One In Five Macs Holds Malware — For Windows

judgecorp writes "One in five Apple Macs is infected with malware, according to Sophos. But most of that is harmless to the Mac... it is Windows malware ready to be transmitted to the Windows population. Only one in 36 Macs has OS X specific infections."

Comments

Infected?

[Rosyna]

If the code never can run on Mac OS X, how can Mac OS X be infected? To Mac OS X, it'd just be a useless file full of some kind of data.

Re:Infected?

[StoneyMahoney]

They may only be able to carry the germ without symptoms, but that still sounds like an infection to me.

Re:Infected?

[Anonymous Coward]

In biological disease, there's a phenomenon called a carrier. For reasons unknown, the person is infected, but doesn't show any of the symptoms and never will. They are however able to infect others. As such, they are still considered infected. I think that's how the mac is considered infected.

Re:Infected?

[masternerdguy]

Correct but it does indicate mac peeps aren't particularly careful about what they download or what sites they visit. This is going to cause them problems later when we see more mac malware.

Re:Infected?

[jdgeorge]

True - if it's inert, it's not really an infection. However, this is why you see Linux workstations running anti-virus software in an enterprise environment. It's not because your Linux system will get "infected"; it's so your Linux system won't inadvertently infect vulnerable systems.

Re:Infected?

[tripleevenfall]

If your Windows boxes are vulnerable to whatever the infection is, forcing these users to use PCs instead of Macs does not lessen your vulnerability, it increases it.

Re:Infected?

[tlhIngan]

If the code never can run on Mac OS X, how can Mac OS X be infected? To Mac OS X, it'd just be a useless file full of some kind of data.

The same way lots of people are infected with some very potent diseases. It's just they're immune to it, so they're really just carriers of the disease. Heck, isn't something like chickenpox able to hide for decades in people only to infect those who haven't had it yet?

Heck, I'd be the rates of Linux infection are the same - Linux is immune to practically all malware, but it certainly can be a carrier of them. Heck, if you think about it, Linux may cause the spread of it (via Linux-based email servers)

Re:Infected?

[Anonymous Coward]

Even if the code is windows only and not affecting the mac, the sheer force of numbers can bring the mac down. It's a bit like if you felt only papercut from an infection that killed someone else when it turned into necrotising fasciitis. It might not kill you, but thousands of papercuts will still take their toll. If the mac has been exposed and is carrying one infection lying in wait for a windows machine to appear on the network, then it's probably carrying dozens.

Re:Infected?

[Tokerat]

It's like being a carrier of an STD. Even though you're causing the disease to spread, you just make everyone else look like dirty whores by comparison.

Re:Infected?

[Anonymous Coward]

That's a ridiculous misinterpretation. It makes sense only if the Windows machines are less likely to have an infection.

Re:Infected?

[Joce640k]

...but how is it 'transmitted'? That implies an installed transmitter, ie. malware.

Re:Infected?

[ColdWetDog]

In biological disease, there's a phenomenon called a carrier. For reasons unknown, the person is infected, but doesn't show any of the symptoms and never will. They are however able to infect others. As such, they are still considered infected. I think that's how the mac is considered infected.

Macs are the computer equivalent of Typhoid Mary?

This should go over well.

I'll just make some more popcorn.

Re:Infected?

[bemymonkey]

Imagine that there are already tons of mostly-Windows networks out there ;)

Re:Infected?

[quasipunk guy]

I'd wager the majority of the Windows malware "infections" are trojan exes from shitty porn sites.

Re:Infected?

[phantomfive]

After going through the links to find a better source, I think I understand what happened.

The study comes from Sophos, with data collected from computers which downloaded their free anti-virus for Mac.

The most commonly found malware on the Macs was apparently fake antivirus scareware. My guess is that a lot of users saw the fake browser popup telling them a virus was found, and then clicked on it. This started a download which didn't run, but now they have a malware binary in their download directory that they can't use.

These are the people who downloaded free anti-virus from Sophos. No correlation.

Re:Infected?

[Anonymous Coward]

Who cares? The important part is: Let Macs onto your mostly Windows network and you might get a not so fun surprise...

No, the important part is Sophos is using this information to attempt to sell anti-virus products. But they can't be too direct about it because there's a clear contradiction here. If Sophos products could stop the malware, then the Windows PCs are already safe. The infected files stored in a Macs web cache aren't going to magically leap across the network, but even if they did, the anti virus software on the Windows machine should catch it first. If the AV can't stop the infection, then why buy any additional copies?

Re:Infected?

[Daniel Dvorkin]

The same way lots of people are infected with some very potent diseases. It's just they're immune to it, so they're really just carriers of the disease. Heck, isn't something like chickenpox able to hide for decades in people only to infect those who haven't had it yet?

Not really comparable. Carriers are still infected, in the sense that the pathogens can still reproduce inside their bodies; they just don't show any symptoms, presumably because their immune systems are capabable of keeping the infection at a subclinical level. Malware infections, OTOH, are, well, binary -- a system is either infected or it's not.

The "Macs" that are infected with Windows malware, it sounds like, are really Apple-branded machines running both OS X and Windows, through dual-booting or with something like Parallels. The only thing comparable in medicine would be if someone were a chimera of different species, vulnerable to two different sets of diseases and with two different immune systems to deal with them, and both the diseases and the immune systems switched places throughout the day. IOW, there's really no such thing.

Re:Infected?

[mallydobb]

semantics. I haven't read the article, but based on the summary they're talking about the Mac being a carrier, being able to pass along the "infection" but not adversely impacted by it itself.

Re:Infected?

[Anonymous Coward]

I have a few dozen files containing PC boot-sector and MS-DOS executable viruses. Does that mean my Linux box is "infected"?

Re:Infected?

[ashpool7]

Contaminated would be a better word, since the viruses have no way to spread or affect the computer.

Re:Infected?

[WrongSizeGlass]

...but how is it 'transmitted'? That implies an installed transmitter, ie. malware.

I guess we'd have to attach it to an email and send it along to them. Since it's can't act on its own, and it isn't active on the system, it's just sitting there like any other file on my Mac.

Re:Infected?

[WrongSizeGlass]

Correct but it does indicate mac peeps aren't particularly careful about what they download or what sites they visit. This is going to cause them problems later when we see more mac malware.

This is very true. Mac users generally surf the web with a complacent sense of impunity from malware.

Re:Infected?

[kurt555gs]

Typhoid iMary.

Re:Infected?

[DamonHD]

There can be a cycle of hosts required for an 'infection' in the real world, all of whom are different but vital to the process. And they may be a mixture of flesh and silicon:

http://www.newscientist.com/article/mg16922754.600-press-v-for-virus.html

Rgds

Damon

Re:Infected?

[ewanm89]

Wine attempting to be bug for bug compatible also has been known to run windows makes malware.

Re:Infected?

[dhaen]

They may only be able to carry the germ without symptoms, but that still sounds like an infection to me.

You mean like all the Unix and MS mail and Ad servers out there? Where do you think those files came from? Are they "infected"? I've scanned scanned lots of Unix machines for Windows viruses. User folders always show something, though I wonder how many are false positives. It pays the Anti-virus vendors to show as many "other platform specific" positives as they can - it's a no-brainer.

Re:Infected?

[Daniel_Staal]

This is probably what Sophos (an anti-virus provider) is hoping.

Re:Infected?

[gnasher719]

Macs are the computer equivalent of Typhoid Mary?

Totally invalid comparison. A Mac with say thousand potent windows viruses on its hard drive, connected to a network with Windows PCs, would not do any harm - because none of those Windows PCs would open any of those infected files.

Re:Infected?

[Anonymous Coward]

Did you think the computer illiterate would be anything else?

A network is only as secure as its weakest link. That's typically Apple users.

Microsoft made this mess, why are Apple users under some sort of an obligation to clean it up? Windows malware will not harm my Mac, if I hand some infected file over to a Windows user and his computer gets infected it's his own fault for not installing anti Malware software. FWIIW I installed an anti malware scanner on my Mac, dunno if it sweeps for Windows malware as well as the Mac malware, not that I care... much.

Re:Infected?

[hemo_jr]

Typhoid Mary was not only a carrier, but contagious. She ended up being forcibly quarantined because she was killing too many people and she could not be cured of being infectious.

In the case of the carrier Macs, they are not infectious, the infections can be removed, and the haven't killed anyone.

Re:Infected?

[Anonymous Coward]

That implies you have it with, directly noticed, controlled, and to do with as you will.

If I happen to be unknowningly injected with ebola, but am somehow entirely immune to its effects... I would have to say I'm infected, but not affected by it. Even if it's unable to be spread from me, that doesn't change the fact that it's still sitting there, just as potent as ever, but simply unable to perform it's function. Should something change in my system that allows it to do as such (let's say for the sake of argument, the Mac is installed with some program that will allow the virus to execute), then it will do exactly as it had originally intended... be a virus.

That's infected, my friend.

Re:Infected?

[Wild_dog!]

Not really similar since a carrier is replicating and spreding the disease. The disease cycle is still progressing even though a carrier doesn't know it and there are no ill effects for the carrier. The mac isn't even a dead end host like many parasitic infections which are not meant for humans. Those actually can cause a disease process that has symptoms.

The malware on macs isn't replicating and spreading.

It is more like someone picked got a piece of mail addressed to nobody with no forwarding address and it is in a pile of junk in a drawer. Unless someone gets it out of the drawer and sends it to someone else, there is not really a problem.

Re:Infected?

[NatasRevol]

being able to pass along the "infection"

It's this part that most everyone calls bullshit on.

If the malware can't run on the Mac, how does it pass it along?

Re:Infected?

[mcgrew]

To stretch the "virus" analogy a bit, if you harbor a virus yet are immune to it you are in fact infected; you are a carrier. You won't get sick, but you'll make everyone else lacking that immunity sick.

