I've seen a couple of programs for Mac OSX which are supposed to offer
anti-virus protection (like Norton, etc.). I'm wondering, how useful are
these (now, and in the future)? Are there viruses for OS X? What about Word
macros, Unix worms, etc. - how concerned should I be? And, how likely is any
of this software to catch things that are a problem for OS X rather than the
usual PC viruses? Will performance be significantly degraded if I keep one
of these programs on in the background? And finally, if people think these
programs are useful, which one would you suggest? Thanks in advance for any
suggestions.

--

Mike Levin
mlevin77@comcast.net

On 4/11/04 7:06 AM, in article BC9E9EDA.14658%mlevin77@comcast.net, "Michael
Levin" <mlevin77@comcast.net> wrote:

> I've seen a couple of programs for Mac OSX which are supposed to offer
> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> these (now, and in the future)? Are there viruses for OS X? What about Word
> macros, Unix worms, etc. - how concerned should I be? And, how likely is any
> of this software to catch things that are a problem for OS X rather than the
> usual PC viruses? Will performance be significantly degraded if I keep one
> of these programs on in the background? And finally, if people think these
> programs are useful, which one would you suggest? Thanks in advance for any
> suggestions.
I interact daily with PC users and run Win 2K at work myself. On Panther, I
find Norton 9 antivirus to be unobtrusive and I like it better than the PC
version actually. I don't want to accidentally pass along any crap to
vulnerable PC users, and who knows what's ahead for Mac viruses and worms...

In article <BC9E9EDA.14658%mlevin77@comcast.net>,
Michael Levin <mlevin77@comcast.net> wrote:

> I've seen a couple of programs for Mac OSX which are supposed to offer
> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> these (now, and in the future)?

I usually recommend that if you must have an antivirus,
leave it on the shelf and run it manually if something were
to happen. For the past few years it seems the cost of
prevention is greater than the cost of cure considering
wasted time and conflicts.

> Are there viruses for OS X?

No. Not in the wild.

> What about Word macros,

These were once the main reason to run an AV. It seems that
in the light of all the mind numbing PC malware that PC
users in professional environments are running AVs and have
stopped a lot of the macros from spreading. Home users
remain a problem.

> Unix worms, etc. - how concerned should I be?

Dunno.

> And, how likely is any of this software to catch things
> that are a problem for OS X rather than the usual PC
> viruses?

This is my main concern. The only real destructive Mac
malware that had any circulation was the Autostart 9805
thingie. And that exploited normal use of the System, so was
initially undetected. AV company shills may claim that their
AV might detect virus-like behavior, but I doubt it. So if
something big were to hit Mac users, I think it would be
undetected. I'm not a programmer though.

> Will performance be significantly degraded if I keep one
> of these programs on in the background?

It wastes cycles. They create conflicts periodically on some
configurations.

> And finally, if people think these programs are useful,
> which one would you suggest?

Probly Norton.

On Sun, 11 Apr 2004 11:06:03 GMT, Michael Levin <mlevin77@comcast.net> wrote:
> I've seen a couple of programs for Mac OSX which are supposed to offer
> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> these (now, and in the future)? Are there viruses for OS X?

Nope. The exact count to date is zero.

> What about Word
> macros, Unix worms, etc. - how concerned should I be?

Not sure about word macros, but there's a good way to avoid those.
The underlying Unix (freeBSD to be precise) OS issues are dealt with by
Apple the same day they're dealt with by the other Unix vendors
(ssh is, after all, the same tool wherever it's installed).

> And, how likely is any
> of this software to catch things that are a problem for OS X rather than the
> usual PC viruses? Will performance be significantly degraded if I keep one
> of these programs on in the background?

Well, right now it will be busy checking against the known list of viruses,
which is zero. So, hard to say how much CPU load that'll put on it, but
it won't have a target to search for. Don't worry, if/when there ever
really is a MacOS virus, you'll hear about it.

> And finally, if people think these
> programs are useful, which one would you suggest? Thanks in advance for any
> suggestions.

I'd suggest spending the 50 bucks on a program that you want, rather than
on a scanner to scan for something that doesn't exist. The firewall
built into OSX eliminates one vector of viruses that plague Windows, the
root-isn't-user permissions model eliminates a second, and, well, someone
should write a FAQ I guess.

Dave Hinz

>

In article <BC9E9EDA.14658%mlevin77@comcast.net>, Michael Levin
<mlevin77@comcast.net> wrote:

> I've seen a couple of programs for Mac OSX which are supposed to offer
> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> these (now, and in the future)?

Save your money. If and when a Mac OS X virus actually appears you'll
hear about it, certainly by the time the AV shills have updated their
software to actually deal with a Mac virus.

