right now may be miniscule, so small that home users don't even need to think about it, but business users don't have that choice.

By and large anti-virus software companys do an excellent job. Peruse one of their sites and check out the meticulously maintained virus tracking archives they have. Note how quickly they have consistently identified every new threat. This isn't easy to do. These folks aren't fly-by-nights who have just cobbled something together. A ton of work goes into their products. Every one of their products aren't as good as each other, but that's why competition is a good thing.
 
I think your argument is sound, in theory. Certainly installing a decent Mac antivirus app would allow a business to be ready for a future virus threat. At that point, an update would be all they would need to do to protect their Macs.

Now that I think about it, I wouldn't laugh at someone for taking such preventative measures in a business or academic setting, since there is a (very small) chance that installing the antivirus software would protect the business from the first Mac virus or worm.

In practice, though, the risks/reward considerations are not that clear-cut.

A couple points:

--Antivirus software companies _have not_ had an incredible amount of success with predictive algorithms. I imagine they're getting better, but I wouldn't count on my antivir software protecting me from an unknown threat before that first update.

--The first Mac virus/worm (I'll just write "virus" from now on) will likely be the ONLY Mac virus for awhile and will spread rather slowly. This will give Mac users plenty of time to install suddenly-useful antivirus apps. Even in settings with lots of machines.

--_Any_ software has the potential to destabilize the machine (cf. Symmantec. In fact, I think "Symmantic" is a synonym for "destabilize"). And installing software that doesn't (yet) do anything . . . Does it make sense?

--Four + years of OS X, zero viruses. I know, I know. They're coming. Any day now. Any day now.

--Opener requires root. The "fake iTunes file" malicious app [Edit: called MP3 Concept] is a trojan but is not in the wild. And there's now a certain amount of protection built into the OS to protect against apps masquerading as files.

--You said you could list the spyware that's out there but don't want to for security purposes. Tell us how many confirmed apps you know of. I know of one commercial keystroke logger. That's it. I'd be surprised if you could round the number of confirmed apps to anything other than 0.

-----
BTW, I forgot about Allume's Internet Cleanup. I wonder what exactly it cleaned up when it first came out? Cookies? Oh boy! $30 for that? Does it actually search for the known keystroke logger? I'd hope so.

Little Snitch seems cool. It's not exactly an antispyware app. It's an enhanced firewall. Of course, spyware would likely "phone home" and be caught by L.S. I know what you meant.

The antispyware I read about today was Mac Scan. As I said, according to their website, it's actually effective against . . . um, they didn't say. They'll let us know later. Any day now.


Doug
 
Please go back and read what I said very carefully. I said that I don't recommend anti-virus software for most users, but many business users have no choice, they *have* to have anti-virus software for business reasons. I also said that the malware threat to OS X is miniscule, but it is not zero. That's true, no matter how you spin it.

You could end up just as unhappy if you open a Word document with a malicious macro virus, or if you get a malicious OS 9 virus in Classic, as you would be if there was an OS X-specific virus and you were infected by it. Its true that it is easy to avoid both occurances, but that doesn't mean that they don't exist, or that they aren't a potential threat.

dktrickey said:
--You said you could list the spyware that's out there but don't want to for security purposes. Tell us how many confirmed apps you know of. I know of one commercial keystroke logger. That's it. I'd be surprised if you could round the number of confirmed apps to anything other than 0.
Click to expand...
I know of three very serious spyware applications for the Macintosh. However, as I said, none of them can be installed via the Web or via e-mail. At least not yet.

However, of much greater interest is the fact that these spyware apps are the product of active hacker groups devoted to hacking the Macintosh (you can easily find their Web sites by doing a Web search) who are trying very hard to perfect their spyware applications. Sort of like an open source community, but with nefarious goals instead of noble ones. That fact alone means that, at some point, there will be a very serious threat to the Mac.

dktrickey said:
Little Snitch seems cool. It's not exactly an antispyware app. It's an enhanced firewall. Of course, spyware would likely "phone home" and be caught by L.S. I know what you meant.
Click to expand...
Little Snitch is a "reverse firewall." That is, it keeps programs on your Mac from contacting the outside world without your permission. How important that is to you depends on how paranoid you are. Lots of applications, even those from big respected companies, phone home and send who knows what information back to the mothership. The recent Sony CD debacle shows that even huge respected companies are willing to put malicious software on your computer. Are you concerned about what information Microsoft Office may be sending back to Microsoft about you? I'm not, but a good number of folks aren't at all happy about applications that phone home.