However, that is a stretch. You can't infect a Mac with a Windows virus, of course. But a virus-ridden file can be on a Mac's drive. This would be problematic for someone who uses both Mac and MS. But I wouldn't call just having a file on your hard drive an "infection".

Re:Infected?

[Wild_dog!]

Infected is not equivalent to immune.
Immune means your body kills off the disease and you don't have it anymore.
Chicken pox is like a herpes virus. It is able to hide itself from immune attack and will only surface when immunity gets messed up somehow.

Chicken pox gets supressed and hides in your neurons. People who get their immunity compromised temporarily let the virus replicate. It travels down the neurons and causes skin erruptions known as shingles. Shingles lesions contain live chicken pox virus which can be passed to other people.

These windows viruses are in know way infecting mac machines or linux machines. And they are not carriers since carriers have replicating virus which can be transmitted from one host to another.
Neither Linux or Mac boxes can directly infect a window machine.

Re:Infected?

[s.petry]

People like you are frustrating because what you claim has some truth, but actually has no value in the root issue. Let me try to explain this in a different way.

You run Mac or Linux, and receive email. Spammer sends you an email that has an embedded file "hackme.jpeg.exe".

You sitting in your world keep it in your inbox. Even if you tried to preview the file, it would not execute. It's just there in the mail file.

Now, run a virus scanner on your Mac or Linux. OMG, you are infected right? That's what the virus scanner will tell you, and what marketing wants you to believe.

In order for a virus to be a virus, or malware to be malware it must be able to take action. Sitting in your trash can is not an action.

Now, lets go a bit further. You thought the message had a funny subject line, so forward that file to 10 friends all running Windows.

That ^ is what the AV software companies are complaining about and want you to be running AV software on your MAC or Linux system. If you have to manually forward a piece of code, it can not be a virus.

Lastly, you can't compare a PC virus to a living virus or transmittable disease simply. Species plays a major role in transmission and infection.

Re:Infected?

[machinelou]

Actually, she was forcibly quarantined twice. The first time was because she was spreading it without her knowledge. After at least a year, she agreed not to work as a cook and they let her go. A few years later, there was an outbreak of Typhoid in a hospital and when investigators arrived, they found Mary working in the kitchen. This time they forcibly quarantined her because she knowingly put others at risk. At the same time, there were a number of individuals in the New York area who were also showed no outward symptoms but were nonetheless infecting others. These individuals were not similarly incarcerated. Hence, in retrospect, incarcerating Typhoid Mary was more 'security theatre' than anything else. It was a visible but largely ineffective solution to a bigger problem.

Re:Infected?

[Wild_dog!]

Um... no.
What are you talking about?
Having a million windows viruses wouldn't bring your mac to a stand still. It is called storage and most everyone has more storage than even millions of malware and virus codes would be able to clog up. Plus I can't imagine someone even downloading a million or a billion separate viruses.
Remember they don't replicate on linux or mac boxes.
Every machine has more useless code sitting around on the hard drive than you would ever find malware and it fails to bring down the machines.

Re:Infected?

[narcc]

I would have to say I'm infected, but not affected by it.

Either way, you're fected.

Re:Infected?

[Anonymous Coward]

There was a slashdot article a couple months ago that the majority of Windows malware is from drive-by downloads, mainly ad servers which allow their clients to put malicious HTML or attack browser add-ons.

I've found that slapping AdBlock on my machines has reduced the infections I've gotten in the past decade to zero.

Re:Infected?

[quasipunk guy]

Because reputable pornography vendors don't distribute malware.

Re:Infected?

[Bert64]

Why should mac users be careful about downloading files which are harmless and/or useless to them?
There are plenty of pieces of malware sent via email (i receive several per day) as well as websites which trigger an automatic download (although obviously it cannot execute, so it just sits in the download dir)... I imagine many users never bother to clean this junk up because its harmless to them, whereas a windows users would either become infected, or have it removed automatically by their anti-malware app.

Re:Infected?

[Bert64]

Download yes, but it won't execute them...
In the case of windows malware, it will just benignly sit there until deleted. In the case of mac specific malware, you would have to execute it in order to actually become infected otherwise it too will sit there benignly until removed.

Re:Infected?

[Wild_dog!]

"However, Macs will continue to serve as a transmission vector for viruses and Trojans so long as anti-malware software is not installed." ....From the link posted above.....

Logical Fallacy actually....not even semantics....I think this is just propaganda.
Linux boxes and macs simply do not get infected and then go on and infect other windows machines. At least not at this point. Perhaps someday we will have cross-platform viruses, but we don't currently.

To be a vector the malware cycle needs to complete itself within a mac or linux box which would mean they are infected. A carrier state is also a state of infection with the cycle being completed in the host although adverse conditions are not felt by the host. Neither of these is actually happening so this is just bogus hogwash from what I can tell.

Re:Infected?

[Anonymous Coward]

Microsoft didn't make Mac OS vulnerable to a virus that then infects Windows machines, sorry. It's Apple's damn fucking fault.

It's not vulnerable. It is simple storing the files.

Re:Infected?

[Billly Gates]

If the code never can run on Mac OS X, how can Mac OS X be infected? To Mac OS X, it'd just be a useless file full of some kind of data.

I surely hope your joking and being sarcastic?

Re:Infected?

[Bert64]

Only if the windows users explicitly retrieve files from the macs and execute them.
While on the mac, the files are inert therefore whatever spreading mechanisms are coded into the malware will not be active.
So the malware will not be actively looking for other machines, other files to infect or vulnerabilities to spread via, it will just be sitting there.

On the other hand, an actual malware infection will often be actively seeking to spread itself, depending on the individual malware it might scan the local network for vulnerable boxes or open file shares, attach itself to (or generate on its own) outgoing emails, attach itself to otherwise legitimate binaries that its able to write to, write itself to any writable media such as usb sticks which are inserted into the infected system etc.

Re:Infected?

[Billly Gates]

I'd wager the majority of the Windows malware "infections" are trojan exes from shitty porn sites.

The majority are from flash and java and javascript exploits by driveby downloads from infected servers or ads. Infact slashdot hosted a virus by a fake virgin mobile ad 3 weekends ago.

Thank God I ran Avast!. If you are one of those types who feels they are virii free who are running Windows and reading this, well your system is 0wned if you came here 3 weekends ago. Oops

Apple is easier to target for malware writters anyway because their users typically do not run anti virus software and feel safe clicking on shit anyway because the genius at the Apple Store said they are secure.

Windows users know better and have anti virus software and run Windows 7 (hopefully if they are home users) with full updates.

Re:Infected?

[Bert64]

A windows executable is not considered an executable by a mac, its just considered an unknown binary file and may well be cached.

If the malware is stored in a shared documents area then sure, it *could* be executed.

On the other hand, if the windows system doing the executing is running an av product that knows about this malware then it will detect the malware at this point and prevent it from running.
If that windows system is not running an av product which knows about the malware, then it is just as likely to be hosting it on its own shared documents area (if not more so, because once a system is infected the malware could make attempts to spread itself, which it couldn't do on the mac since it cannot execute there).

Re:Infected?

[MobileTatsu-NJG]

I have a few dozen files containing PC boot-sector and MS-DOS executable viruses. Does that mean my Linux box is "infected"?

Heh. I wonder if a dude that does medicinal research who has freezers stocked with viral samples is considered infected.

Re:Infected?

[Billly Gates]

Look up flashback?

All you had to do was view a site in Safari and even under a regular user account you were 0wned even if you did not click the "upgrade flash now" button. Of course damage was more limited and could be easily removed by deleting and recreating the user account taht way versus running as admin, but still.

Even with the latest patch more mac users are getting infected by the day. The latest varient now runs silently without any interaction from the user at all.

Memory corruption bugs are evil. They can even bypass user security totally and simply run around the check.

Re:Infected?

[Bert64]

No, the mac is a dumb carrier of a file which is utterly benign to the mac, but dangerous when copied to a windows system. The mac in this instance is behaving as a dumb storage device, like a disk.
The malware might be dangerous if copied from a storage device to a vulnerable system, but just sitting on the storage device it's benign.

The malware becomes far more dangerous once it moves from a dumb storage device and onto a system it can actually infect, because then instead of just passively sitting there waiting to be executed, it can actively make attempts to spread, as well as trying to disguise its present and prevent its removal.

Re:Infected?

[Billly Gates]

Still regardless it is time to run an anti virus suite in 2012 regardless of OS.

I know the AV companies have an alterior motive here, but it is true. Flashback is gaining more and more users by the day and Mac users are more dangerous because they feel they are immune and have no idea they are infected. Even if some malware is Windows only it should not be on any mac or linux box.

If I were a malware writter I would target MacOSX. Why? The users are idiots who do not run anti virus software, many are not auto updated and old (because of the price), and Windows users know better to click on shit and almost all have anti virus software that can detect my code fast. Apple users are higher income users too so its more money for me to steal.

Linux boxes are rooted often too. The worms are just different and are designed to host fake web ads or setup phising servers. Linux users feel supperior and that they are immune so they never check or run anti virus software.

Downplaying by even suggesting ... well its WIndows only makes the problem worse. Its time to get the elite anti Windows attitude away in 2012 where 15% of US internet enabled computers are macs.

Re:Infected?

[jdgeorge]

Heh... Not sure... I didn't think I was saying anything controversial. My Linux system at work runs AV software for the reason I described. It's irritating because it sucks a fair amount of memory, but I understand the reason for it.

Re:Infected?

[Billly Gates]

What a truly ignorant comment.

I support home users for a living and see mac viruses very often. The trend started last year.

