Mac Anti-Virus Programs

On Tuesday, April 27, 2004, at 09:43 PM, korimac.com wrote:

> Anti-virus programs - automatically updated daily - are an absolute
> necessity on a Windows PC, and a waste of money on a Mac. There is no
> purpose in finding Windows-only viruses, unless you have a habit of
> sending .pif and .exe email attachments to all your Windows "friends".
> Virus checkers can also cause problems with installing software and
> downloading useful files.
>
> So why bother? Leave that to the PC people.

We've been running and updating Norton on the assumption that a copy of
Virtual PC on our Powerbook is making it vulnerable to PC viruses. Is
this a waste of time?

Marilyn

At 7:26 AM -0700 on 04/04/28, Randy B. Singer wrote:

>Marc Farnum Rendino said:
>
>>Near as I can tell by the docs (and some direct experience) Virex
>>does indeed check for all known malware, regardless of intended
>>platform - which, to me, is one of the positives that keeps it in the
>>running, even considering the negatives we're discussing here.
>
>Except...I have a copy running right now, and it totally ignores the
>bunches of Windows viruses that come in my e-mail several times a day.

Interesting; I specifically tested it against some Windows malware
awhile back, and it properly identified them.

We are talking about Virex7, right? Virex6 definitely didn't scan for
Windows malware.

And it's hard to imagine the virus definitions that MacAfee publishes
are somehow different per platform; why would they go to the extra
work, after having "unified" (if I recall correctly) the engines?...

Are you sure you've got an up-to-date virdefs file? Do you use only
the monthly files or the weekly as well?

This is rather interesting...

- Marc

On 27 Apr 2004, at 27d, 19:43, korimac.com wrote:
> Anti-virus programs - automatically updated daily - are an absolute
> necessity on a Windows PC

No they're not. I've been running a Windows PC in some form or another
since Windows 3.0. There are just a couple of rules:

   1) Never use a MSFT email program
   2) Never use a MSFT browser
   3) keep the machine behind a NAT

> -----Original Message-----
> From: Marilyn Matty [mailto:mmattynyc.rr.com]

> We've been running and updating Norton on the assumption that
> a copy of
> Virtual PC on our Powerbook is making it vulnerable to PC viruses. Is
> this a waste of time?

Yes, it's probably a waste. Even if the Mac antivirus software has Windows
viruses in its definition list, it's unlikely that it can detect virus
activity within the guest OS or infected files in the guest OS file system.
Depending on what you use VPC for, you should run an antivirus program for
Windows within the guest OS.

AVG is an oft-recommended antivirus program for Windows
http://www.grisoft.com/us/us_dwnl_free.php. It's free for "single home
users" and "non-profit organizations may apply for a non-profit discount."
There's also a free trial version.

On 4/29/04 9:25 AM, "LuKreme" <kremelskreme.com> wrote:

>> Anti-virus programs - automatically updated daily - are an absolute
>> necessity on a Windows PC
>
> No they're not. I've been running a Windows PC in some form or another
> since Windows 3.0. There are just a couple of rules:
>
> 1) Never use a MSFT email program
> 2) Never use a MSFT browser
> 3) keep the machine behind a NAT

Eudora 5.X on windows is just as vulnerable to Outlook address book viruses.
Before it even starts, yes it is. I've seen it, on multiple machines where
Outlook was never installed and Outlook Express was as removed as humanly
possible. It worked out in the end, because it allowed the users to more
gracefully switch to Mozilla and IMAP from Eudora and POP. They were really
happy with it, and Mozilla has some nice security features that a lot of
other email clients don't.

As well, your second point ignores things like Code Red that attacked web
servers, slammer, etc. So that's really not going to help much.

Point number three was shown to be a false sense of security in the case of
Nortel who had their network brought down by a laptop that was carried past
the NAT/Firewall, and proceeded to infect the internal, unprotected network.

Your first point would be somewhat valid except for one simple problem: In
the corporate space, (where Windows holds the high ground), there's no
email/calendar/etc client that can touch Outlook. Domino/Notes is just a
nightmare to use, and if you are talking about a company like Bose, that has
made heavy use of the workflow features available with Exchange/Outlook,
there's nothing else that's even an option. Period.

