State of Mac security?

So, I keep getting these emails from Comcast's Constant Guard service claiming "Constant Guard from XFINITY identified that one or more of your computers may be infected with a bot."  They seem to be dead serious about it, though Comcast never provides any details about what triggered the email. They only provide a link for you download a free copy of...ew...Norton.
But, the security emails keep coming, about once every two weeks or so. Something is triggering Comcast's snoops to raise a flag my way. I think it's just occasional spikes in traffic due to suddenly having three computers online, but it's not something I can prove.
Has anyone else been the recipient of these Comcast emails? I also tend to be of the opinion that the Comcast emails are largely a marketing campaign, since they also direct you to their own for-fee security service.
So, what's the state of Mac security today? Are there really any bots that can make a home on a Mac these days?
FWIW, my home network is an iMac, two iBooks and, occasionally, an iPhone, connected via an Airport Extreme Base Station (WPA2).
Thanks,
Jim

Technically your Mac can become part of a botnet if you installed something unawares of what it was.
There has been a Mac botnet back in 2009.
http://arstechnica.com/apple/news/2009/04/evidence-suggests-first-zombie-mac-bot net-is-active.ars
You can check with this site to see if your IP address has seen traffic associated with a botnet.
http://botnetchecker.com/
Could be those emails are phishing scams. Visit their site and see if there is any official word about these emails.
Comcasts DNS servers get hacked from time to time.
Use OpenDNS or Google DNS instead, only take second to reconfigure the router.
Norton is the last thing you want on your Mac, ClamXav would be the only good solution I would think.
Of course simply reinstalling OS X  on top of the installed version and then Software Updating should clear out anything in OS X, but then third party programs and plug-ins should all be reinstalled.

Similar Messages

  • Hard drive crashed after mac security update

    My hard drive crashed right after downloading and installing the mac security and safari updates last night? Other than doing a complete re-install from my installation dvd and back-up, is there another way to fix this problem?

    Nope. You may have to replace the drive that crashed if you cannot reformat it.
    Clean Install of Snow Leopard
         1. Boot the computer using the Snow Leopard Installer Disc.  Insert the disc into the
             optical drive and restart the computer.  After the chime press and hold down the
             "C" key.  Release the key when you see a small spinning gear appear below the
             dark gray Apple logo.
         2. After the installer loads select your language and click on the Continue
             button. When the menu bar appears select Disk Utility from the Utilities menu.
             After DU loads select the hard drive entry from the left side list (mfgr.'s ID and drive
             size.)  Click on the Partition tab in the DU main window.  Set the number of
             partitions to one (1) from the Partitions drop down menu, set the format type to Mac
             OS Extended (Journaled) then click on the Apply button.
         3. When the formatting has completed quit DU and return to the installer.  Proceed
             with the OS X installation and follow the directions included with the installer.
         4. When the installation has completed your computer will Restart into the Setup
             Assistant. When you finish Setup Assistant will complete the installation, after which
             you will be running a fresh install of OS X. Now you can begin the update process
             by opening Software Update and installing all recommended updates to make your
             installation current.

  • How to get rid of "Apple Mac Security?"

    Hi, a company called "Apple Mac Security" downloaded some program onto my PowerMac before I could stop it, and now they pop up warning that I'll crash if I don't use them to remove things that have supposedly infected my computer. I did a search for their program to remove it but nothing comes up. I'd appreciate some help, I know these people are crooks.
    Thanks!

    Thank you, Mad Macs,
    I didn't install the "Apple Mac Security" program, so when I went to search for it in my applications file and the other recommended places, it wasn't there. I thought it was hidden because it seemed to install something before I could close out of Safari, and it popped up again when I was browsing. Very insidious. But I appreciate your response and help, and am happy to have found Apple Support Communities. I am a cartoonist, and am working on putting a daily strip online, do you have experience with Live Trace in Illustrator? I used to use Adobe Streamline to convert line art into Vector Images, and it was much more user friendly than Live Trace, but I may just not know how to use Live Trace correctly.

  • Malware " Mac Secure"  attempted access to my Mac.  I rebooted but now thunderbolt bridge in my preferences and I cannot clear it.  Is this an attempt by malware to gain access?

    I cannot remove thunderbolt bridge from preferences. Even after I rebooot it is still there .  I have not clicked ok to co figure.    I saw it after a malware attempt "  Mac Security"  .  Is the the thunderbolt an attempt to access my system by malware?

    Many thanks BobRz for prompt and brilliant suggestion!!!!!! It worked!!!!
    Just a follow question, any idea on how to delete duplicate copies of files and music as I have tried to delete as many files as possible yet the start up disc remains full?
    Thanks a lot!!!!

  • I'm investigating whether I can take on 'Lion' when it's released. The information states that your mac needs Intel Core 2 Duo. Is this the same as '2 GHz Intel Core Duo' which is what it actually states my mac has?