They get infected by flash and java and exploits in javascript. The users debate and tell me they are not infected because they own a mac. I run a scan and everytime there is a slowdown several trojans are on it.

Macs are worse because the users do not believe in anti virus software and therefore are easier to target. The Windows malware gets on throug the same web based exploits because of outdated flash, java, and iframes in Firefox that Windows versions have.

People need to get a more update knowledge as this is becoming a large problem regardless of platform. Clickong on free screensavers in IE 6 with unpatched XP is not how these infections come by anymore. IE and Windows 7 with patches is very secure and sanboxed (version 9 of IE is) and mixed with anti virus software is pretty good. Almost all the infections are through ads and 0 day exploits in flash and rogue PDFs.

Re:Infected?

[clang_jangle]

In enterprise settings it's common for AV to be run on linux machines that interact with windows machines. ClamAV also exists for OS X. TFA is just an applehate troll. Windows users whose machines can become infected from emailing or exchanging files with another machine are doing it wrong, regardless of the OS serving the malware.

Re:Infected?

[mallydobb]

being forwarded in an email or on removable media are the most obvious ways that malware is being passed along. For the most part it is not very likely for an infected/malicious file (unless intentional) to be passed from a Mac to Windows machine, but I've scanned my email folders occasionally and found a file that is harmless on my MacBook but would compromise a Windows system if opened. So it can happen, its not BS.

Re:Infected?

[mcgrew]

It got on the Mac's drive somehow, probably by a downloaded file, which could easily be downloaded from the mac by a windows PC on the network. Say you're in the coffeeshop with your MacBook Pro and see what appears to be a usefull MS program, so you DL it to take home and install on your Windows box.

But what I'm wondering is how your perfectly reasonable question was infected with a "flamebait" mod. Windows user with thin skin, maybe?

Re:Infected?

[Wild_dog!]

I'm not arguing that macs can't be infected by mac exploits..
All computers can be infected by things meant to exploit them.
But malware intended for windows injected on a mac wouldn't have much effect I would presume.
Same thing for malware intended for linux wouldn't have much effect on a windows machine as of yet.
Perhaps I am wrong???

The article is about macs passing windows malware onto window machines.
So what you are saying by calling my comment ignorant, which it could possibly be, is that the macs pass these windows virus' on to windows machines from the macs?

Are you saying these macs are then relaying this malware to windows machines?
Are you truly seeing these infected macs then passing these infections to windows machines?

I remain unaware of macs contaminated with windows trojans then of themselves passing these trojans on to windows machines.

Re:Infected?

[Tarlus]

This could be compared birds or insects that can carry diseases that are harmful to humans, while being themselves entirely unaffected by them. I wouldn't consider them to be infected per se, as the disease doesn't target their physiology. But that's my way of looking at it.

Re:Infected?

[b4dc0d3r]

Please don't inure people to the idea of "security theater". It really is a great description for a lot of what is being done publicly to pretend to do something, often at great expense, and frequently to the financial benefit of well connected people.

She swore by affidavit not to cook, but returned to cooking. Under a different name. Her release as a carrier depended on her not cooking, which she didn't follow.

She was the first carrier identified (at least in New York), and the policies evolved as more information came along. The effective solution to the bigger problem was to restrict carriers' activities, and Mary was used as the example of what would happen if you didn't comply. The rest were considered not justified for quarantine, again as more information was discovered.

Making up policies as you go along, and having to fight an obstinate woman who refused to acknowledge her danger to others, is not even close to security theater. You may be able to call it "meting punishment based on public perception" since she became relatively famous, which is not a whole lot better.

http://cythereabast.wordpress.com/2007/02/20/the-board-of-healths-exile-of-mary-mallon-was-it-justifiable/

Re:Infected?

[Anonymous Coward]

Um...perhaps you should, oh, read the Wikipedia article? Typhoid is by a carrier of typhoid in urine and feces. So, as in Typhoid Mary's case, the risk from a typhoid carrier comes from inadequate hand washing. So, yes, Macs might be non-communicable. But, you can't trust the files stored on a Mac and run them on a PC. The reason Typhoid Mary was effectively isolated was precisely because she refused to accept that she was responsible for spreading typhoid. It was an isolated case which doesn't suggest it valid to quarantine all typhoid carriers or Macs. It does, however, make it appropriate to consider the possibility that a Mac might be a carrier and consider isolating a repeat offender.

Re:Infected?

[vought]

It is more like someone picked got a piece of mail addressed to nobody with no forwarding address and it is in a pile of junk in a drawer. Unless someone gets it out of the drawer and sends it to someone else, there is not really a problem.

That's exactly the right analogy. The vast majority of Windows malware found on Macs is in filed e-mails from Windows users. Seriously. If you never do anything with the mail again, it's not even comparable to a dormant bacillus like anthrax because there is literally zero chance of infection of the host being infected, and a zero chance of infecting others unless direct action is taken by the "host".

Re:Infected?

[vought]

Apple is easier to target for malware writters anyway because their users typically do not run anti virus software and feel safe clicking on shit anyway because the genius at the Apple Store said they are secure.

Credibility fail troll. You meant trojan, right? Because zero Mac viruses (self-spreading and replicating) exist. There's one widespread Mac trojan which masqueraded as a Flash installer with an Adobe logo - because, you know, Mac users are all stupid and clicking on shit like installers from major software vendors.

Malware "writters" must be busy doing something else, eh?

Re:Infected?

[s.petry]

Just because you can run AV software on other operating systems is not reason to pay for and run AV software. You can purchase air conditioners and ship them to the Arctic and get the same effect. "But what if someone gets hot in the igloo? It could happen!"

Would I care if my actions screwed over a PC user? Sure I would, I'm human and have compassion. Does that mean I have to fix all of their problems at my expense? Not hardly. I educate them, and tell them to stop using Windows.

Re:Infected?

[Bobfrankly1]

Who cares? The important part is: Let Macs onto your mostly Windows network and you might get a not so fun surprise...

No, the important part is Sophos is using this information to attempt to sell anti-virus products. But they can't be too direct about it because there's a clear contradiction here. If Sophos products could stop the malware, then the Windows PCs are already safe. The infected files stored in a Macs web cache aren't going to magically leap across the network, but even if they did, the anti virus software on the Windows machine should catch it first. If the AV can't stop the infection, then why buy any additional copies?

Of course Sophos is using this information in an attempt to sell anti-virus products. That is their business. Sophos products DO stop the vast majority of malware, but only inept systems and/or security administrators would leave an attack vector open for later abuse. Sophos (like any other AV vendor) reacts to new threats as they are found in the wild. By closing any security holes you may have (including your OS X clients) you are much more likely to evade infection until your AV vendor updates their signatures.

But don't worry, the black hats love people like you. Save your money, don't buy security software, that way there's more to fleece from your bank account.

Re:Infected?

[interkin3tic]

There were other individuals who were aware they were spreading a deadly disease without changing jobs who were not incarcerated? From what I just read, it was the fact that she willfully endangered other people by adopting a false identity and working as a cook the second time that got her confined for life. She also refused treatment, though I'm not sure what that would have been.

I'd say it's not security theater. She was informed of what would happen if she worked as a cook, ignored it, and killed people as a result.

Re:Infected?

[mcgrew]

And maybe Microsoft should make their OS less prone to getting viruses? Yes, Windows' monopoly contributes to their being targeted, but there are millions of macs manufactured yearly.

Microsoft should stop hiding extensions so a user won't click on picture.jpg which is really named picture.jpg.exe.

Microsoft shouldn't have so many different kinds of executables (com, exe, scr, etc)

Microsoft should do away with all "active content". Data should be data and nothing else. You should not be able to contract a virus from a music file, but WMA files are infectable thanks to their DRM capabilities. Also note that you can rename a wma virus to MP3 and WiMP will happily play it anyway, no other music player I know of will do anything that stupid.

That's just off the top of my head. MS has gotten better at security, but they're still abysmal at it. I believe the reason is, they don't HAVE to be serious about security; every PC maker except Apple puts it on their equipment by default. So why should Microsoft care? It's not THEIR security.

Re:Infected?

[NatasRevol]

In other words, user intervention is required on the Mac side. Making this not-malware.

Re:Infected?

[quasipunk guy]

The majority are from flash and java and javascript exploits by driveby downloads from infected servers or ads.

I don't think that excludes shitty porn sites. I chose porn because ~70% of malware infestations I've encountered on customer computers appeared to have come from porn-related trojans.

Re:Infected?

[pr0fessor]

Wine and Crossover can run all kinds of windows software, not always with the same results as windows, but none the less they can be executed.

Re:Infected?

[Jackie_Chan_Fan]

I havent had viruses in years.

User accounts rule.

Re:Infected?

[pr0fessor]

A well installed and configured version of Wine works a lot better than it used to and I know plenty of people who have it on their linux box so they can play their favorite windows only games. I would not be surprised if the Mac or Linux versions could execute windows based malware with similar results to windows.

Re:Infected?

[Billly Gates]

Well there are now 3 known vulnerabilities on the mac platform. Flashback, Word 2004, and an iframe hack that FF and Safari can execute. Java itself only has 3 known issues yet is considered the most insecure plugin on the planet. Why? Because no one ever updates Java or they need an old version for the corporate crapware app like ADP for payroll.

To me it is simply irresponsible not too and Avast has a beta of their free anti virus program for MacOSX. They are more secure generally but its time users ran anti virus software on them. With few users running any protection it is just too easy of a target to ignore.

Flash is insecure and is on every mac and simply visiting a site will get you owned regardless of platform. Time to put the pride away and educate all mac users they need the same precautions they practiced on Windows. Trust me there is mac malware out there as I fix computers for a living.

Re:Infected?

[ewanm89]

It's been able to for quite some time, there is even a dynamic malware analysis tool that makes use of this: http://zerowine.sourceforge.net/

Re:Infected?