It must be a wonderful thing, to be able to sell software that does
absolutely *nothing* to people who believe it's absolutely *essential*,
mustn't it?

(That last sentence isn't aimed at you Michael...)

djb

--
Okay, so this is my new sig line, eh?

Michael Levin <mlevin77@comcast.net> writes:
>
> I've seen a couple of programs for Mac OSX which are supposed to
> offer anti-virus protection (like Norton, etc.). I'm wondering, how
> useful are these (now, and in the future)?

Not all _that_ useful now. Dunno about the future.

There are no known virusses/worms that target OS X. There have been
virusses that targetted older versions of MacOS, but they are pretty
rare these days.

The main reason you might want one is to protect against macro
virusses and to prevent you from accidentally spreading a Windows
virus by manually mailing it to someone else.

> Are there viruses for OS X? What about Word macros, Unix worms,
> etc. - how concerned should I be?

UNIX worms have historically not spread through e-mail. They have
spread by exploiting security holes in UNIX. But I haven't heard of
one of these for many years. IMO, as long as you keep your version
of MacOS up to date with all the latest updates, you should be OK.

> And, how likely is any of this software to catch things that are a
> problem for OS X rather than the usual PC viruses? Will performance
> be significantly degraded if I keep one of these programs on in the
> background? And finally, if people think these programs are useful,
> which one would you suggest? Thanks in advance for any suggestions.

I can't answer these. I don't run an AV program on my Mac.

-- David

In article <BC9E9EDA.14658%mlevin77@comcast.net>,
Michael Levin <mlevin77@comcast.net> wrote:

> I've seen a couple of programs for Mac OSX which are supposed to offer
> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> these (now, and in the future)?

Now? They are mostly a comfort factor for people who are especially
paranoid or who are required to demonstrate that they are running
anti-viral software for some reason. (I'm in the second group.)

Future? Noone can say.

G

--
Standard output is like your butt. Everyone has one. When using a bathroom,
they all default to going into a toilet. However, a person can redirect his
"standard output" to somewhere else, if he so chooses. - Jeremy Nixon

In article <BC9E9EDA.14658%mlevin77@comcast.net>,
Michael Levin <mlevin77@comcast.net> wrote:

> I've seen a couple of programs for Mac OSX which are supposed to offer
> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> these (now, and in the future)? Are there viruses for OS X? What about Word
> macros, Unix worms, etc. - how concerned should I be? And, how likely is any
> of this software to catch things that are a problem for OS X rather than the
> usual PC viruses? Will performance be significantly degraded if I keep one
> of these programs on in the background? And finally, if people think these
> programs are useful, which one would you suggest? Thanks in advance for any
> suggestions.

They are useful if you are on a PC network, and the system
admin/informatics security officer is clueless. Gratefully accept their
expert advice and install something comforting. Norton if they need to
pay annual subscription fees to feel useful. Or, make up a fake software
box with the word "antivirus" on it somewhere and leave it on the shelf
by the computer. Our Mac minority at work use Virex I think.

Hey, even if it does nothing to keep the imaginary Mac viruses away,
anything that keeps the computer science grads away is a bonus.

In article <kentc-2ED296.17430712042004@nr-ott01.bellnexxia.net>,
Kent Clarke <kentc@dot.org> wrote:

> In article <BC9E9EDA.14658%mlevin77@comcast.net>,
> Michael Levin <mlevin77@comcast.net> wrote:
>
> > I've seen a couple of programs for Mac OSX which are supposed to offer
> > anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> > these (now, and in the future)? Are there viruses for OS X? What about Word
> > macros, Unix worms, etc. - how concerned should I be? And, how likely is any
> > of this software to catch things that are a problem for OS X rather than the
> > usual PC viruses? Will performance be significantly degraded if I keep one
> > of these programs on in the background? And finally, if people think these
> > programs are useful, which one would you suggest? Thanks in advance for any
> > suggestions.
>
> They are useful if you are on a PC network, and the system
> admin/informatics security officer is clueless. Gratefully accept their
> expert advice and install something comforting. Norton if they need to
> pay annual subscription fees to feel useful. Or, make up a fake software
> box with the word "antivirus" on it somewhere and leave it on the shelf
> by the computer. Our Mac minority at work use Virex I think.
>
> Hey, even if it does nothing to keep the imaginary Mac viruses away,
> anything that keeps the computer science grads away is a bonus.

