Malware and Anti-virus software

Recently, there has been news about a particular trojan that infects the Mac using a gap in the Java software.  I haven't heard or seen much about it on the support communities or the security software websites, other than Sophos.  Apparently the problem has been solved for the later versions of OS X, but I am curious if versions prior to 10.6 are affected?  Does anyone know?

John L Lewis wrote:
Recently, there has been news about a particular trojan that infects the Mac using a gap in the Java software.  I haven't heard or seen much about it on the support communities
Considering that there are around a dozen or more threads on the subject, some of them running to 100s of posts, I find that a little surprising!
In theory, yes you can be infected. It's difficult to say what's the best way to stop it as there have now been so many variations, but the latest one uses a Java vulnerability to install a downloader which then 'phones home' and presumably loads the main malware package.
Turning off Java in all browsers via the preferences settings should be sufficient to stop that variation (the latest update isn't available to anyone on 10.6.7 or earlier).
Earlier versions have used JavaScript to attempt the same, giving fake Adobe Flash installers or fake ssl certificates or other other means to try to get you to enter your admin password and give the trojan access.
Unfortunately JavaScript (which has nothing whatever to do with Java) is widely used and essential for many sites, so disabling it completely really isn't an option.
However, FireFox with the NoScript extension gives you a good degree of control over what you allow to run, and the AdBlock+ extension can disable many of the fake ads used to induce you to download.
Little Snitch is also very useful - it warns you of any processes attempting to dial out, and can give early warning if a downloader has slipped by your guard.
One of the more comprehensive threads is here; https://discussions.apple.com/message/18036792#18036792
That gives various terminal commands that may be useful in determining if there's any infection.
One symptom of earlier versions was menu items turning to number strings.
As for AV software, it's not really worth the bother as the detection is so far behind the curve you're almost certain to see symptoms before the AV definitions have caught up. Also, most AV applications are worse than the malware in terms of slowing your system and some are downright damaging (stay away from Norton in particular).

Similar Messages

  • Malware and Anti-virus

    My company has a policy that we can use our personal laptops as long as it has some form of anti-malware and anti-virus software on it.
    I am fairly new to the mac world, 18 years of working with government issued windows laptops. Could someone point me in the right direction.
    Thanks.