[Killjoy_NL]

If I have an infection that doesn't affect me but could kill you, then how responsible would I be if I came close enough to you to kill with it?
I would take precautions because I am not an asshole.

Re:Infected?

[multimediavt]

Your analogy still doesn't work. Yes, a carrier shows no symptoms but is infected, i.e., the virus is biologically active in the body (consuming, multiplying, etc.), but the host shows no symptoms of "illness". The operating system in this case (could be OS X, Linux, Solaris, Irix, AIX, BSD) is not infected. The virus is not active and is in fact harmless to the OS, as it's nothing more than binary data.

In this case, I would say the file system has some antisocial binary data in it that should not be shared with friends. This does underscore the need for antivirus for any OS, especially in a social network sharing kind of world we live in today. We never know what file in our file system might wreak havoc on someone else's.

Re:Infected?

[multimediavt]

Correct but it does indicate mac peeps aren't particularly careful about what they download or what sites they visit. This is going to cause them problems later when we see more mac malware.

Actually, I can name a few legitimate reasons why a Mac user may have a malicious Windows binary on their machine.

1. Clicked on a link and got the Windows [driver/self-extracting archive/app] because the link wasn't labeled as Windows only.
2. Clicked on a link and got the Windows [driver/self-extracting archive/app] because the link wasn't labeled as Windows only.
3. Clicked on a link and got the Windows [driver/self-extracting archive/app] because the link wasn't labeled as Windows only. ...

Seeing the pattern? And when this happens we either go, "Oops" click on the correct link and go on, or go "F@@k! Stupid Windows only util!". In both cases the misbegotten .EXE file stays in our Downloads folder until it gets cleaned out manually, or via virus scan. The odds on that type of thing getting shared is abysmally small. Any other type of infected file probably came from a friend that has Windows and is either an idiot or is infected and you got spammed from his Outlook contact db.

Re:Infected?

[0111 1110]

In 1906, a typhoid outbreak occurred in a household on Oyster Bay in Long Island where Mary Mallon had recently worked. The owner of the house hired Dr. George Soper, a famed sanitary engineer, to investigate the domestic epidemic.

He hired a janitor?

Re:Infected?

[pr0fessor]

Nifty. I wander if any of my friends have AV on their linux boxes I know they have a working versions of Wine. Now I'm curious to see if any of them have malware running in wine.

Re:Infected?

[ewanm89]

I've found some interesting pages on malware in wine: 2005 and 2007 (second is the one linked to in the wine FAQ).

Re:Infected?

[couchslug]

I used to think that, but I've been reloading PCs for friends kids and they've had plenty of malware, without porn in the browser history.

Re:Infected?

[Rosyna]

Actually,it probably got there because some infected windows host that was part of a botnet sent it via spam. In which case, the file is still just a useless bag of bytes stored with your email.

Re:Infected?

[jrumney]

They may only be able to carry the germ without symptoms, but that still sounds like an infection to me.

Is a file sitting in the browser cache really an infection? Plenty of malware will download to any browser, but if the vulnerabilities are not in the browser/JVM/Flash/PDF reader or whatever is being exploited to make the malware run, then it isn't really infecting the machine (though anti-virus software will still detect it and treat it as an infection).

Re:Infected?

[symbolset]

This is most likely the case. And the "some infected Windows host that was part of a botnet" was most likely: 1) your boss or coworker or 2) your mom or other family member. But they're no threat.

Re:Infected?

[symbolset]

If I put out rat food every day until the neighborhood was swarming with the little beasties, I'm pretty sure the neighbors are going to blame me for the rat problem.

Re:Infected?

[symbolset]

Just a-clicking on every little link without a care in the world: completely unaware that beneath every click - indeed, below the very useful content they enjoy - lurks a Minefield of Voracious vermin who would love to be feasting on their browser's entrails, "if" they were using Windows. They call it "browsing", as if they were in a nice shop picking up some brioche and a Pinot Noir. It's disgusting.

Re:Infected?

[wkcole]

...but how is it 'transmitted'? That implies an installed transmitter, ie. malware.

A lot of Windows malware is transmitted via email, because there's a long history of Windows mail clients (most importantly Microsoft's crapware) being directly vulnerable and/or facilitating deceptive mail.

I have a lot of Windows malware on my Macs because I have email addresses that have been used openly and actively for 20 years and so have made it onto all sorts of indiscriminate spamming lists that are used for malware distribution. Because mail abuse is a professional focus of mine, the archives of malware-bearing spam I have accumulated is a resource, not an infection. I'm not sure why anyone else would retain all of their junk forever, but many people do so. It is a rare hour when I can't identify a log entry from my mail server rejecting mail that is almost certain to be bearing malware, and a rare week when I don't have at least one spam slip through carrying some form of malware.

If you dig down past the click-bait page referenced in the /. submission, the original source of this story is a blog post by Graham Cluley at Sophos: http://nakedsecurity.sophos.com/2012/04/24/mac-malware-study/ and it includes a breakdown of the strains of Windows malware seen on Macs. The top 2 I recognize as mail-borne and some of the other named ones are likely to end up the browser cache of any carelessly wandering user. It is an act of irresponsible fearmongering by Cluley to say (as he does) in an unqualified way that these "can still be spread to others" and compare the 20% infection rate to the 20% rate of Chlamydia infection in young men in the UK. Those in men are infective, a Mac with a Windows trojan in its browser cache or junk mailbox is not.

Re:Infected?

[runningduck]

I finally installed a version of ClamAV on my Mac. I was surprised when it found more than a dozen viruses on my Mac. Interestingly these were all in my junk mail folder. I now do not feel so "infected".

Re:Infected?

[bruce_the_loon]

Actually it doesn't pay to show false positives as the default action is to destroy the infected file. If an AV company got caught deleting clean data, they would be ridiculed publically and possible be open for civil action.

Citation, McAfee and Microsoft's relatively recent debacles with false positives.

Re:Infected?

[dhaen]

Actually it doesn't pay to show false positives as the default action is to destroy the infected file. If an AV company got caught deleting clean data, they would be ridiculed publically and possible be open for civil action.

Citation, McAfee and Microsoft's relatively recent debacles with false positives.

That's true with your own data, but consider the others' data. Few will get far with a complaint that an email attachment got removed due to the company "security policy". For an exception, consider a home user who has switched from MS Windows. A few positive on his archived files will bring a smile of satisfaction that he made the right decision.

Re:Infected?

[giorgist]

In fact this is not a carrier, this is known as a natural reservoir. This does not infect the Macs, and they almost have no motive to deal with it.

Re:Infected?

[s.petry]

Sorry, but now you are just trolling. Flash vulnerabilities have been around for a long time for all Operating systems. Sun Flash was just as impacted as Linux, or Mac, or Windows. What is the difference in why and how they are exploited? Simple. Windows is the only OS that will give you ring 0 security when the script exploits are used. No other operating system will.

Your next argument, as you gave before "User space is dangerous". Um.. no, it should not be dangerous. It is in Windows, but it is not in any other Operating system. A nuisance yes, dangerous no. If you don't understand why that is, I'd recommend you start reading.

Re:Infected?

[Billly Gates]

Trolling?

IE is sandboxed and has not run on anything in ring 0 since the IE 6 on Windows 98. Even on XP IE 6 only uses the services it uses run on ring 0 which is a bad security practice too I may ad but that was 10 years ago.

Windows Vista and higher have UAC, DEP, ASLR, and sandboxing. I am not a troll at all but stating the truth that with a fully patched Windows 7 system with a good anti virus product that monitors behaviors is a pretty secure system. Flash and Java can still infect and go around the kernel and ring 0 through a buffer overflow or other memory corruption and the CPU will simply execute it without any check at all. This is true regardless of OS.

This is why an anti virus product is needed to monitor internal changes and block them on the Mac as well as Windows.

You are not superior at all and in the future more malware writters will target Apple because users like yourself think you do not need anti virus software and that they are always patched when Apple ends support after 3 years.

Re:Infected?

[bkcallahan]

iTyphoid Mary

Re:Infected?

[Anonymous Coward]

I finally installed a version of ClamAV on my Mac. I was surprised when it found more than a dozen viruses on my Mac. Interestingly these were all in my junk mail folder. I now do not feel so "infected".

Just to be sure that they really are malware, forward them to all Windows users you know to get their confirmation.

Re:Infected?

[nobodie]

It is not a useless bag of bytes if it is stored in a picture, chainletter, video of kittens that the mac user passes on. This has happened with my linux boxes at home where the kids ot wife get a file with cuteness and, thanks to the AV that i run even on my linux machines , i caught it and killed it. No it is malware and it can be passed on.

Linux malware

[Anonymous Coward]

It took me about an hour to track down and eliminate some windows malware running in wine. it turned my poor Linux box into a free p2p seeder for some freeium MMORPG. It ended up saturating my poor little cable modem until I clobbered it.

Re:Linux malware

[jones_supa]

Maybe he preferred a bit more discreet option than "nuking it from the orbit".

Re:Linux malware

[Culture20]

It took me about an hour to track down and eliminate some windows malware running in wine. it turned my poor Linux box into a free p2p seeder for some freeium MMORPG. It ended up saturating my poor little cable modem until I clobbered it.

Huh? Why would it take that long? Just rm ~/.wine, or sudo killall wine, and if all else fails sudo apt-get remove --purge wine or whatever your local package manager is.

AC notices his cable usage.
AC checks all of his computers to see which one is using the most bandwidth
AC discovers which computer is the culprit, then has to determine what program is using more than others (but probably not saturating his local connection to the cable modem, so not looking like a lot).
AC narrows it down to wine. Now how does the program start up, is it in cron? A shell start-up script? User or system? Did it replace an entry that already existed, thereby running both?
Maybe the AC wants to use wine for something (thus why it's installed), and setting up a blanket removal of all things wine would be overkill.