Hey! I'm a CS grad, and you won't see me insisting on virus
"protection" software. I think you have MIS (management information
systems) grads in mind, or possibly MCSEs. :-)

--
Tom "Tom" Harrington
Macaroni, Automated System Maintenance for Mac OS X.
Version 2.0: Delocalize, Repair Permissions, lots more.
See http://www.atomicbird.com/

Gregory Weston writes:
> Michael Levin wrote:
>>
>> I've seen a couple of programs for Mac OSX which are supposed to
>> offer anti-virus protection (like Norton, etc.). I'm wondering, how
>> useful are these (now, and in the future)?
>
> Now? They are mostly a comfort factor for people who are especially
> paranoid or who are required to demonstrate that they are running
> anti-viral software for some reason. (I'm in the second group.)

They also trap Windows virusses, which is useful if your Mac is a
server that may have Windows clients.

-- David

On 4/12/04 7:18 PM, in article tph-5789E3.17181912042004@localhost, "Tom
Harrington" <tph@pcisys.no.spam.dammit.net> wrote:

> In article <kentc-2ED296.17430712042004@nr-ott01.bellnexxia.net>,
> Kent Clarke <kentc@dot.org> wrote:
>
>> In article <BC9E9EDA.14658%mlevin77@comcast.net>,
>> Michael Levin <mlevin77@comcast.net> wrote:
>>
>>> I've seen a couple of programs for Mac OSX which are supposed to offer
>>> anti-virus protection (like Norton, etc.). I'm wondering, how useful are
>>> these (now, and in the future)? Are there viruses for OS X? What about Word
>>> macros, Unix worms, etc. - how concerned should I be? And, how likely is any
>>> of this software to catch things that are a problem for OS X rather than the
>>> usual PC viruses? Will performance be significantly degraded if I keep one
>>> of these programs on in the background? And finally, if people think these
>>> programs are useful, which one would you suggest? Thanks in advance for any
>>> suggestions.
>>
>> They are useful if you are on a PC network, and the system
>> admin/informatics security officer is clueless. Gratefully accept their
>> expert advice and install something comforting. Norton if they need to
>> pay annual subscription fees to feel useful. Or, make up a fake software
>> box with the word "antivirus" on it somewhere and leave it on the shelf
>> by the computer. Our Mac minority at work use Virex I think.
>>
>> Hey, even if it does nothing to keep the imaginary Mac viruses away,
>> anything that keeps the computer science grads away is a bonus.
>
> Hey! I'm a CS grad, and you won't see me insisting on virus
> "protection" software. I think you have MIS (management information
> systems) grads in mind, or possibly MCSEs. :-)

By the way, Macaroni is a great utility on my system, Tom... That said, I
ran into a couple of inbound virus-laden attachments in my Yahoo Mail inbox
today (.pif extensions). I felt good knowing that my Mac was not vulnerable
to that junk, but I run NAV on Panther just to make sure that I don't
accidentally send a 'turd' to one of my Windows-suffering clients.

In article <m2oepyy111.fsf@qqqq.invalid>,
shamino@techie.com (David C.) wrote:

> Michael Levin <mlevin77@comcast.net> writes:
> >
> > I've seen a couple of programs for Mac OSX which are supposed to
> > offer anti-virus protection (like Norton, etc.). I'm wondering, how
> > useful are these (now, and in the future)?
>
> Not all _that_ useful now. Dunno about the future.
>
> There are no known virusses/worms that target OS X. There have been
> virusses that targetted older versions of MacOS, but they are pretty
> rare these days.
>
> The main reason you might want one is to protect against macro
> virusses and to prevent you from accidentally spreading a Windows
> virus by manually mailing it to someone else.

I'm scanning, now, and it is finding some virus. See below:

Thank you for contacting us.

We understand that you received complaint emails about spam
coming from your email address.

There are three likely reasons for this. Some or all may apply:

1- Someone is forging your address and using it to send spam.
The bounces and responses you get to this mail would likely
contain unknown user errors, unsubscribe requests, and general
spam complaints.

2- Your e-mail address is being stored within someone's virus
infected computer, which provides your address to the virus,
which is programmed to forge your address on outbound copies of
itself.

3- Your system is virus infected. A virus is able to hijack an
infected system's internet connection, at any time (even when you
are not using the computer, as long as it is on). The virus is
programmed to send copies of itself out from your computer, using
various e-mail addresses that it finds stored in your address
book, web cache, and other system files. The virus forges these
addresses as the From: and To: address on the outbound copies of
itself.

The bounces and responses you get to 2 and 3 above would likely
contain virus notifications.

For more information regarding these viruses, please visit:

http://www.sarc.com/avcenter/
http://www.itd.umich.edu/virusbusters

Unfortunately, there is not any way to prevent your address from
being forged if it is forged as a result of someone else's
infected system, or forged by a spammer.

While you can't prevent the forgery, you can report any known
incidents of forgery to the responsible network.