For home use? Meh, almost anything will work. But in a corporate
environment, where mail and scheduling are not simple tasks, Outlook,
especially 2003 is a hell of a tool, albeit a problematic one.

And no one has stepped up to the plate yet with something that's a drop in
replacement. No, evolution doesn't count. It doesn't have all the workflow
features of Outlook, and it's limited to using DAV. Unless you're using
Exchange 2003, then there is a VERY large gap between the feature sets of
DAV and MAPI. Exchange 2003 fixes this, but you're not just going to jump
into a mail server upgrade willy - nilly. Besides, the Exchange connector
functionality in Evolution isn't free, and Evolution doesn't run on Windows,
so no one is going to switch OS's for Evolution.

So it's all well and good to say "Don't use Outlook", lord knows I have, but
then you have to replace it with something...and on Windows, there's really
nothing else out there.

--
John C. Welch Writer/Analyst
Bynkii.com Mac and other opinions
jwelchbynkii.com

On 4/29/04 at 7:25 AM, rbrodertwmi.rr.com wrote:
>
> I have just come from the NAI... I mean Dr. Solomon... I mean
> McAfee... I mean Virex site. Without the URL supplied by a previous
> writer on this thread, one is hard pressed to even find the page
> describing their Mac products. You CANNOT buy a single copy of the
> software! The cart defaults to 11 copies, the minimum for their site
> license. All attempts to change the quantity have failed. And I can
> forget about upgrading my current version of Virex 6.1. The upgrade
> links take you to their PC page.

I have concluded that they just don't want to sell us the software.
I recently sent them the following missive:

> I've been told you sell antivirus software for the Macintosh, but
> your product listing pages don't show it. What gives? I've heard of
> companies that had products that they didn't want to sell, but I
> never understood that concept.

This was their unhelpful reply:

Date: Tue, 27 Apr 2004 00:00:20 -0700 (Pacific Daylight Time)
To: geoff.odhnerpobox.com
From: mcafeesupportmcafee.com
Subject: [Incident 040426-008512] Anti Virus Software

Recently you requested personal assistance from our on-line support
center. Below is a summary of your request and our response.

Thank you for allowing us to be of service to you.

Subject
---------------------------------------------------------------
Anti Virus Software

Discussion Thread
---------------------------------------------------------------
Response (Ma. Alexandra Ravelo) - 04/27/2004 12:00 AM
Dear McAfee Customer,
        
Thank you for your e-mail to McAfee Security.

Regarding your concern, please be informed that we offer anti-virus
software for Macintosh computers. We suggest you to contact Macintosh
for further assistance.

Macintosh
www.mac.com
        
For further assistance regarding technical concerns, please click on the
following link and select your preferred Technical Support option:
                
<http://ts.mcafeehelp.com>
            
To contact McAfee Security Customer Support by phone, call (408)
992-8599, Monday-Friday, 8AM-8PM CST. Our fax number is (972) 963-7485.

Customer - 04/26/2004 09:13 PM
I've been told you sell antivirus software for the Macintosh, but your
product listing pages don't show it. What gives? I've heard of
companies that had products that they didn't want to sell, but I never
understood that concept.

You may also update this question by replying to this message. Because
your reply will be automatically processed, you MUST click 'REPLY' and
then enter your reply in between the 'reply' lines provided at the
bottom of this email. Text entered into any other part of this message
will be discarded.
[===> Please enter your reply below this line <===]

[===> Please enter your reply above this line <===]

McAfee.com Discover & Recover
Customers have been asking us for a backup CD they can keep at home, in
case of emergencies. For just $12.95 (introductory special pricing),
we'll ship you a McAfee.com Discover & Recover CD with backup copies of
your McAfee.com services. Buy now
<http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3759>
Thank You,

Alexandra
McAfee Security

On Apr 29, 2004, at 8:25 AM, Marc Farnum Rendino wrote:

> At 5:47 PM -0700 on 04/04/15, Nik wrote:
>
>> Virex's virus definitions haven't been updated since March 24th
>
> You may of course manually download the more frequent updates; look
> for the one labeled "Unix".

"Of course"? Why is this an "of course?" I ran the in-app virus
definitions update, and it gave me the March 24th version. If there's
something more recent, well, it really ought to download those
definitions.