Re:Linux malware

[Anonymous Coward]

bingo. also 'netstat -pn' was rather helpful here. The evil windows app showed up as a process.

Of course I had to check 3 machines before I finally found the bad one. (stupid router firmware doesn't provide good bandwidth logs)

huh?

[Anonymous Coward]

Only one in 36? Sounds like a lot to me!

Passive carriers

[sandytaru]

Isn't that like 90% of tuberculosis infections? Many people are infected, but only ten percent or so ever develop an active infection, and the rest of them never develop the diseased form at all.

Re:Passive carriers

[oneiros27]

Yep. When I changed virus scanners a few years back, it found hundreds of infections on my system ... because I save my spam for when I need to train new filters.

The bigger problem is going to be people with infected files on a webserver that they're serving to the world ... JPEG exploits, word macro viruses, etc.

And it's compounded by the fact that some virus scanners don't bother scanning for older infections, so they can save CPU cycles & size of the virus definitions.

Re:Passive carriers

[Anonymous Coward]

This isn't even about being a passive carrier. Its a distribution vector.

The title is quite misleading. Its like saying 1 in 5 pig farmers carry a virus that affects pigs but not humans. Being a distribution vector is in no way being infected.

News break! 1 in 5 winter breezes are infected with influenza!

This is true.

[Tokerat]

I've run Macs most of my life, and recently backed up the entire contents of a machine to a Windows box with the space needed for the backup; close to a million files (app bundles contribute largely to this number), about 120 common-use files had various infections that Norton picked up.

Re:This is true.

[lennier1]

If even Norton picked up 120 infections imagine what a real scanner would've found.

Re:This is true.

[joemck]

Yeah, I've got plenty of Windows viruses on my Mac, and my Linux box too. Downloaded intentionally for the purpose of dragging into Windows VMs to see what they do. Then I promptly forget to delete them from the host OS because they're harmless there, and I have 5.5 TB of space.

Re:This is true.

[Matheus]

So my question... what are the stats for Windows hosts (infected / most likely infected)?

1/5 Macs have Windows malware. Disturbing percentage unless you consider the fact most Mac users don't install Anti-Virus because they don't feel the need. Ergo, any Malware floating around the usual channels will find its way to their host and stick there.

I'd rather compare that number (1/5) and the 1/36 number of actual Mac viruses to the current infection rate of PCs... ? Are they closer to the 1/5 or the 1/36 or some other relevant number?

Confirmation Bias - better title

[Qwerpafw]

One in five macs where people chose to install antivirus software have (inactive) Windows malware.

Which is a bit like saying "one in five cars brought to the mechanic get serviced for something." The survey is skewed due to the sample group - most Mac users never install any anti-virus software.

The only places I've seen it installed are on computers in corporate environments where there are already viruses being passed around commonly via email attachment, USB stick, and network drives. These places install antivirus on Macs so users don't forward a virus to Windows users - and it sounds like from this survey, that's with good reason.

Apple's Mail software (and Microsoft's Outlook for Mac) cache attachments locally on the user's disk, so it's very easy to "have" malware and viruses if you just receive email (even without opening it).

It's a bit ridiculous to claim they are "infected" however, and again, the sample group is not really representative. That said, I don't think Macs are in any way immune from viruses. Apple's iOS-like sandboxing and signed-app requirements would likely help OS X considerably in this regard, but of course every decision that increases security by removing control from the user also infuriates free/open software proponents and hackers. Think of jailbreaking iOS and how Apple patches security holes - this is maddening for people who want to jailbreak, but is ultimately an attempt to fix a potential infection vector.

Re:Confirmation Bias - better title

[mikael_j]

Apple's iOS-like sandboxing and signed-app requirements would likely help OS X considerably in this regard, but of course every decision that increases security by removing control from the user also infuriates free/open software proponents and hackers.

Changes in 10.8 won't remove control from the user, any admin user (which for home users is the same as "the user" unless they asked a cousin or someone to set things up for them) can change the settings, it just defaults to "block unsigned". It's a setting, you can turn it up and only allow app store downloads and you can turn it off completely.

Re:Confirmation Bias - better title

[drinkypoo]

They are infected, though they don't have any symptoms; they are still carriers.

Re:Confirmation Bias - better title

[Gaygirlie]

It's an infection only if the code runs. If the files just lie dormant somewhere and cannot run on the system at all then it's not an infection.

Re:Confirmation Bias - better title

[elsurexiste]

One in five macs where people chose to install antivirus software have (inactive) Windows malware. [...] the sample group is not really representative.

It's true that this applies to all Macs that have an antivirus, but I'll answer your claim of not being representative with a healthy [Citation needed].

Re:Confirmation Bias - better title

[Tharsman]

Interesting tidbit I noticed: only about 1% of macs were infected by flashback.

From the users than installed the free antivirus (that appears to also be spyware) 2.7% had flashback.

My theory? Users that installed this thing re 170% more likely to get infected by a trojan than the average mac user. They are also likely to have an inbox full of exe attachments.

Re:Confirmation Bias - better title

[drinkypoo]

It's an infection only if the code runs.

And it's only Herpes if you have a visible, weeping sore, right?

Re:Confirmation Bias - better title

[Gaygirlie]

No, in a human the virus would be "running." If you want to compare this with herpes it'd be akin to carrying a container with herpes virus in your pants, ie. you wouldn't have an infection yourself.

a marketing opportunity

[Anonymous Coward]

study shows 1 in 5 macs have software they can't even run, because it is written for windows. get vmware / parallels and start running ALL the software already on your mac -- seamlessly!

Re:Maybe it's time to get a new Mac

[Bobfrankly1]

I'd mod this funny, but I'm out of mod points...

Re:Antivirus Software on a Mac

[tripleevenfall]

It's always been a good idea to have a virus scanner on a Mac - at the very least, it's a courtesy to users of other platforms who may be more vulnerable to any infectious crap you may pick up without realizing.

(I use OSX exclusively at home)

You want me to pay for an antivirus suite, or devote system resources to it all the time, as 'courtesy to users of other platforms'?

Nah. I'm good.

Re:Antivirus Software on a Mac

[phantomfive]

There are those who believe that having a virus scanner anywhere is a bad idea. Especially something like Symantec, which can slow your computer down more than many viruses.

More marketing ......

[King_TJ]

The last sentence in the article makes their motives clear: “What Mac users really need to do is protect their computers now or risk allowing the malware problem on Macs to become as big as the problem on PCs in the future.”

Sophos simply wants to scare up some more business selling Mac business users their anti-virus software. (At least right now, home users can get it from them for free, at: http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-edition.aspx)

I'm in no position to challenge their numbers, but even "1 in 36 Macs" having a Mac specific infection seems awfully high to me. Maybe this last trojan horse that made the rounds pushed that number way up ... but I haven't encountered a single Mac that was infected yet, out of the ones my co-workers own (and always ask me for help with when they have problems), out of the ones we use at home, or out of the ones I support for clients in my side job. I don't think any of my Mac using friends on Facebook mentioned problems with it either.

Regardless? The concern of Macs harboring Windows malware is nothing new... That's been a potential issue for as long as I can remember. I recall the office running Norton anti-virus for the Mac on iMac G3 machines running MacOS 8.6 and 9.1, at one of my old jobs, just for that reason. They didn't want to accidentally spread an infected file they might have gotten via email to a Windows recipient.

The main reason Mac users stopped that practice, as I recall, was the really poor quality of most anti-virus packages when OS X came out. Apple even gave away copies of Virex for OS X to .Mac account holders at one time, and the software bogged down and destabilized the machines so badly, everyone I knew removed it in a matter of days!

Re:More marketing ......

[masternerdguy]

I know someone who had that Mac trojan.

Re:More marketing ......

[Guppy06]

I haven't encountered a single Mac that was infected yet

Did you actually look, or do you simply equate "no complaints from the end-user" with "not infected?"

Re:More marketing ......

[s.petry]

Honestly, trojans are simple to create for any operating system. The hard part is getting users to run the install which actually infects the system.

Like with Linux, OS-X user space is protected from system space. non-root access means very minimum damage to a system.

Back about 15 years ago, I wrote a proof of concept virus for Unix. It modified user start up files to run, and just needed a port above 1024 on the network to listen for C&C. The amount of work it took was pretty incredible, but it's possible. You can't however run spam relays and such since those ports are protected. The only thing one could actually damage was world writable directory files and directories, and the user space that ran the code. A "System" was not a real target, unless that is, some poor sod went against best practices and did everything on the system as root. OS-X would be the same way.

The real thing that people try to do with AV for *nix and Mac is protect PCs from being infected. If a Mac user sent a Windows user a file that was infected, even though it did nothing on the Mac, it would be the Mac users fault.

This is the marketing game being played for 10+ years. More FUD increases that revenue.

Re:More marketing ......

[Vegemeister]

non-root access means very minimum damage to a system

Hahahahaha no.

Non-root access is sufficient to blow away the user's documents and snarf their passwords. The only thing root lets you do is screw with the other users. But most desktops are single-user machines.

Re:More marketing ......

[cbhacking]

Non-root access makes it more difficult to hide the infection, or cause it to resist deletion (rootkit). However, it's entirely possible for malware to obtain root access with your unknowing cooperation.

1. In a writable, executable location (the user folder works, on most Linux installs), install a program (a script would probably work) called "sudo".
2. Modify the user's profile so that, at login, either their PATH now includes the location fo that sudo, or "sudo" becomes an alias for the malware version.
3. Wait until the user tries to do something as root.
4. Steal the credentials they type into "sudo" and store them.
5. Pass along the credentials to the real sudo program, so the user doesn't know anything went wrong.
6. Install rootkit with your new access to root permissions!