Of more interest is the fact that software connecting to the Internet in the background puts a substantial hit on CPU use. Is your Mac significantly slower than it was when new? It may be that several very common applications accessing the Internet for "legitimate" reasons in the background are slowing your Mac down substantially. Little Snitch can prevent them from doing this.

Speaking of slowing your Mac down, the argument that anti-virus software always makes your Mac slower and/or that it makes your Mac unstable is an uninformed one. Try VirusBarrier and tell me if you notice a slowdown or instability caused by it. (If you do, I won't believe you. ;) I tested all of the major anti-virus programs personally.) That is what competition in the marketplace is all about, and why its good that there are a bunch of anti-virus apps for the Mac to choose from. And why it is good to have someone like me to test them all for you and tell you which one is best. ;)
 
I don't really see much that we disagree about. As I wrote before, your first (I think) message got me thinking about what I would do were I in charge of a Mac business / gov / ed installation. I might be concerned about Word viruses at this point. Less so about spyware that requires root. Why, though, does David Pogue write that Word macro viruses don't work properly in OS X? He effectively dismisses them as nothing to worry about in Mac OS X: The Missing Manual (Tiger edition).

I didn't suggest that "anti-virus software _always_ makes your Mac slower . . . and / or unstable." I wrote that any software ***has the potential*** to do so. I'm glad to hear VirusBarrier is reliable and efficient. I'll keep that in mind when I'm shopping for Mac antivirus software. In 2009. ;)

I'm also familiar with "reverse firewalls." I didn't know until recently that that's what people were calling them. Any Windows firewall worth anything polices outgoing traffic thanks in part to Steve Gibson (www.grc.com). I followed along on his site as he showed how the free Zone Alarm initially put the (commercial) Norton Personal Firewall to shame because Zone Alarm had "reverse firewall" capabilities and Norton initially didn't.

We do appreciate the work you and others have done writing about OS X. I've heard good things about The Macintosh Bible.

Doug

Incidentally, a recommendation for anyone interested and concerned about computer security, check out Steve Gibson and Leo Laporte's podcast "Security Now!" (available at twit.tv or on Steve's website above). It can get a bit technical but still very interesting. I also highly recommend "This Week In Tech" a more general tech news podcast with some of the former TechTV people.
 
dktrickey said:
Why, though, does David Pogue write that Word macro viruses don't work properly in OS X? He effectively dismisses them as nothing to worry about in Mac OS X: The Missing Manual (Tiger edition).
Click to expand...
I can't find that in his book. What page is it on?

It's hard to believe that is true. If Word macro viruses don't work in OS X, then one would have to assume that all Word macros don't work properly in OS X, which I know isn't true.

Or you may read about the "Macro Virus Protection" feature in Word. Which stops *all* macros from running. That's great, unless you are someone who needs to run macros in documents sent to you. The "Macro Virus Protection" feature in Word doesn't tell you if a macro is malicious or legitimate. Only a good commercial anti-virus program can tell you if an embedded macro is malicious or legitimate, and can strip out a malicious macro and leave the underlying document intact.
 
You know, I was idly leafing through the book at Barnes & Noble. I bought the 10.1 version (of the Missing Manual) back in 2001 when I got my first Mac. I was impressed at the time by the book's clarity and details and Pogue's excellent style.

So . . . anyway, I don't know what page it's on. It specifically said something to the effect that "Word macro viruses don't work properly in OS X." Looks like he is mistaken.

Doug
 
dktrickey said:
So . . . anyway, I don't know what page it's on. It specifically said something to the effect that "Word macro viruses don't work properly in OS X." Looks like he is mistaken.
Click to expand...
Or you were mistaken that he said that. I have the Tiger Edition of his book right here, and I can't find anywhere in the book that he says anything like that.

Which doesn't surprise me, because its not true. Cross platform Word macro viruses (unfortunately) run just fine in OS X.
 
Well, it said _Mac OS X: The Missing Manual (Tiger edition)._ It's possible, though highly unlikely that ANOTHER David Pogue wrote an identically titled book with different information.

Just like it's possible, though unlikely, that I read it wrong. I'm pretty sure about what it said. And it's a big book. Look again. ;) I don't have that luxury. I'm not about to go out and buy it.


Doug
 
dktrickey said:
Well, it said _Mac OS X: The Missing Manual (Tiger edition)._ It's possible, though highly unlikely that ANOTHER David Pogue wrote an identically titled book with different information.