On 4/29/04 at 7:25 AM, mmattynyc.rr.com (Marilyn Matty) wrote:

>We've been running and updating Norton on the assumption that a
>copy of Virtual PC on our Powerbook is making it vulnerable to PC
>viruses. Is this a waste of time?

It depends a great deal on what type of software you run under Virtual PC and your backup strategy.

Basically, the questions you need to answer for yourself are:

How likely are you to get a virus?

If you did get a PC virus how easy would it be to restore your Virtual PC files from a virus free backup copy?

How much would you lose if you had to trash the infected Virtual PC files and start from scratch?

Can you afford such a loss?

If you install and run software under Virtual PC from a wide variety of untrusted sources, don't backup regularly, and cannot afford to trash the Virtual PC files and start anew with virgin files, then it definitely is not a was of time to scan for PC viruses.

At 12:41 PM -0700 on 04/04/30, Nik wrote:
>On Apr 29, 2004, at 8:25 AM, Marc Farnum Rendino wrote:
>
>>At 5:47 PM -0700 on 04/04/15, Nik wrote:
>>You may of course manually download the more frequent updates; look
>>for the one labeled "Unix".
>
>"Of course"? Why is this an "of course?" I ran the in-app virus
>definitions update, and it gave me the March 24th version. If
>there's something more recent, well, it really ought to download
>those definitions.

I meant "of course" as in "I'm no genius", not "you're an idiot". :)

The eUpdate in the app only does the monthly updates, but you can
find the more frequent updates here:

<http://www.networkassociates.com/us/downloads/updates/dat.asp>

Look for the "Unix" distribution. The ReadMe supplied (next to it) is
useful (ex: describes malware it now checks for), but doesn't tell
you how to apply the update in Mac OS X. That info is included in
the ReadMe that came with Virex - look for the "To update your DAT
files on a weekly basis" section. it is a little more involved than
the eUpdate, and involves (wait for it) the command line.

- Marc

John C. Welch wrote:

>For home use? Meh, almost anything will work. But in a corporate
>environment, where mail and scheduling are not simple tasks, Outlook,
>especially 2003 is a hell of a tool, albeit a problematic one.
>
>
Outlook 2003 doesn't suffer from the obvious security problems that
Outlook Express has, they've actually fixed a number of issues --
although it is still possible for it to spread viruses, but mostly
because the viruses have evolved with Outlook.

For example, Outlook 2003 requires the users permission before a program
or macro can access the address book. It also blocks access to all
executable extensions, plus a couple of other extensions. You can't
even save it to disk (which is quite annoying for some of the extensions
such as access databases.) It's also difficult to send outgoing
messages with executable attachments.

But if you look at most of the viruses going crazy today they get their
e-mail addresses from the internet explorer cache files, not the address
book. They also include their own SMTP engine to send e-mail without
having to use Outlook as the e-mail application. Most do seem to still
be using executable file attachments as their spread method, but what
we've been seeing a lot of lately are zip files that exploit a buffer
overflow in XP's zip handling engine, or just put the executable in the
zip. Also, to get around corporate mail scanners that look in files for
executables, many of the zips are now encrypted with the password in the
message for the user to open it up (you'd be surprised how many users
will actually do this.)

Securing a corporate network against these types of threats requires far
more than a simple anti-virus program, no matter how frequently updated.
If you check Symantec's virus dictionary you'll see it takes a day for
most new viruses, with same day updates for virus variants. It takes
less than an hour for a virus to spread throughout a company.

Corporate security involves, among other things, an e-mail scanner (from
a different company than the desktop anti-virus company so you have
double the possiblity of getting a quick signature update), network
security that blocks outgoing port 25 (blocks the viruses with their own
SMTP engine from spreading if you do get infected), a system for
distributing patches (with an emergency system for distributing patches
very quickly for fast spreading exploits), policies against connecting
non-corporate owned computers to the corporate network (i.e. no users
get to use a VPN connection from their own computer, and no vendors get
to use the corporate network to demo internet software, or just check
their e-mail), users are not administrators of their computers and a
local software firewall for laptops.

Using these methods we've not had more than a handful of infections in
over a year, and none of these infections has spread beyond the
individual users that launched the virus. This doesn't mean we're
invulnerable, just that our vulnerability is narrowed as much as we can.