While you're at it, do the same with su and kdesu and whatever the graphical privilege-elevation-credential-prompt programs are for other desktop environments.

Re:Antivirus Software on a Mac

[robinsonne]

Unless you're a business, why would you pay for an AV suite in this day and age?

Unless you're running some old crappy Mac from 8 years ago, why would your big bad super duper Mac even notice the miniscule amount of system resources devoted?

You don't have a problem infecting other people's computers? Thanks a bunch!

Re:Antivirus Software on a Mac

[beckett]

Sophos also recommends this. However, should one really sign up for a subscription of virus signatures for operating systems they don't use? I don't carry an Epi-Pen around just because I happen to be eating at a restaurant where other people might have peanut allergies.

You're free to run whatever software you'd like on your computer. However, this article is long on FUD, and as a fortunate side effect for Sophos, hundreds of thousands of mac users have downloaded their antivirus software. There is an inherent responsibility and conflict-of-interest in a researcher working in a for-profit company recommending their own software.

Re:Antivirus Software on a Mac

[w_dragon]

I'm not worried about the virus slowing down my computer, I'm worried about it storing kiddie porn on my computer, or stealing documents, or blowing a bunch of bandwidth for a DDOS attack.

Best practices say: Run antivirus!

[williamyf]

No matter if your OS is Windows 5.x, 6.x, Mac OS X 10.x or GNU/Linux Kernel 2.4.x or 2.6.x. If your machine is a desktop run an antivirus.

You owe it to the rest of the world to exterminate viruses/trojans/malware, both the many (or few) that your machine is susceptible to, as well as those that, even though will not infect your machine, will be passed on to someone else... ...because YOU, saavy and enlightened slashdot user, did not catch and exterminated them.

Do it for the unwashed masses, that are clogging the pipes with port scans and attempts to infect, do it to have a tad fewer cheap viagra/penis enlargement offers in your spam folder... do it for the children!!!! :-)

If you "feel confident" (note the quotes) that your OS is "safe", that you use "safe practices", and the AV is a "Waste of resources", then fine, get an AV with a small footprint, both in system resorurces, and in $£¥€, and run it while you are sleeping, so it does not affect your daily work routine.

I am writing this fom Firefox 10.0.3 esr in a Mac with 10.6.8, and I am not scared at all about these developments, but, as safe practice, run ClamXav manually. I scan my machine and its external hard-drives every night, and scan smaller/unknown removable media every time it is inserted. ;-)

So, please my Linux and Mac OS X brothers and sisters, stop being a bunch of snobs, get on with the program, and run an antivirus. :-)

--

Re:Best practices say: Run antivirus!

[ratbag]

As a service to your brethren, could you let us know the hit rates from Clam on your Mac?

1. In files only available to your Mac
2. In files shared between Mac and Windows (VM/Boot camp etc.)
3. Viruses that can affect your Mac
4. Viruses that you are just a carrier for.

Re:Best practices say: Run antivirus!

[RazorSharp]

It sounds like you work for Norton. Maybe your tin-foil hat is just a tad too tight and it's cutting off circulation.

1. A couple times a year I do some spring cleaning and make sure I'm not running anything I don't want to be. Usually this is just stuff I don't use anymore. Then there's cookies.

2. The last thing I'm worried about when I'm getting ready to go to bed is whether some piece of spam contains a trojan horse I'll never open. Actually, my spam folder is empty. I must be doing some(multiple)thing right. Setting up your browser correctly will do you more good than scanning your computer for viruses every night. Staying off Facebook and porn sights helps, too.

3. I don't owe shit to the rest of the world. I didn't tell those jackasses to go buy Windows and spend all their time on Facebook. Your FUD won't make me pity them.

Re:Best practices say: Run antivirus!

[williamyf]

As a service to your brethren, could you let us know the hit rates from Clam on your Mac?

1. In files only available to your Mac
2. In files shared between Mac and Windows (VM/Boot camp etc.)
3. Viruses that can affect your Mac
4. Viruses that you are just a carrier for.

On all four counts, the number is 0.

All I've got up until now is false positives from the days of yore, when I used MS-DOS, and was interested in viruses and anti-viruses

Remember things like Flu-Shot plus, the pakistani virus and it's remover programs, or the ping-pong virus and it's removal programs? All safely tucked away in a folder named dviej (oldhdd in English) from the time of my DTK-286 with amber monitor and Ati Wonder (not EGAwonder, not VGAwonder, just plain wonder) card, MS-DOS 6.22 and Windows 3.0.

I set exceptions for that folder on all my windows machines (from my DEC Starion 700i, then my Thinkpad i series, then my Toshiba), but in the MAC, I got lazy about it, so, as ClamAV's signature files refine, I finds more and more of this legacy code, and let ClamXav erase the files, since I realize I have no use for them anymore.

The last time I was hit by a virus, was in 1996, it ate my hard drive, and my thesis with it, lucky me, I had backups on my paralel port Travan Tape Drive, so, all that was lost was a day of work (to restore) + 1 day of updates on the thesis docs...

And that's the other lesson, have good backups!

I know my Mac is less susceptible to virus/trojans/worms, I also use safe practices when browsing/downloading files, but nonetheless, I do not kid myself thinking that this alone is enough, so, on top of that, I run an Antivirus, have the SW firewall enabled, and run a firewall on my AP.

Re:Best practices say: Run antivirus!

[williamyf]

Yes, that's why I checked for the presence of the virus using the command line instructions given by many antivirus firms, and was ready to carry out the manual elimination instructions, if needed be.

Lucky for me, I use safe practices when browsing the net/downloading programs, so I was not infected. The point is, even when you _think_ your practices are safe, and even if you _think_ your platform is less susceptible to virus/trojans/worms, you still need antivirus and firewalls as part of those safe practices, do not kid yourself.

Re:Best practices say: Run antivirus!

[williamyf]

Can you explain where you learned maths? I still don't understand how less than 5% of world PC population (nerds) scanning their machines will save the other 95% who don't even know what a virus is?

I learned my maths at Universidad Simón Bolívar, and was very good at them, from calculus (math1), to imaginary numbers in multivariable calculus (math 6). Then along came fourier (math7), and my brain crapped (in reality, I got lazy, really lazy for a while)... but mind you, I eventually recovered, and became an electronics engineer.

Having said that, I wrote: "do it to have a TAD fewer cheap viagra/penis enlargement offers in your spam folder... DO IT FOR THE CHILDREN!!!! :-)" (uppercase added for this comment).

Please notice that I said a tad less, not eliminate all, and.. How can you refuse to do something for the children?!?!?! You Monster!!!!

No I do not think that 5% of us nerds will save 95% of all machines, but Macs are ~10% of all PCs globaly (something like 16-20% in the US), and Linux hovers around 5%.

But more worrisome is the effect we enlightened slashdot users have when our less enlightened breathen realizes that we do not do backups, and do not run antivirus, and guess what, neither will they... and when their machines crap out.. who are they gonna call? Well not the ghostbusters, but you and me!

I know your post was done in good humour, so I am replying in kind.

Re:Best practices say: Run antivirus!

[williamyf]

No, I did not!

I wrote: "do it to have a TAD fewer cheap viagra/penis enlargement offers in your spam folder... DO IT FOR THE CHILDREN!!!! :-)" (uppercase added for this comment). ;-)

I _think_ you wrote in good humour, so I am replying in kind.

Re:Best practices say: Run antivirus!

[williamyf]

If I worked for Norton, I would not be telling people I run ClamXav on my Mac. And I run Windows Security Essentials on my Windows 7 Machines (my folks, actually).

Do not worry about my facebook habits, yes I go there, but httpsEveryWhere, Noscript and AdBlockPlus are my friends too.

Point number 3 hints to trollish behaviour, but, FWIW, I've given you the benefit of the doubt, therefore, this reply.

I'm blaming Paul Allen

[smittyoneeach]

For the sake of variety.

And Windows has less than 1% infection rate?

[Drethon]

Just curious...

Error in summary.

[Annirak]

One in five Apple Macs is infected with malware, according to Sophos. But most of that is harmless to the Mac... it is Windows malware ready to be transmitted to the Windows population. OnlyOne in 36 Macs has OS X specific infections.

FTFY. A 2.8% infection rate is pretty significant.

Re:Error in summary.

[6ULDV8]

75% of that 2.8% figure is the Flashback trojan. If they haven't patched or upgraded by now, they are not likely to do so.

Re:Antivirus Software on a Mac

[Samalie]

You know what? Stop surfing to fucking dodgy porn sites (or other dodgy sites of questionable content) and you won't get infected whether or not Mr. Mac up above runs antivirus software on his macbook pro.

Stop clicking on every fucking popup too.

Numbers skewed?

[FreshlyShornBalls]

Only one in five? I'm guessing they got their numbers from Macs with Sophos installed. That should have made it a solid five in five.

Subject

[Hatechall]

So 20% macs have infections on it that they have no reason to counter. Woo. A stat like how many would actually make it onto a system that would have a reason to guard against that virus would be an important stat to guestimate. If you assume there are hardly any windows machines with rudimentary enough security to accept the majority of these viruses to begin with - a story which would sync with known windows infection rates -, this becomes a nonstory. But this essential fact wasn't looked at, making this entire story worthless propaganda.

Re:Infected? No, contaminated.

[MROD]

It's actually the wrong terminology.

The Mac system has been contaminated with the Windows virus, which, to use the "viral" analogue, doesn't have the correct DNA to infect the host.

In the same way that a farmer which has been handling sheep with Foot and Mouth disease can become contaminated and pass the infection onto another sheep the Macs which have been contaminated with the disease can potentially pass the infection on, especially if it's infected Microsoft Office documents.