To determine the responsible network, you need to look at the
extended headers of the mail the prompted the bounce/complaint,
wherever it came from. These headers are often included within
the body of the bounce message. Interpreting the extended
headers will show you who the responsible network is. You can
then send an abuse complaint to that network's Abuse address. Be
sure to include the bounce message and an explanation that you
were the victim of forgery. The Abuse department of that
network should then be able to investigate and take action on the
individual account responsible. Only the Abuse department of the
network of origin will be able to investigate and take
appropriate action.

Even if another virus infected internet user is ultimately
responsible, I would highly suggest that you regularly scan your
own system for any worms or viruses. It is very important that
you are using anti-virus software and keeping it up to date on a
daily basis.

For access to free services, including a virus scan, a security
risk assessment, and a personal incident investigation tool,
please see:

http://security1.norton.com/ssc/home.asp

Note: EarthLink does not recommend any third party software or
productline.

We hope that the above information was helpful. If you need any
further help, please let us know.

--
Memory was given to mortals so that they might
have roses in December.
....unknown

In article
<110420040841466618%dave@N_O_T_T_H_I_S.balderstone .ca>,
Dave Balderstone <dave@N_O_T_T_H_I_S.balderstone.ca> wrote:

> In article <BC9E9EDA.14658%mlevin77@comcast.net>, Michael Levin
> <mlevin77@comcast.net> wrote:
>
> > I've seen a couple of programs for Mac OSX which are supposed to offer
> > anti-virus protection (like Norton, etc.). I'm wondering, how useful are
> > these (now, and in the future)?
>
> Save your money. If and when a Mac OS X virus actually appears you'll
> hear about it, certainly by the time the AV shills have updated their
> software to actually deal with a Mac virus.
>
> It must be a wonderful thing, to be able to sell software that does
> absolutely *nothing* to people who believe it's absolutely *essential*,
> mustn't it?
>
> (That last sentence isn't aimed at you Michael...)
>
> djb

So far NAV has found a strain of Bloodhound.HybridCOM
Strain of Trojan dropper
Strain of W32.Mimail.A@mm
Strain of W32.Swen.A@mm

I either got it through email or it was in new software that I
purchased, recently.

--
Memory was given to mortals so that they might
have roses in December.
....unknown

In article <kati_e-334500.23305313042004@news-60.giganews.com>, kati_e
<kati_e@snow.com> wrote:

> So far NAV has found a strain of Bloodhound.HybridCOM
> Strain of Trojan dropper
> Strain of W32.Mimail.A@mm
> Strain of W32.Swen.A@mm

None of which affect, or are able to become active on, a Mac.

> I either got it through email or it was in new software that I
> purchased, recently.

The former, most likely. All that suggests is that some clueless
Windows user or users have you in their address book(s) and are not
runinng anti-virus software on a system that desperately needs it.

I stand by my assertion that anti-virus software is not currently
needed on any Mac system. If and when a real Mac virus appears in the
wild, you'll hear about it very quickly and will have ample opportunity
to purchase AV software that can deal with it with a 98% certainty you
will not have been infected in the meantime.

djb

--
Was that last sig line lame or what?

On Tue, 13 Apr 2004 23:28:46 -0400, kati_e <kati_e@snow.com> wrote:
>
> I'm scanning, now, and it is finding some virus. See below:
>
> We understand that you received complaint emails about spam
> coming from your email address.

Nearly every virus for the last several years has forged it's
from: address. They harvest the address book of the infected
system and pick one of those at random to show as the source.
Antivirus makers know this, but they probably feel that they can
sell more programs if they continue to make it look like you
just might be infected. You're not.

> 1- Someone is forging your address and using it to send spam.

Happens, particularly to people who have gone out of their way
to annoy spammers.

> 2- Your e-mail address is being stored within someone's virus
> infected computer, which provides your address to the virus,
> which is programmed to forge your address on outbound copies of
> itself.

Bingo.

> 3- Your system is virus infected. A virus is able to hijack an
> infected system's internet connection, at any time (even when you
> are not using the computer, as long as it is on).

Yes if you were running Windows, no if you're running OSX.

> The bounces and responses you get to 2 and 3 above would likely
> contain virus notifications.

Some of these even are so kind as to include the virus itself,
making the problem worse. Of course, they include an ad for their
antivirus product, so ...
>
> Unfortunately, there is not any way to prevent your address from
> being forged if it is forged as a result of someone else's
> infected system, or forged by a spammer.

Very true.

> To determine the responsible network, you need to look at the
> extended headers of the mail the prompted the bounce/complaint,
> wherever it came from.

spamcop.net has a free reporting service, which you can either just
use, or use to see the technical details of what it's looking for in
the headers. You don't have to learn how to go through them, but
if you'd like to, it's a great (free) tool for both.

earthlink's advice applies to most of their customers (those running
windows), but not so much to you and me.

Dave Hinz