If you look at the list above you'll see the Mac has many of the same
software in place -- standard Mail program, standard Address Book (or
internet cache files that are easily accessible to scan for e-mail
addresses), standard unzip/unstuff program (one built-in to the OS, the
other from Aladdin, both which might be vulnerable to buffer
overflows.) Fortunately most of the obvious vulnerabilites of the
Windows programs have been avoided, but there are still some of things
that worry me about the Mac. One is that Apple allows any program to
access the Address Book. One change I would like to see is that program
access to the Address Book have to be approved by the user. Something
like Keychain's method that asks once for each program, and if the
program is changed/updated/modified it re-asks for permission.

On 5/1/04 9:35 AM, "Kevin van Haaren" <kevinvanhaaren.net> wrote:

> John C. Welch wrote:
>
>> For home use? Meh, almost anything will work. But in a corporate
>> environment, where mail and scheduling are not simple tasks, Outlook,
>> especially 2003 is a hell of a tool, albeit a problematic one.
>>
>>
> Also, to get around corporate mail scanners that look in files for
> executables, many of the zips are now encrypted with the password in the
> message for the user to open it up (you'd be surprised how many users
> will actually do this.)

I've been doing IT for a loooooong time...no it wouldn't. We just summarily
strip all compressed files. People get pissed. Too bad, so sad, stop coddling
virus writers. Jail the little jerks for decade or so, and let them see how
well their l33t sk1llz hold up against their felony convictions. Or make
them serve time in the homes of the IT people who don't get to see their
families because these jerks cannot leave other people's stuff alone.

> Corporate security involves, among other things, an e-mail scanner (from
> a different company than the desktop anti-virus company so you have
> double the possiblity of getting a quick signature update),

We've got three.

> network security that blocks outgoing port 25 (blocks the viruses with their
> own SMTP engine from spreading if you do get infected),

This ends up being impractical for a number of reasons. Forcing all smtp to
be authenticated is a better choice in the long run.

> policies against connecting
> non-corporate owned computers to the corporate network (i.e. no users
> get to use a VPN connection from their own computer, and no vendors get
> to use the corporate network to demo internet software, or just check
> their e-mail),

Nice idea, but you can't do it. Someone always has the pull, or a need to
override, and unless you have the budget and the manpower to issue laptops
and home boxes to corporate users and visit their homes regularly, it isn't
going to happen. So, instead, you have your AV software set on paranoid, and
you use SSL VPNs which lock down what gets tunneled

> users are not administrators of their computers and a
> local software firewall for laptops.

But you can't do this as a blanket policy. No, really. Trust me, I get the
emails. Someone's always got the pull, or the need. Local software firewalls
get hacked and exploited just like everything else. What you end up doing is
either not issuing windows laptops if you can, or setting up a system
wherein every time the laptop plugs into the company network, it is first
checked for proper security, and scanned for virii, spyware, etc., BEFORE
you get access to the stuff.

>
> Using these methods we've not had more than a handful of infections in
> over a year, and none of these infections has spread beyond the
> individual users that launched the virus. This doesn't mean we're
> invulnerable, just that our vulnerability is narrowed as much as we can.

You've got more power than most IT folks.

> One is that Apple allows any program to
> access the Address Book. One change I would like to see is that program
> access to the Address Book have to be approved by the user. Something
> like Keychain's method that asks once for each program, and if the
> program is changed/updated/modified it re-asks for permission.

This was in place in 10.1, yanked in 10.2, for two reasons:

1) It really hosed up the functionality of iCal and other applications that
need to be able to talk to the Address Book.

2) It was what I call "feel good" security. It never prevented access to
Address Book's data. You could still dump the raw file through a half -
dozen unix utilities and a billion perl scripts and yank out the email
addresses, and this silly dialog wouldn't have stopped you. It only munged
up AppleScripts. It was stupid and gave an illusion of security that wasn't
there. A false sense of security is FAR worse than none at all.

john

--
John C. Welch Writer/Analyst
Bynkii.com Mac and other opinions
jwelchbynkii.com

>Look for the "Unix" distribution. The ReadMe supplied (next to it) is
>useful (ex: describes malware it now checks for), but doesn't tell
>you how to apply the update in Mac OS X. That info is included in
>the ReadMe that came with Virex - look for the "To update your DAT
>files on a weekly basis" section. it is a little more involved than
>the eUpdate, and involves (wait for it) the command line.