Re:Antivirus Software on a Mac

[tripleevenfall]

I don't use p2p, I don't use pron sites, and I don't use Windows or IE. Viruses aren't really a part of my life.

Don't ask me to pay for the shortcomings of the platform you've chosen.

how do they know?

[jsepeta]

I'm sure Sophos' sample size is too small to be of any use. Hardly anyone knows who Sophos is or uses their antivirus. I like it, but I haven't run AV on my Mac since moving to OSX 10.3 when Norton failed to make the jump in a timely manner. And I've never seen Macs on OSX brought down as hard as PC's on XP.

Don't forget, Malware & Trojans are a different beast than viruses. A lot of viruses can spread just by the fact that your Windows PC is connected to the same network as an infected PC. This does not happen to Macs with OSX, no matter how loudly Leo Laporte whines about it. Or Sophos.

Re:how do they know?

[jsepeta]

sure, many Macs I serviced in the 1990's held Microsoft Office macro viruses, but as the users on those computers were mostly graphic designers, they weren't bothered by what the business people did on the other side of the advertising/communications firm. We ran antivirus regularly back then (MacOS 7,8, 8.5, 9, etc) but since moving to OSX, I have yet to run into one Mac that's been brought down by a virus. Not bad for my last decade of computer support. Compare that to the corporate shenanigans that went on with Windows 98 & Windows XP... on machines that HAD installed antivirus, being infected by new strains that Symantec/Norton was dragging their feet to fix.

Another thing that Sophos and the MacBreak Weekly podcast seem to overlook is the fact that there are now millions more Macs than ever before. Apple's iDevices have spurred an upswing in Apple computer purchases, and discounting the iDevices themselves, Apple is still earning decent revenue on their computers (which mostly sell with a 30% markup).

Re:Antivirus Software on a Mac

[E-Rock]

That's not true any more. Most of the infections we have to address at work are coming through the ad networks. A harmless site spinning content from a company that puts up anything where a check clears. Local radio stations are the worst with a little player surrounded by ads from various providers.

Re:Antivirus Software on a Mac

[tommy8]

I surf porn sites all the time and I've never gotten a virus

Where is this malware anyway? The browser cache?

[AC-x]

I still can't decipher where exactly this malware is on OSX, I suppose it's just sitting harmlessly in the browser's cache?

Re:Antivirus Software on a Mac

[Guppy06]

Avoiding anti-malware in order to "enhance performance" is about as rational and well-planned as avoiding condoms for the same reason, and generally produces the same results.

Re:Antivirus Software on a Mac

[FranktehReaver]

Who said pay? There are plenty of free versions for Mac available that you do not have to pay for that work just fine. You can continue to stick your nose up and walk by everyone else but the fact of the matter is there are more malicious software files written today for Macs and it is exponentially increasing. Having a anti-virus/mal-ware software on the machine wouldn't hurt but rather add an extra layer of security on your machine. Why sit there in your armored car laughing at normal cars thinking your king of the world until a tank turns the corner and explodes your world and you sit there wondering wtf happened? Nothing is 100% safe but having nothing to detect the threats makes you 100% unaware of what is really happening on your machine. Security through obscurity is fine and dandy but I will add an extra layer of defense to my computer thank you very much.

Re:Antivirus Software on a Mac

[phantomfive]

Avoiding anti-malware in order to "enhance performance" is about as rational and well-planned as avoiding condoms for the same reason, and generally produces the same results.

A statement that demonstrates this point: "analogies are like nuclear weapons: you can use them to avoid making a good argument."

Re:Antivirus Software on a Mac

[Gr8Apes]

Nah, no need, not even at a business level. Note that there are no known viruses for OSX, and a properly configured mac makes even malware difficult to run.

All that aside, this article is extremely suspect - 1 in 36 macs were infected with malware? 600K macs estimated to be infected with flashback, the only really known problem malware at the moment. So that would indicate about 22 million macs according to the story. According to Apple's Q1 2012 results, they sold over 5 million macs just this quarter, meaning that this article is saying 25% of the macs out there were sold this quarter? Of course, Sophos sells "security" software, so is this a surprise?

Re:Antivirus Software on a Mac

[DamonHD]

Infection via legitimate ad channels on respectable sites is not unknown.

Rgds

Damon

Re:Antivirus Software on a Mac

[mark-t]

It's always been a good idea to have a virus scanner on a Mac - at the very least, it's a courtesy to users of other platforms who may be more vulnerable to any infectious crap you may pick up without realizing.

Sure... when people who run other platforms that are more susceptible to viruses start paying me for the CPU time and other computing resources that the virus scanner must utilize on a system that *I* paid for.

Re:Antivirus Software on a Mac

[Guppy06]

Whatever makes you feel better, just remember to pull out before the scripts load; that always works.

Re:Antivirus Software on a Mac

[Anonymous Coward]

I don't use p2p, I don't use pron sites, and I don't use Windows or IE. Viruses aren't really a part of my life.

Don't ask me to pay for the shortcomings of the platform you've chosen.

That's idiotic. For one example, Flashback relied on none of those things. Viruses and malware don't just come from porn sites or file sharing, and Windows and IE aren't the only pieces of software with vulnerabilities. So you don't use email? You never open attachments? You don't click on links, you manually type in every address you go to? You don't use flash drives? There's a countless number of attack vectors from a countless number of sources.

Re:Antivirus Software on a Mac

[mark-t]

There's something fundamentally flawed with what amounts to using an elaborate grep command to ensure computer security.

Re:Antivirus Software on a Mac

[TheNinjaroach]

I like your analogy to condoms. I don't use them because there are better solutions to birth control. Same goes for anti-malware, you can avoid it altogether by making better choices when it comes to the software that you run on your computer.

Re:Where is this malware anyway? The browser cache

[93 Escort Wagon]

I still can't decipher where exactly this malware is on OSX, I suppose it's just sitting harmlessly in the browser's cache?

Macs (and Unix boxes) might also harbor infected MS Office docs.

We had this problem a few years back - one of our end users repeatedly would get his box thoroughly infected. His group shared a workspace drive that was on a Linux box running Samba. He'd upload a doc that'd sit there, biding its time on the Linux box, until one of the other users grabbed it - then they'd either get a pop-up from their antivirus, or they'd get hosed themselves.

I'm not a Windows sysadmin, so I found the whole thing rather funny - but my Windows compadres didn't see the humor in it.

Re:Antivirus Software on a Mac

[bdabautcb]

Good analogy...

Re:Antivirus Software on a Mac

[mark-t]

You can avoid condoms safely... you just have to avoid having sex with people you can't say are certainly uninfected, abstaining entirely if you must.

Interestingly enough, that analogy is still actually applicable back to avoiding anti-malware... you just avoid doing the things that are liable to result in infection.

Re:Antivirus Software on a Mac

[Guppy06]

I like your analogy to condoms. I don't use them because there are better solutions to birth control.

/facepalm

you can avoid it altogether by making better choices when it comes to the software that you run on your computer

"She looks clean."

Re:Antivirus Software on a Mac

[Guppy06]

You can avoid condoms safely... you just have to avoid having sex with people you can't say are certainly uninfected, abstaining entirely if you must.

And, similarly, you can safely avoid antivirus software provided you abstain from connecting your computer to anything, and pre-screening any and all new software on a system that does have anti-malware tools.

But the people who avoid anti-malware software because of performance issues also tend to be the ones engaging in the riskiest behavior, such as connecting to random LANs for gaming. And so the ones who proudly boast this behavior should be avoided like the plague-carriers they are.

global warming

[OrangeTide]

Why should I waste electricity scanning for viruses that can't infect my computer?

Re:global warming

[williamyf]

Why should I waste electricity scanning for viruses that can't infect my computer?

Because the cost of that electricity is marginal to the electricity you consume while torrenting huge DVD-ISO Linux distros and LibreOffice and Android source files overnight to help test and debug them... ;-)

I know your comment was done in good humour, and I am replying in kind.

Wait, what?

[bmo]

Cluley adds that while the spread of malware to and from Macs is no different than that for Windows computers, a lack of anti-virus implementation means that it sticks around for longer. Some samples collected by Sophos found malware dating back to 2007.

For shits and giggles, I ran a scan on my email archive, some of which dates back to 1994, and it resides on a linux machine.

I found *two* Windows trojans.

I didn't bother removing them. So this means I'm infected?

What a load of horse-pucky.

--
BMO

Re:Wait, what?

[bmo]

>no, it means you're a fucking loser.

Stay mad, brah. Let the butthurt flow through you. Good, good.

--
BMO

Re:Wait, what?

[bmo]

>Why did you waste time looking for two trojans and not remove them?

Honest answer? It's too much trouble to load the thing in vi and edit it out. Clamav doesn't remove it automatically, which is good, because I'd not like it to fuck with the archive, tyvm.

>I'm shocked you didn't immediately forward those messages to everyone you know.

honestly, now.

--
BMO

Re:Antivirus Software on a Mac

[tripleevenfall]

No, I don't use flash drives or open email attachments that aren't from trusted senders or use p2p specifically for that reason.

I think the real truth is, if have some computer savvy and you use a little common sense your chances of getting a virus even on Windows is pretty low.

Because most of it is due to user stupidity, I simply don't feel bad at all about not running virus software on my Mac so Windows users can continue to click "happybirthday.jpg.exe" when it shows up in their email.

Re:Infected? No, contaminated.

[Wild_dog!]

Contaminated is actually a more apt description as you say although even if contaminated it can't rub off as Foot and Mouth contamination can exactly.