    I'm investigating whether I can take on 'Lion' when it's released. The information states that your mac needs 'Intel Core 2 Duo'. Is this the same as '2 GHz Intel Core Duo' which is what it actually states my mac has when I click 'About This Mac'?

    I could not agree more! My MBP 2007 Intel Core Duo has had its logic board replaced not to long ago (DVI port died). The original hard drive is running great and I am running Snow Leopard wonderfully.
    I was amped during the keynote and am really looking forward to Lion. I know the community is working hard to uncover a workaround because at present time, the solution (by new!) is not a worthy one. Especially when there is literally, nothing wrong with my existing machine.
    Apple, please ensure Lion will be available for Intel Core Duo machines, we are not that old! The closed architecture approach produces quality hardware. 4 years is a toddler perhaps teenager when it comes to apple hardware and technology. I predict I have at least 3-4 more years left in my current MBP 2007 machine.
    Much Love, Apple!

  • I am having issues with connecting to the store...the page just hangs and when I run Diagnostics it states that a secure connection could not be established.

    I am having issues with connecting to the store...the page just hangs and when I run Diagnostics it states that a secure connection could not be established.
    I have contacted apple via email and tried all the steps they have recommended and it is still not working. 
    I have tried disabling my McAfee and that does not work either. 
    Anyone that the phone number to apple express so I don't have to keep waiting for them to email within 48 hours? 
    Thanks. 

    With those symptoms, I'd try the following document:
    Apple software on Windows: May see performance issues and blank iTunes Store
    (If there's a SpeedBit LSP showing up in Autoruns, it's usually best to just uninstall your SpeedBit Video Accelerator.)

  • I'm trying to load avira free mac security, and am told i am not on patch level required, to update to latest patch level, what to do?

    i'm trying to load avira free mac security and am told i am not on the patch level required, to update to latest patch level, what to do?

    afickera wrote:
    i'm trying to load avira free mac security ...
    Please See Here  >  Antivirus Discussion
    More Info Here  >  http://www.reedcorner.net/mmg/

  • What is Mac Security

    What is Mac Security and why do I keep gettting a pop-up box with a message to update?

    It's some junk program.  just ignore the pop ups.

  • I installed Mac Security before I realized that it was a scam.  Now I can't remove it because "it is open" and I can't close it.

    I was taken in by the Mac Security trojan horse.  I installed it, but I did not register it because it asked for money.  Now I can't get it off my computer.  When I want to put it in the trash, it says that the program is in use.  Also, I am receiving **** sites because of this.  What should I do?

    Joseph's idea is correct but incomplete. After force quitting Macdefender in Activity Monitor (Applications - Utilities - Activity Monitor) then you need to:
    Remove the program.
    Go to the /Applications folder and move the program to the trash (it should likewise be called "MacDefender," "Mac Security," or "Mac Protector"). Also locate the installer file (likely in your Downloads directory, or wherever you have Safari store downloaded items) and move it to the trash as well. When you have done this, empty the trash.
    Remove references to the program.
    So far the program is launched at log-in by the system's "Login Items" feature. Go to the "Accounts" system preferences and choose your account name. Then go to the "Login Items" tab and remove any reference to the software from that list.
    Thank CNET for Steps 1 & 2 above. I go them from Malware Removal.
    Roger

  • Mac security and maintenance advice needed.

    can someone please advice me how to keep my mac secured and well maintained. i mean the macbook hardware as well as software.
    any antispyware or antivirus i should get for mac? would u recommend one? and which one? also suggest me some free alternatives.
    on pcs putting realtime scanners would slow down the system. i hope thats not the case in mac.
    also, any maintenance software like a defragmenter? i have been told macs dont need a defrag program. recently a whole lot of permissions went bad when i did a 'verify permissions' check.
    also, can someone tell me how often one should calibrate the battery?