    No viruses that can attack OS X have so far been detected 'in the wild', i.e. in anything other than laboratory conditions.
    It is possible, however, to pass on a Windows virus to another Windows user, for example through an email attachment. To prevent this all you need is the free anti-virus utility ClamXav, which you can download for Tiger and Leopard from (on no account install Norton Anti-Virus on a Mac running OS X):
    http://www.clamxav.com/
    The new version for Snow Leopard is available here:
    http://www.clamxav.com/index.php?page=v2beta
    (Note: ClamAV adds a new user group to your Mac. That makes it a little more difficult to remove than some apps. You’ll find an uninstaller link in ClamXav’s FAQ page online.)
    However, the appearance of Trojans and other malware that can possibly infect a Mac seems to be growing, but is a completely different issue to viruses.
    If you allow a Trojan to be installed, the user's DNS records can be modified, redirecting incoming internet traffic through the attacker's servers, where it can be hijacked and injected with malicious websites and pornographic advertisements. The trojan also installs a watchdog process that ensures the victim's (that's you!) DNS records stay modified on a minute-by-minute basis.
    You can read more about how, for example, the OSX/DNSChanger Trojan works here:
    http://www.f-secure.com/v-descs/trojanosxdnschanger.shtml
    SecureMac has introduced a free Trojan Detection Tool for Mac OS X. It's available here:
    http://macscan.securemac.com/
    The DNSChanger Removal Tool detects and removes spyware targeting Mac OS X and allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users' DNS records will be repaired.
    (Note that a 30 day trial version of MacScan can be downloaded free of charge from:
    http://macscan.securemac.com/buy/
    and this can perform a complete scan of your entire hard disk. After 30 days free trial the cost is $29.99. The full version permits you to scan selected files and folders only, as well as the entire hard disk. It will detect (and delete if you ask it to) all 'tracker cookies' that switch you to web sites you did not want to go to.)
    A white paper has recently been published on the subject of Trojans by SubRosaSoft, available here:
    http://www.macforensicslab.com/ProductsAndServices/index.php?mainpage=document_general_info&cPath=11&productsid=174
    Also, beware of MacSweeper:
    MacSweeper is malware that misleads users by exaggerating reports about spyware, adware or viruses on their computer. It is the first known "rogue" application for the Mac OS X operating system. The software was discovered by F-Secure, a Finland based computer security software company on January 17, 2008
    http://en.wikipedia.org/wiki/MacSweeper
    On June 23, 2008 this news reached Mac users:
    http://www.theregister.co.uk/2008/06/23/mac_trojan/
    More on Trojans on the Mac here:
    http://www.technewsworld.com/story/63574.html?welcome=1214487119
    This was published on July 25, 2008:
    Attack code that exploits flaws in the net's addressing system are starting to circulate online, say security experts.
    The code could be a boon to phishing gangs who redirect web users to fake bank sites and steal login details.
    In light of the news net firms are being urged to apply a fix for the loop-hole before attacks by hi-tech criminals become widespread.
    Net security groups say there is anecdotal evidence that small scale attacks are already happening.
    Further details here: http://news.bbc.co.uk/2/hi/technology/7525206.stm
    A further development was the Koobface malware that can be picked up from Facebook (already a notorious site for malware, like many other 'social networking' sites like Twitter etc), as reported here on December 9, 2008:
    http://news.bbc.co.uk/newsbeat/hi/technology/newsid_7773000/7773340.stm
    You can keep up to date, particularly about malware present in some downloadable pirated software, at the Securemac site:
    http://www.securemac.com/
    There may be other ways of guarding against Trojans, viruses and general malware affecting the Mac, and alternatives will probably appear in the future. In the meantime the advice is: be careful where you go on the web and what you download!
    If you think you may have acquired a Trojan, and you know its name, you can also locate it via the Terminal:
    http://theappleblog.com/2009/04/24/mac-botnet-how-to-ensure-you-are-not-part-of- the-problem/
    As to the recent 'Conficker furore' affecting Intel-powered computers, MacWorld recently had this to say:
    http://www.macworld.co.uk/news/index.cfm?email&NewsID=25613
    Although any content that you download has the possibility of containing malicious software, practising a bit of care will generally keep you free from the consequences of anything like the DNSChanger trojan.
    1. Avoid going to suspect and untrusted Web sites, especially p'orn'ography sites.
    2. Check out what you are downloading. Mac OS X asks you for you administrator password to install applications for a reason! Only download media and applications from well-known and trusted Web sites. If you think you may have downloaded suspicious files, read the installer packages and make sure they are legit. If you cannot determine if the program you downloaded is infected, do a quick Internet search and see if any other users reported issues after installing a particular program. A recent example is of malware distributed through innocent looking free screensavers: http://www.zdnet.com/blog/security/malware-watch-free-mac-os-x-screensavers-bund led-with-spyware/6560?tag=nl.e589
    3. Use an antivirus program like ClamXav. If you are in the habit of downloading a lot of media and other files, it may be well worth your while to run those files through an AV application.
    4. Use Mac OS X's built-in Firewalls and other security features.
    5. Stop using LimeWire. LimeWire (and other peer-to-peer sharing applications and download torrents) are hotbeds of potential software issues waiting to happen to your Mac. Everything from changing permissions to downloading trojans and other malicious software can be acquired from using these applications. Similar risks apply to using Facebook, Twitter, MySpace, YouTube and similar sites which are prone to malicious hacking: http://news.bbc.co.uk/1/hi/technology/8420233.stm
    6. Resist the temptation to download pirated software. After the release of iWork '09 earlier this year, a Trojan was discovered circulating in pirated copies of Apple's productivity suite of applications (as well as pirated copies of Adobe's Photoshop CS4). Security professionals now believe that the botnet (from iServices) has become active. Although the potential damage range is projected to be minimal, an estimated 20,000 copies of the Trojan have been downloaded. SecureMac offer a simple and free tool for the removal of the iBotNet Trojan available here:
    http://macscan.securemac.com/files/iServicesTrojanRemovalTool.dmg
    Also, there is the potential for having your entire email contact list stolen for use for spamming:
    http://www.nytimes.com/2009/06/20/technology/internet/20shortcuts.html?_r=1
    NOTE: Snow Leopard, OS 10.6.x, offers additional security to that of previous versions of OS X, but not to the extent that you should ignore the foregoing:
    http://www.apple.com/macosx/security/
    Apple's 10.6.4 operating system upgrade silently updated the malware protection built into Mac OS X to protect against a backdoor Trojan horse that can allow hackers to gain remote control over your treasured iMac or MacBook.
    http://www.sophos.com/blogs/gc/g/2010/06/18/apple-secretly-updates
    Finally, do not install Norton Anti-Virus on a Mac as it can seriously damage your operating system. Norton Anti-Virus is not compatible with Apple OS X.