Re:Antivirus Software on a Mac

[mark-t]

And, similarly, you can safely avoid antivirus software provided you abstain from connecting your computer to anything

Where it can be shown that the mere act of simply connecting the computer to a network creates a clear and present infection risk, then yes. Windows isn't *QUITE* that bad... at least not when coupled with sound administrative practices (not visiting unknown websites, avoiding software that has not prescreened, users not having administrative privileges, etc).

Re:Antivirus Software on a Mac

[supercrisp]

Setting up ClamXav to scan the folders likely to be infected is a bit of a drag, but it's not much of a drag on system resources. I did this last week after a scan flagged some files on my Macbook as infected. They were mostly e-mail attachments from students and FLV files I'd gotten via Facebook posts. I figured that, since I share files quite a lot with colleagues, it'd be a good idea to check myself. The nice thing with ClamXav is that you can set it to scan lots or a little; it's not like that godawful stuff on Windows that seems designed to frack up your machine (excluding Security Essentials, which is very nice). The end result is a negligible drag on my processor, less than 1% if top is right, and I'm checking a very full list of candidate folders: all the launchagents, caches, internet plug-ins, along with obvious spots like ~/Downloads and the Mail.app attachments folder. I've been having ClamXav doing a full similar set of scans on an PPC machine for years now. It's a dual G4 500MHz machine, which is pretty weak by today's standards, yet ClamXav's process barely registers in top on it.

Re:Antivirus Software on a Mac

[supercrisp]

I surf some sleazy websites, but my infections have come from e-mail attachments sent by coworkers and from a couple of flash videos I snagged from YouTube. All of the skanky pr0n I've downloaded seems to have been disease free.

Re:Antivirus Software on a Mac

[robinsonne]

Maybe you've been living under a rock for the last few years, but "happybirthday.jpg.exe" hasn't been a big attack vector for a long time.

Most of the infections I've seen in the past 3-4 years have been from some dodgy ad on otherwise legitimate sites exploiting a security hole somewhere. News sites are common for that, or anywhere else where lots of people visit (don't even get me started about facebook).

Malware aren't usually out to pwn the computer for the lulz anymore. It's about expanding their botnets for spam ($$$), or getting credit cards from people ($$$). No system in the world is going to protect a user that decides they want to give their CC# for something.

Re:Infected? No, contaminated.

[calyphus]

"can potentially pass the infection on," How? The entire pathogen analogy is invalid in this case. Biological pathogens put into an environment that doesn't support them die. The same is true of a malware file downloaded to a Mac. It's dead. The malware delivery truck went over the side of 1000 meter cliff and left bits of nothing significant, just some file clutter.

Statistics

[Tarlus]

One in eight statistical analyses are made up on the spot.

Tyhpoid mary has become

[Registered Coward v2]

Typhoid Macintosh. Seriously, this is nothing new - years ago when I did some publishing on the Mac we'd often get Word docs infected with various stuff; it got to the point we simply ignored the warnings since even when we emailed the author a warning we'd often get another article with the same infection.

No background scanning

[DrYak]

Well technically, as most of said viruses are Windows binary, they won't run on an actual non windows OS. (I mean outside of some virtualised box).

Thus you don't really need to constantly have background analysis turned on: because there's no running viruss that needs to be unmasked, or exploits that need to be prevented before accessing a compromised file.

What you need, to do a 'courtesy to other platform' is simply scanning at the entry point.
Use a plugins like Fireclam on FireFox so any newly downloaded file is checked.
Do something similar with your P2P client.
Now you've covered most source of new malware.

Also, add an option to scan plugged in media, if you're into sneakernet too.

Re:Antivirus Software on a Mac

[mcgrew]

That's your prob, Bob. I'm not the one who neglected to wipe a poorly written piece of shit OS for one that actually works, and not only works but works how I want it to work.

You don't want me giving you viruses? Get rid of your OS. It sucks. It's not MY fault that your OS is insecure. You don't want to catch the flu from me? Get a flu shot, same thing.

Re:Antivirus Software on a Mac

[tripleevenfall]

I run adblock and flashblock at all times. I also do not use IE, I don't have Adobe et al. installed, JRE and the OS itself are kept meticulously updated.

In a larger sense - in all my years of home computing under Windows, almost all of that time running Norton or later McAfee - I never got a virus warning.

Call me crazy, but it doesn't seem like most people have virus issues unless they engage in high risk behavior.

Re:Antivirus Software on a Mac

[Killjoy_NL]

But but but, digital vaccinations cause digital autism :D

Re:Antivirus Software on a Mac

[GrumpySteen]

http://blog.chron.com/techblog/2008/07/average-time-to-infection-4-minutes/

That's about XP, mind you. I can't find where anyone has done a similar test with Windows 7, but Windows 7 continues has had its fair share of buffer overrun issues that didn't require user intervention to be exploited.. Only a fool would think that the last patch cycle had finally fixed them all and perfected the OS.

Re:Infected? No, contaminated.

[MROD]

An example could be an infected word document which requires Visual Basic scripting to cause the agent to run won't work on the Mac version of Microsoft Office. However, the "DNA" of the infection will stay in the file harmlessly until such time as it is transported to a PC and opened within the Windows version of Microsoft Office, which does have the scripting language available.

It is true that most of the drive-by attempted infections will fail, as do most biological attempted infections by viruses when they land on the wrong host.

Re:Antivirus Software on a Mac

[multimediavt]

Avoiding anti-malware in order to "enhance performance" is about as rational and well-planned as avoiding condoms for the same reason, and generally produces the same results.

My machine could get pregnant? What?! What?! What?!

Re:Antivirus Software on a Mac

[mark-t]

It's fixed enough of them that the simple act of hooking a (up-to-date patched) windows xp computer up to a network does not tend to compromise it.

read the original blog

[pbjones]

'Infected by Malware' means that the Malware was able to attempt to do stuff on a Mac and left a couple of signature files(?) but the Malware would have stopped because it wasn't running on Windoze. 'Potential' vector for Malware, means that they don't have evidence that people do this, but it's possible, it's also possible for Mac users to pass bad Word or PDF files onto other systems. So the lesson here is buy their product (sarcasm) and this will make the world safer for Windoze users and Mac users. As for Flashback, a sad tale where not patching Java, and stupid users, mainly those that frequent sites in Europe/Russia, have caught a bug, life goes on.

Clients should insist that Carriers get vaccinated

[louCostello]

We saw this in action in our Graphic Design classes. The class size was 25, with 20 Macs, and 5 PC's, we found the PC's were constantly being attacked. Fortunately the PC users had protected themselves, but eventually a mistake was made and one got infected. That person lost their computer for three days, and almost pulled down an ongoing project involving the entire class. Once he figured out what hit him, we started a search and found 15 of the Macs carried the virus. Once found it took only a few minutes to purge the malware from all the Macs. But...the original reaction from the Mac users was essentially "bummer pc dudes, buy a mac," however the pc folks pointed out their entire class project almost failed because of their not practicing safe computing. Next we pointed out that most of the folks they were working for outside the class were pc users, and every time they sent a presentation or passed a usb drive at a customer site, they most likely spread the infection. Panic ensued as they immediately begin reaching out to their clients. That was when they really learned the hard lesson of being a carrier. In the end only one Mac student purchased a form of protection. So if you're a client using a service provided by a Mac environment, be very wary, and perhaps add into your requirements that the service provider demonstrate they are aware of this risk and have taken steps to minimize it. If they don't, then move on.

That low

[russotto]

My spam folder (on my Mac) at any given time usually has some windows malware in it. Who cares?

And This Is The GOOD News?

[rueger]

"...one in 36 Macs has OS X specific infections..."

Ah yes, only in Mac-land would they spin that into a positive!

Re:Antivirus Software on a Mac

[phantomfive]

Thanks

Re:I have some, and I don't care

[williamyf]

As for new threats...the last round of Mac malware got right by every antivirus vendor out there, too. By the time the part-time intern that Symantec has working on their Mac version came back from Spring Break and added a definition, Apple itself had finally released a removal tool.

True, and yet, apple released a removal tool, all antiviruses now detect the threat because all the interns are back from spring break, and yet, the botnet keeps going strong and even growing a bit...

What that tells you is that people do not run antivirus, nor do they apply patches...

We teach with example, you know?

If you touch a piece of shit...

[issicus]

wash your hands, that's what my mom taught me, I don't do ether of those things though.

Re:Antivirus Software on a Mac

[Gr8Apes]

Note that there are no known viruses for OSX, and a properly configured mac makes even malware difficult to run.

600K macs estimated to be infected with flashback, the only really known problem malware at the moment.

Off the top of my head, there's also Flshplyr, SabPub and Maljava. If you don't keep up with the tech world, at least check your facts before getting on your soapbox. There's been PLENTY of OSX malware, mostly trojans and scareware - the aforementioned, Dloadr, FakeAv, Miner, Imuler, Renepo. Yes, there have been viruses, worms and malware for OSX. This is a matter of indisputable fact. This is not the first, it's not the only vulnerability currently out there. None of this is news.

• Flshplyr - Trojan 2012 (Java)
• SabPub - Trojan 2012 (Java and MS Word Document variants)
• Maljava - Trojan 2010 (Java Applet)
• Dloadr - Windows Trojan 2012
• FakeAv - Trojan 2007
• Miner - Trojan 2011
• Imuler - Trojan 2011
• Renepo - Worm 2004 - never seen in the wild, ie concept virus

So, with the exception of Renepo, which doesn't exist except as a concept and was for PPC Macs, the real problem was Flashback. All the other recent Trojans were targeted. I'll also note that Sophos now estimates the Flashback to be less than 275K infections as of last week. What was your point again?

Re:I didn't see it... apk

[Billly Gates]

Try NortonDNS. It will filter out bad domains for you. OpenDNS does as well if you use the paid version. The free one does have phishing and banking protection for home use.

That should save you a lot of effort and it is easy to setup on your router for all devices.