    Kappy's Personal Suggestions for OS X Maintenance
    For disk repairs use Disk Utility. For situations DU cannot handle the best third-party utilities are: Disk Warrior; DW only fixes problems with the disk directory, but most disk problems are caused by directory corruption; Disk Warrior 4.x is now Intel Mac compatible. TechTool Pro provides additional repair options including file repair and recovery, system diagnostics, and disk defragmentation. TechTool Pro 4.5.1 or higher are Intel Mac compatible; Drive Genius is similar to TechTool Pro in terms of the various repair services provided. Versions 1.5.1 or later are Intel Mac compatible.
    OS X performs certain maintenance functions that are scheduled to occur on a daily, weekly, or monthly period. The maintenance scripts run in the early AM only if the computer is turned on 24/7 (no sleep.) If this isn't the case, then an excellent solution is to download and install a shareware utility such as Macaroni, JAW PseudoAnacron, or Anacron that will automate the maintenance activity regardless of whether the computer is turned off or asleep. Dependence upon third-party utilities to run the periodic maintenance scripts had been significantly reduced in Tiger and Leopard.
    OS X automatically defrags files less than 20 MBs in size, so unless you have a disk full of very large files there's little need for defragmenting the hard drive. As for virus protection there are few if any such animals affecting OS X. You can protect the computer easily using the freeware Open Source virus protection software ClamXAV. Personally I would avoid most commercial anti-virus software because of their potential for causing problems.
    I would also recommend downloading the shareware utility TinkerTool System that you can use for periodic maintenance such as removing old logfiles and archives, clearing caches, etc.
    For emergency repairs install the freeware utility Applejack. If you cannot start up in OS X, you may be able to start in single-user mode from which you can run Applejack to do a whole set of repair and maintenance routines from the commandline. Note that presently AppleJack is not compatible with Leopard.
    When you install any new system software or updates be sure to repair the hard drive and permissions beforehand. I also recommend booting into safe mode before doing system software updates.
    Get an external Firewire drive at least equal in size to the internal hard drive and make (and maintain) a bootable clone/backup. You can make a bootable clone using the Restore option of Disk Utility. You can also make and maintain clones with good backup software. My personal recommendations are (order is not significant):
    1. Retrospect Desktop (Commercial - not yet universal binary)
    2. Synchronize! Pro X (Commercial)
    3. Synk (Backup, Standard, or Pro)
    4. Deja Vu (Shareware)
    5. Carbon Copy Cloner (Donationware)
    6. SuperDuper! (Commercial)
    7. Intego Personal Backup (Commercial)
    8. Data Backup (Commercial)
    The following utilities can also be used for backup, but cannot create bootable clones:
    1. Backup (requires a .Mac account with Apple both to get the software and to use it.)
    2. Toast
    3. Impression
    4. arRSync
    Apple's Backup is a full backup tool capable of also backing up across multiple media such as CD/DVD. However, it cannot create bootable backups. It is primarily an "archiving" utility as are the other two.
    Impression and Toast are disk image based backups, only. Particularly useful if you need to backup to CD/DVD across multiple media.
    Visit The XLab FAQs and read the FAQs on maintenance, optimization, virus protection, and backup and restore.
    Additional suggestions will be found in Mac Maintenance Quick Assist.
    Referenced software can be found at www.versiontracker.com and www.macupdate.com.
    Do You Need Anti-Virus Protection for Your Mac?
    According to Rich Mogull's article, Should Mac Users Run Antivirus Software?,
    "The reality is that today the Mac platform is relatively safe. There are hundreds of thousands of viruses and other malicious software programs floating around for Windows, but less than 200 are known to target the Mac, and many of those are aimed at versions of the Mac OS prior to Mac OS X (and thus have no effect on a modern Mac).
    It's not that Mac OS X is inherently more secure against viruses than current versions of Windows (although it was clearly more secure than Windows prior to XP SP2); the numerous vulnerabilities reported and patched in recent years are just as exploitable as their Windows equivalents. But most security experts agree that malicious software these days is driven by financial incentives, and it's far more profitable to target the most dominant platform."
    Mr. Mogull is a computer security expert. I recommend reading the entire article as it is quite informative.
    For additional information on viruses, trojans, and spyware visit The XLab FAQs and read the FAQs on viruses and spyware.
    About Batteries in Modern Apple Laptops
    Apple - Batteries - Notebooks
    Extending the Life of Your Laptop Battery
    Apple - Batteries
    Determining Battery Cycle Count
    Calibrating your computer's battery for best performance
    Battery University
    Repairing the Hard Drive and Permissions
    Boot from your OS X Installer disc. After the installer loads select your language and click on the Continue button. When the menu bar appears select Disk Utility from the Installer menu (Utilities menu for Tiger and Leopard.) After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the installer. Now restart normally.
    If DU reports errors it cannot fix, then you will need Disk Warrior (4.0 for Tiger, and 4.1 for Leopard) and/or TechTool Pro (4.6.1 for Leopard) to repair the drive. If you don't have either of them or if neither of them can fix the drive, then you will need to reformat the drive and reinstall OS X.
    would keeping the charger plugged in extend battery life?
    It will neither hurt nor improve battery life. The life of the battery is determined by the number of full charge cycles - about 500 is the average life. If you use the computer mostly in a location with access to an AC outlet then you should use the AC adapter rather than run on the battery.