  • Do i need to install and anti virus software on my macbook air? if yes, which one should i install?

    Do i need to install and anti virus software on my macbook air? if yes, which one should i install?

    Welcome to Apple Support Communities
    OS X has got its own security systems, so you don't need any antivirus. Furthermore, they will only slow down your computer. If you want more information, read > http://www.thesafemac.com/mmg
    If you want an antivirus, install ClamXav, but you don't need an antivirus

  • Since download of Firefox Hello desktop & laptop both on Windows 7 are very slow even after refresh, download history removed and anti virus software turned off

    Since download of Firefox Hello my home desktop & laptop, both on Windows 7, are very slow to open. I have refreshed firefox, removed download history and turned off the anti virus software in extensions. All the plugins are up to date. Can we revert back to Firefox without Firefox Hello?

    Firefox Hello is simply a wrapper for technology already in Firefox, it doesn't negatively impact performance if you aren't using it. Are you saying that your entire computer is slow or just Firefox?

  • Are there solutions to Compatibility Issues with Thunderbird, Windows 8.1 and Anti-Virus Software, e.g., MacAfee?

    Since I upgraded to Windows 8.1, Thunderbird freezes up and goes into "Not Responding" mode repeatedly every few minutes. My research indicates that it is a problem with compatibility with antivirus software, which obviously is needed with an e-mail program. How can this problem be solved, or is there an antivirus program that works seamlessly with Thunderbird and Windows 8.1?

    Personally I use ESET NOD32. It is not cheap, but it is unobtrusive and appears to get the job done. Originally I was drawn there for their server protection, but since I no longer have windows servers that need is gone, but I see no reason to change.
    Previously over the years I have used;
    * Norton (Found it just to much embedded into the operating system. Something went wrong with it and Windows would not boot.
    * Microsoft Security Essentials. Any application using large data files was unworkably slow. That included Thunderbird.
    * AVG It was just clunky and I did not like it.
    But the big issue these days is the products are not just anti virus, they are suites including firewalls, password managers/vaults and often spam and scam tools. It is usually these later tools that cause the most issues with the firewalls blocking anything but known versions of known software and spam tools that mess up because it has not had enough testing.
    Basically your on your own in selecting a product5. I can not recommend one. But I seriously question the need for mail scanning. Especially after that remarkable admission by Symantec regarding Norton's not scanning mail.
    Thunderbird does not run any scripts in mail, nor does it do anything with attachments before you open them and then it decodes them and places them in the temp folder where any good anti virus will scan them.
    Personally I suggest anti virus rather than security suite software. Especially so if you use Chrome or Firefox browsers and they both use Google lists of known malware and phishing site to block inadvertent visits.
    Windows has a firewall, your modem (over 90%) has one as well, those firewalls block ports, protocols and route traffic. Do you also need one that blocks programs?
    Mozilla products have a password manager, do you need another? And so the list goes on.

