Virus affecting OS X

[jamieboy]

Just saw on the Register that Sophos have warned about a virus affecting OS X - not sure if it's the first, but it's the first I've heard of.

Now, I keep all my PCs protected, but there's no AV at all on our iMac G5. What would the Apple users recommend?

A free one would be good, but a reliable one would be better.

[robbieduncan]

It's not a virus. It's a trojan. It relies on user stupidity to install. You have to download and double click on the file to run it. It does not attack a vulnrability in the OS. If you don't make a habit of downloading and double clicking on random stuff you will be fine.

[jamieboy]

You are absolutely correct, and you could argue that the same applies to most Windows malware as well.

And yet, the generic term for the software we use to detect / prevent them is anti-virus. So again, what anti-virus software would people recommend for OS X?

[mmm-five]

Can't recommend one as I've never used one on the Man in 17 years.

This one is cheap and open-source though - www.clamxav.com/

[Paul 2000]

I am running OSX Tiger and use Intego Virus Barrier X without any problems. If you are running Jaguar or Panther you can use Virex, although it is NOT compatible with Tiger. An alternative is the freeware (I think) ClamX which I'm pretty sure runs on all versions of OSX (best check before downloading though).

[Hirich]

Clamxav has been getting a lot of good press, not least because it is free, including the upadatable definitions list. Of course, it's never been really tested by a 'proper' virulent outbreak (ie how quickly would a new definition become available). It seems to do all things you would expect (updatabe, watch folder, etc.)

[jamieboy]

Cheers - I'll have a look at those three.

[neil_cardiff]

I've an awful lot of experience in managing NAI (McAfee Corp) products, and can vouch for the effectiveness of their Enterprise products.

They do one for OSX, and even PDA's!

Both of which do a cracking job.

They can also all be managed centrally via EPolicy which is THE best AV management system around.

Neil

[Hirich]

There's a good (if long) lowdown on this here:
www.macworld.com/news/2006/02/16/leapafaq/index.php?lsrc=mwrss

Bottom line is "don't automatically type in your admin password when you receive an iChat or email attachment". If you didn't already realise this, you should do the following:
- Go to the Apple menu, and select "Shutdown"
- Click on OK in the dialogue box.
- Once the machine has shot down, disconnect it from the mains and unplug all cables.
- Put all components back in the original boxes, and return it to the retailer, enclosing a note confirming that you clearly are too stupid to own a computer...

[r988]

The problem is, most people are pretty stupid

[klassiekerrally]

You are right:
'Most people' own ordinary PC's, not Macs. How stupid is that?

[zaktoo]

jamieboy said:

You are absolutely correct, and you could argue that the same applies to most Windows malware as well.

You could argue that, but you'd be quite wrong. Most MS Windows viruses replicate very handily without direct user intervention, as in without the user needing to double-click attachments or actually respond to a prompt.

This certainly is no virus, and it's replication is severely dependent on the stupidity of the intended victim. For my money, I wouldn't bother looking for AV products for OSX yet - spend the time & money in understanding why it's a bad idea to just run (or even double-click) attachemnts from untrusted sources; how to mitigate the potential damage if you really want to go ahead, and generally become more aware of what implications your actions have on your security. There is no software anywhere that will properly defend against malicios programs - I think that user education is a better long-term strategy than programmatical prophylactics.

Ciao

Zak

[jamieboy]

jamieboy said:

You are absolutely correct, and you could argue that the same applies to most Windows malware as well.

zaktoo said:

You could argue that, but you'd be quite wrong. Most MS Windows viruses replicate very handily without direct user intervention

I know you enjoy a good argument about definitions, Zak, but 'virus' does not equal 'malware', although I acknowledge that I initially said 'virus' when I should have said 'trojan', as did the report on the Register which has now been changed.

I'm fairly happy with my abilities to use the Internet safely, but I'm happier running AV software, in the same way as I'm happy with my ability to drive, but I still have insurance.

Anyway, the point of my post was to ask if anyone had recommendations for OS X anti-virus software, some people have taken the time to do that, and I thank them.

[neil_cardiff]

zaktoo said:

jamieboy said: You are absolutely correct, and you could argue that the same applies to most Windows malware as well. You could argue that, but you'd be quite wrong. Most MS Windows viruses replicate very handily without direct user intervention, as in without the user needing to double-click attachments or actually respond to a prompt. This certainly is no virus, and it's replication is severely dependent on the stupidity of the intended victim. For my money, I wouldn't bother looking for AV products for OSX yet - spend the time & money in understanding why it's a bad idea to just run (or even double-click) attachemnts from untrusted sources; how to mitigate the potential damage if you really want to go ahead, and generally become more aware of what implications your actions have on your security. There is no software anywhere that will properly defend against malicios programs - I think that user education is a better long-term strategy than programmatical prophylactics. Ciao Zak

Not wishing to reopen an old (and I'm not being personal herejust merely stating a fact) argument, but this is exactly what you were saying you didn't want to do yesterday? You've taken the time to understand and learn how to protect yourself regarding Vulnerabilites, so couldn't you accept you need to do the same regarding Spam?

Would have saved your blood pressure a bit perhaps?