Just like it's possible, though unlikely, that I read it wrong. I'm pretty sure about what it said. And it's a big book. Look again. ;) I don't have that luxury. I'm not about to go out and buy it.
Click to expand...
I just checked again in Mac OS X The Missing Manual Tiger Edition. It doesn't say that in the indexed section that deals with "viruses" and it doesn't say that in the indexed section that deals with "Microsoft Word."

I can't find it anywhere else in the book. I'm sure that it doesn't say it, because it isn't true. Visit your favorite virus reporting site and you will see that Word macro viruses run perfectly well under OS X.

However, I just had a look at the Panther Edition of TMM, and it says this on page 694:

"You still need to be careful with Word and Excel macro viruses, of course."

I don't think that it is Pogue who is mistaken.
 
Jeez, Randy. You have the book in front of you. I don't. I don't really know. You're going to goad me into going over to B&N and looking it up, aren't you? Well, maybe I will. After all, I have no life. ;)

Doug
 
I have been looking at the previous posts in this thread to bring myself up to date with the virus/spyware issues. To give you a brief background -- I have been trying to convince a friend, who is a professional counsellor with sensitive client files on her system, to use an AV app. The response I get continually is the ever common -- "I don't need AV protection -- I own a Mac". Recently, she has mentioned that she has noticed other applications launching by themselves and is also having some slowdown issues. Could this be the MP3Trojan I have read about?

Also, regarding spyware, I use a small Freeware calendar app called PandoCalendar. Some time ago I was at a website that advertises workshops. Several days after visiting this site I discovered their Workshops had been planted in my calendar app -- and I guarantee you -- I did not put them in there myself. Would you consider this a spyware? or what? And can you suggest an application to scan my system -- ie. will VirusBarrier pick this up?

Both systems I have mentioned are running Panther.

I am very much looking forward to responses on this.

Thanks

Aidren
 
aidren said:
I have been looking at the previous posts in this thread to bring myself up to date with the virus/spyware issues. To give you a brief background -- I have been trying to convince a friend, who is a professional counsellor with sensitive client files on her system, to use an AV app. The response I get continually is the ever common -- "I don't need AV protection -- I own a Mac".
Click to expand...

You should better inform her. Not having AV software on her machine could be a big deal if one day she finds that those client files are gone (for any reason.) Not having AV software installed could be considered de facto professional negligence in any subsequent disaplinary hearing or court action regarding the loss of client files.

aidren said:
Recently, she has mentioned that she has noticed other applications launching by themselves and is also having some slowdown issues. Could this be the MP3Trojan I have read about?
Click to expand...

The MP3 Trojan was a "concept" Trojan. That is, it didn't do anything malicious, it was just created to show that it could be done.

There are a couple of other Trojan's out there for OS X, but unless she has been downloading files from file sharing services, or someone has purposely given her a Trojan, it is highly unlikely that she has one.

On the other hand, files launching themselves is very unusual, and I don't have any theories for what would cause that to happen.

aidren said:
Also, regarding spyware, I use a small Freeware calendar app called PandoCalendar. Some time ago I was at a website that advertises workshops. Several days after visiting this site I discovered their Workshops had been planted in my calendar app -- and I guarantee you -- I did not put them in there myself. Would you consider this a spyware? or what?
Click to expand...
If you have encountered spyware that can install itself via a Web site, then, as far as I know, you are the first OS X user to encounter such a thing. I know of spyware for OS X, but none that can install itself via the Web or via e-mail.

However, once again, I have no theory on how such a thing got into your calendar. You may want to contact one or more of the virus tracking companies and consult with them about this.

McAfee: http://vil.mcafee.com/
Symantec: http://www.symantec.com/avcenter/
F-Secure: http://www.f-secure.com/virus-info/

You may also want to contact the developers of Pando Calendar and get their take on this. They may have seen this before, or they may know whether or not it is at all possible.

aidren said:
And can you suggest an application to scan my system -- ie. will VirusBarrier pick this up?
Click to expand...
VirusBarrier should pick up any and all known malware that might exist on your Mac. However, if you have something new, until you, or someone else, reports it to one or more of the virus tracking agencies, and it is tracked down and analyzed, nothing will scan for it.
 
Hello everyone, and here is my problem: Lately my mac G5 dual with Mac OSX when I connect to internet after 5-10 minutes nothing seems to work OK.
I cannot open Final Cut or my Photoshop not even safari. Everything stacks.
I belive it might be a virus but I 'm not sure. Any ideas?

Panagiotis
 
You must log in or register to reply here.
Back
Top