  • Apple iMac G5 and Anti-Virus software....

    Again, another question from a rookie. With my new G5, do I need to purchase a reputable AV software package? Nortons? Virus Barrier X?
    Thanks all,
    Bob

    but if you practice safe surfing and do not blindly forward emails and attachments from unknown sources, you are doing about the same thing.
    I agree Eric...same practice here as I don't use this type of software.
    With that said, I believe it's important to present all information in these forums so people can make up their minds about what's most important for them. I read both articles and overall I'd say the information is valuable for better understanding this "growing" issue.
    Given the tenuous state of computing where a lot changes in a very short period of time, it's just a matter of time before something very creative, albeit destructive, makes its way onto the Mac Platform. I guess such is the nature of computing. Staying up-to-date with what is going on in the "virus world" is enough for me at the moment. At some point in the future I may have to "upgrade" that strategy.

  • Cannot connect to Itunes, status bar goes about half way and stops. I have tried all the fixes other people have used, no joy. Running Vista with the most recent Itunes installed. Disabled fire wall and anti virus software. Once again, I have tried it all

    Itunes won't connect, status bar goes about half way and stops, then times out. I have tried all fixes posted, you name it, I have done it. Running Vista and current version of Itunes. Can connect to Internet with any other app. Using Firefox, their latest version if that matters.
    I have seen this is an on going problem throughout the Itunes community. All I can say is 'Bad Form Apple, Bad form.'

    One more odd thing.  The itunes diagnostics believes my windows firewall is on which is it not (believe me I've checked/double checked etc) AND believes itunes is not enable in windows firewall which it is, if ever I turned WF on.  How can itunes get this wrong?  I mean, if itunes believes its being blocked, maybe that's why I'm being blocked...has anyone heard of this?

  • Anti-virus software for Tiger

    I understand that Virex is not compatible with Tiger. Any recommendations on a similar program for virus protection?
    Thanks.

    It isn't needed - at the present time anyway.
    Check Macs, viruses, and anti-virus software.
    If you insist, check ClamXav which is free (donationware).

  • I just opened an email from someone I knew via Insight Broadband. It was a link. I clicked on it and it led to a enhancement drug web site. Do you think I downloaded a virus? I didn't buy any anti-virus software. Thanks to anyone who has time to help me.

    I just opened an email from someone I knew via Insight Broadband. It was a link. I clicked on it and it led to a enhancement drug web site. Do you think I downloaded a virus? I didn't buy any anti-virus software. Thanks to anyone who has time to help me.

    Hello:
    There are NO viruses that affect a Mac running OS X - none.  FWIW, I suggest that you NOT buy A/V software.  It is a waste of both money and computer resources.
    Having said that, there are a couple of instances of malware that have popped up.  Just don't follow links from unknown sources.
    Barry

  • Once and for all: Do I need anti-virus software for my Mac?

    I've always heard that you don't really need anti-virus or anti-spyware software for Macs - but I do wonder that there has to be viruses about that would affect Macs?
    I do alot of creative and professional work on my Mac. The data on it, means a **** of a lot to me, and I'd hate for my Mac to be infected with something horrible.
    Could anybody please tell me if I really do need anti-virus or anti-spyware software for my iMac? And if I do, which one do you recommend? (Ideally I would want it to be cheap and not hog lots of system resources)...
    Thank you!