Neil

[zaktoo]

neil_cardiff said:

Not wishing to reopen an old (and I'm not being personal herejust merely stating a fact) argument, but this is exactly what you were saying you didn't want to do yesterday? You've taken the time to understand and learn how to protect yourself regarding Vulnerabilites, so couldn't you accept you need to do the same regarding Spam? Would have saved your blood pressure a bit perhaps?

Your not closing a thread prematurely could have helped too. However, the concepts behind spam & viruses (and other malware) are quite astoundingly different. If i have to actually explain why they're different and should not be considered in the same context or have the same solutions, then sorry but you're not fit to argue over it with.

Ciao

Zak

[mefoster]

jamieboy said:

Anyway, the point of my post was to ask if anyone had recommendations for OS X anti-virus software, some people have taken the time to do that, and I thank them.

The answer to your question has really got to be, "Why?". What is it that you're trying to protect against? There are no viruses for the Mac and there is no AV software that will protect against malware preying on user stupidity.

If you are concerned about passing Word macro viruses on to your less enlightened Windows friends then by all means invest in something like Sophos Anti-Virus or another well known AV product. Other than that, for now at least, Macintosh AV products are a waste of money and the hype stirred up by AV vendors whenever something like this comes along is only intended to get you to part with your money.

I have been running Mac OS X without AV "protection" since it was first launched, I'm not about to start just yet... and I sleep just fine.

[zaktoo]

jamieboy said:

I know you enjoy a good argument about definitions, Zak, but 'virus' does not equal 'malware', although I acknowledge that I initially said 'virus' when I should have said 'trojan', as did the report on the Register which has now been changed.

The heading of this thread said "virus"; and certainly all viruses are malware - so I replied to your post in that context. However, most non-virus malware on MS Windows platforms does not require user intervention either, so I'm strugglin to fathom your point here.

jamieboy said:

I'm fairly happy with my abilities to use the Internet safely, but I'm happier running AV software, in the same way as I'm happy with my ability to drive, but I still have insurance.

Your choice. My suggestion was aimed at the request for AV for OSX specifically. For that platform I contend that AV is a waste of money and time and user education is a cheaper and more effective long-term strategy. If that isn't what you wanted to hear I'm sorry, but that is my considered opinion on this matter. Fo rdifferent platforms expect different answers, as they all have different weaknesses and associated problems.

jamieboy said:

Anyway, the point of my post was to ask if anyone had recommendations for OS X anti-virus software, some people have taken the time to do that, and I thank them.

I'm sorry that you chose to read my response as unhelpful - it was genuinely an attempt to present another option.

Ciao

Zak

[neil_cardiff]

zaktoo said:

neil_cardiff said: Not wishing to reopen an old (and I'm not being personal herejust merely stating a fact) argument, but this is exactly what you were saying you didn't want to do yesterday? You've taken the time to understand and learn how to protect yourself regarding Vulnerabilites, so couldn't you accept you need to do the same regarding Spam? Would have saved your blood pressure a bit perhaps? Your not closing a thread prematurely could have helped too. However, the concepts behind spam & viruses (and other malware) are quite astoundingly different. If i have to actually explain why they're different and should not be considered in the same context or have the same solutions, then sorry but you're not fit to argue over it with. Ciao Zak

I understand your point of view, but it was turning into a slanging match between people which is not on.

The ORIGNAL question was not being deiscussed hence I closed it, with Teds approval.

If you wish to start a new thread sensibly discussing Spam, it's whys and wherehows, be my guest, but please toe the line at being insulting (and this goes for everyone).

Lets get back to the original question shall we?

[neil_cardiff]

mefoster said:

jamieboy said: Anyway, the point of my post was to ask if anyone had recommendations for OS X anti-virus software, some people have taken the time to do that, and I thank them. The answer to your question has really got to be, "Why?". What is it that you're trying to protect against? There are no viruses for the Mac and there is no AV software that will protect against malware preying on user stupidity. If you are concerned about passing Word macro viruses on to your less enlightened Windows friends then by all means invest in something like Sophos Anti-Virus or another well known AV product. Other than that, for now at least, Macintosh AV products are a waste of money and the hype stirred up by AV vendors whenever something like this comes along is only intended to get you to part with your money. I have been running Mac OS X without AV "protection" since it was first launched, I'm not about to start just yet... and I sleep just fine.

I been involved in AV and am cloely tied with Network Associates (Beta testing, Sandboxing, DAT testing etc) and know my way aournd Viri.

I decide to quickly email a friend in the AVERT centre which tests and sends out definitions for new viri: He said:

Just had the first one (for OSX) yesterday :-) There are approximately 80 Mac OS 9 and earlier viruses... Seach for MacOS on VIL...

OSX/Leap http://vil.nai.com/vil/content/v_1385

It is NOT the first malware for OSX as we have seen Trojans already - for example http://vil.nai.com/vil/content/v_1291 and http://vil.nai.com/vil/content/v_1252 plus many UNIX/Linux "scripts"
which run quite happily on the BSD subsystem that makes up OS X. As to whether this is likely to be a series of threats is not known - the OS X platform is
a) relatively secure, and
b) is a far smaller target for malware authors, so the number of new threats is likely to remain far smaller than for larger target markets such as Windows.

So while you are loosely right, it is not Viri free - and as for Mac OS9!!!

Hope that helps...

>> Edited by neil_cardiff on Friday 17th February 16:10

[jamieboy]

neil_cardiff said:

Hope that helps...

It does, ta.