  • My mac security cannot find firewall  i have disable before how to made it enable thank you

    my mac security cannot find firewall
    i have disable before how to made it enable
    thank you

    Hi AngelZulu,
    If you are having issues updating iTunes due to security software issues, you may find the following article useful:
    iTunes: Troubleshooting security software issues
    http://support.apple.com/kb/ts3125
    Cheers,
    - Brenden

  • Mac security-browser, Java, Flash

    Just now read an article about Mac security. The writer offered several tips, including—
    –Never use an administrator account for day-to-day computing.
    –Use a sandboxed browser such as Google Chrome.
    –Uninstall/disable the standalone Flash Player.
    –Uninstall/disable the Java Player.
    These tips raise some questions. Why the concern about the administrator account? What is a "sandboxed browser"? Why the fuss about Flash and Java? If I use Mountain Lion, if I keep the OS up–to–date, and if I keep Flash and Java fully up–to–date, what's the big deal?

    I cannot explain why, but my browsers started recognizing the Java plug-in when I went to the following web site by Oracle.
    http://www.java.com/en/download/testjava.jsp
    My hunch is that between the support note listed in the above and going to the Java browser test it started working, but I am not really sure.

  • PBS POV video streaming stops when I order actual program to begin. Am up-to-date re PBS, in USA. Never happened before. Started when had POV ready to go when Avira Free Mac Security signalled download available;"told" to wait.Deleted Avira but nadaut noh

    PBS POV video streaming stops when I order actual program to begin. Am up-to-date re PBS, in USA. Never happened before. Problem started  when  had POV ready to go and Avira Free Mac Security suddenly signalled download available--;"told"it  to wait.Deleted Avira but still fails to stream. Presently: screen jumps but remains dark when I order the streaming. Any suggestions, please?  Harry H.

    hello sir,
    i want to your help
    i was installed fresh windows 7 via cd rom and then after installed all software.
    and now after 1 day customer complained me that cd rom not read any cd and i m also check when i insurt cd so its not read and when i am double click on cd rom icon its eject so what i do for that please reply on my email address.
    [text removed for privacy]
    VIMAL

  • New Version of Mac Security Available message??

    I am having this message appear on all my Macs...New Version available.  New Version of Mac Security has been downloaded and is ready to be installed.  Please click "install now" to start installation.  This message looks very questionable.  Is it real?  Should I be installing?
    Thanks!

    Is this appearing in a browser window? When the window showing that message is frontmost (click on its title bar to bring it to the front), is your web browser the active app? (Look at the application menu, next to the Apple menu on the menu bar, to see what the active app is.) If so, it's a pop-up from some web site you're visiting on all those machines. You can (and should) ignore it.
    If it's not a browser window, can you provide a screenshot? Press command-shift-4, then push the space bar, then click on the window. The screenshot of that window will appear on your desktop, and you can insert it in a post here using the camera icon in the post editor toolbar.

  • Why is it do hard to get a straight answer on Mac security?

    I have the latest OS, Yosemite.  I don't download anything illegally or use software I don't trust.  I basically only use my computer for personal reasons and limit what websites I go to and visit.  I have gone to the apple store and talked to the staff there several times and there always seems to be this mentality of, "well you should be ok."  I know there is no guarantee.  Like a car, you have to trust the brakes will work if a mechanic tells you they will work, but there is never a guarantee.  Just like how people used to say that Macs aren't vulnerable to viruses or Trojans and there is no guarantee to that.  I guess what I am wondering is, does anyone have ways they know that for now, Macs are working normally and can be checked to see if they are ok"?  Can someone at the apple store check certain things/operations to see if so far, so good?
    Thanks.

    1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to take control of it remotely. That threat is in a different category, and there's no easy way to defend against it.
    The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
    OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
    2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
    The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
    The following caveats apply to XProtect:
    ☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
    ☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
    As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
    3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
    Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
    ☞ It can easily be disabled or overridden by the user.
    ☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
    ☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
    Apple has so far failed to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. These failures don't involve App Store products, however.
    For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
    4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
    5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, not machine behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
    The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
    Software from an untrustworthy source
    ☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software. A genuine alert that Flash is outdated and blocked is shown on this support page. Follow the instructions on the support page in that case. Otherwise, assume that the alert is fake and someone is trying to scam you into installing malware. If you see such alerts on more than one website, ask for instructions.
    ☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
    ☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
    ☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
    Software that is plainly illegal or does something illegal
    ☞ High-priced commercial software such as Photoshop is "cracked" or "free."
    ☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
    Conditional or unsolicited offers from strangers
    ☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
    ☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
    ☞ You win a prize in a contest you never entered.
    ☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
    ☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
    ☞ Anything online that you would expect to pay for is "free."
    Unexpected events
    ☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
    ☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
    ☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
    ☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
    I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
    6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
    Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
    Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
    Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a padlock icon in the address bar when visiting a secure site.
    Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
    7. Never install any commercial "anti-virus" (AV) or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
    Why shouldn't you use commercial AV products?
    ☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
    ☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
    ☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
    ☞ Most importantly, a false sense of security is dangerous.
    8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
    An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
    Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
    London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
    You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
    The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
    9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
    10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It can be as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

Maybe you are looking for