    Hi
    I can only give you my personal experience on this one.
    The short answer is "no". I've been using macs for the past 4 years, my partner for many more. Neither I nor she have an anti virus program installed.
    We both use firewall on both the os x setup and via our router. I tend to install the security updates posted by apple after they are released and check the forums to be aware of any potential problems.
    A much better idea is to back up your important projects etc on a regular basis to dvd and external hard disk.
    I have one experience of anti-virus software on the mac:
    About 2.5 years ago i thought i had a virus - my diskspace was being eaten up at a very very fast rate - and i was worried. Found out that the os update from 10.3.2 to 10.3.5 had an incompatability issue with the mcafee shock game controller driver (obscure eh!)
    Anyway, after this experience and deleting the driver which i no longer needed, i decided to err on the side of caution and tried out both mcafee and norton. Both of which slowed down my system and norton especially caused problems when i was running logic pro etc. really really annoying.
    Once i'd got over my "insecure" stage and having spoken to other mac users i realised anti-virus software was causing many many more issues than resolving any - and besides since then i have still had no problems and have never come across any viruses on mac os x.
    It all depends on what makes you feel safer. Personally i wouldn't recommend ant-virus programs... i wonder if anyone has any positive experiences of anti-virus software on the mac?
    that's my 0.02 pence

  • Anti virus software  and patching os

    Can anyone tell me their views on anti virus software running on a database server? We are windows 2003 / 11g.
    I have not allowed it in the past but our networking folks think we should have it installed so we can at least scan the C: drive.
    Also, what is your policy for updating the OS. I currently do not update the OS unless I have a know issue. Others seem to think this is crazy but this policy has worked well for the last 3 years. I should add that we replace our databases every 4 or 5 years and they are all behind two firewalls - access is only thru the web app or file server.
    I would be very interested in other's policies.
    Thanks,
    Kathie

    Personal opinion: I'd never put AV on a proper, production Oracle server -and by "proper", I essentially mean what you indicate: it's not accessible directly by the public; it's behind firewalls; it has no functioning connection to the Internet etc etc etc
    We also disable automatic updates on all our Windows servers, because otherwise there's a tendency for a production database to die unannounced as the automatic updates kick in!
    As for manual updates: we tend not to bother on a routine basis. We've fully patched a server when we were planning to take it offline for other reasons (an Oracle CPU patch, for example), so periodically everything becomes as up-to-date as it can. But during normal running, we just let it run without interruption (i.e., without updates) for as long as we can. Only

  • I have a 6.1.6 MAC desktop and my bank has recommended anti-virus software and turn on Firewall - require advise please

    I have a 6.1.6. MAC desktop and my on-line bank has recommended I download  separate anti-virus software and turn on Firewall
    Please advise
    Thank you
    Karinband

    I concur with Etresoft. If they persist in their demands for you to install AV software and turning on a firewall, ask to speak to a manager of the bank and suggest to them that you are seriously considering changing banks. That usually changes their tune.

  • My MBpro has been running some kind of app in the background upon turning on, heating up for no cause. Is this normal since Snow Lepard? It's been updated and I also have anti-virus software too.

    My MBpro has been running some kind of app in the background upon turning on, heating up for no cause. Is this normal since Snow Lepard? It's been updated and I also have anti-virus software too.

    you're welcome....
    also check activity monitor - all processes - see what's using up most of your cpu resources under % CPU....
    highlight anything that's really high and hit quit process......anything over 10% is considered high - unless it's your browser....
    good luck...

  • I have upgraded to os x 10.10 and now anti-virus software is disabled. It is trend micro maximum security.

    I have upgraded to os x 10.10 and now anti-virus software is disabled. It is trend micro maximum security.
    To keep my subscription does this mean that I to go back to os x 10.9.5 Mavericks?

    I would remove the anti virus software.  Does not help.

  • Who can recommend a functional anti virus software for imac and macbaook

    Alarm! Great problems with Internet Banking!
    Access closed by bank because of "Trojaner" on my imac. Can't believe.
    Who can recommend a good anti virus software for imac, macbook and even ipad?
    Thanks for helping
    Eva

    ClamXav.
    You will find this User Tip on Viruses, Trojan Detection and Removal, as well as general Internet Security and Privacy, useful:
    https://discussions.apple.com/docs/DOC-2435
    The User Tip (which you are welcome to print out and retain for future reference) seeks to offer guidance on the main security threats and how to avoid them.
    More useful information can also be found here:
    http://www.reedcorner.net/mmg/

Maybe you are looking for