There are GUI tools available for this, like Get DAT Updates(http://homepage.mac.com/beryrinaldo/Tools/Get_DAT_Updates/) and Virex 7 Scripts (http://home.comcast.net/~b.courbage/scripts/index.html). I've been a happy user of the first; I have it set to run automatically when I login.

Dirk Paul

I'd like to refer back to a posting by John Welch, in April, in which he referred to the beta version of Virex 7.5.

In August, for a short period of time, Apple posted Virex 7.5 (not stating whether or not it was still in beta) on the .Mac site. Having used Virex (in all of its ownerships) for more than a decade, I downloaded and attempted to install it.

I was informed by one of the first dialog boxes that I had virus protection software running that was not compatible with Virex 7.5 ... it did NOT state whether it was NAV, Virex 7.2.1, MicroMat's TechTools Protect (in OS 9). So, I attempted to uninstall all of them ... but finding invisible files is sometimes difficult. I also downloaded the "new" uninstaller program from Symantec. That program did not even list NAV as an option to uninstall (just Utilities and Personal Firewall).

Attempts to solicit information from Symantec, McAfee, and Apple, were all uniformly uninformative. At least one person attempted to suggest (on CNET.com) that I download the Symantec uninstaller program.

However, after 2 weeks, .Mac no longer has Virex 7.5 on it, but Virex 7.2.1 back. Does anyone know what is going on? Am I the only one who is unaware of what Virex/McAfee/Dr. Solomon/NAI is up to? And, why would .Mac post the software for download without either a) testing it, or b) providing some support (even in the FAQ section)?

By the way, it still is in beta, isn't it?

Thanks.

--Apple-Mail-1-994001500
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII; format=flowed

On Sep 15, 2004, at 8:27 AM, WGibson648 wrote:

> I was informed by one of the first dialog boxes that I had virus
> protection software running that was not compatible with Virex 7.5 ...
> it did NOT state whether it was NAV, Virex 7.2.1, MicroMat's TechTools
> Protect (in OS 9). So, I attempted to uninstall all of them ... but
> finding invisible files is sometimes difficult. I also downloaded the
> "new" uninstaller program from Symantec. That program did not even
> list NAV as an option to uninstall (just Utilities and Personal
> Firewall).
>
> Attempts to solicit information from Symantec, McAfee, and Apple,
> were all uniformly uninformative. At least one person attempted to
> suggest (on CNET.com) that I download the Symantec uninstaller
> program.

The Virex 7.5 installer checks for the presence of Norton AntiVirus by
looking for a Norton Scheduler process running in the background. The
problem is that all Norton tools install Scheduler. If you kill that
process (or move the startup files, then restart), Virex will install.

> However, after 2 weeks, .Mac no longer has Virex 7.5 on it, but Virex
> 7.2.1 back. Does anyone know what is going on? Am I the only one who
> is unaware of what Virex/McAfee/Dr. Solomon/NAI is up to? And, why
> would .Mac post the software for download without either a) testing
> it, or b) providing some support (even in the FAQ section)?

Apple pulled it, possibly due to some data loss issues. Since the
beta, there's been an issue with Virex scanning mail, finding viruses
sent from Windows machines, and deleting the file that contains the
virus. In the case of mail clients that store entire mailboxes as one
file, that means a lot of other mail goes with it. I suspect that
issue bit a few users who complained to Apple (since McAfee doesn't
acknowledge Virex as one of its products) and Apple yanked it since
(obviously) that's unacceptable behavior.

Oh, and Apple does provide support. Much more than McAfee, it turns
out. Check out the forums.

> By the way, it still is in beta, isn't it?

Nope. That was supposed to be an official release.

Brendan

--Apple-Mail-1-994001500
content-type: application/pgp-signature; x-mac-type=70674453;
        name=PGP.sig
content-disposition: inline
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQUhsL9RCzO6DmsIhEQL1xQCgv+DjqP1sIg4gsH+mjLl4inJSXR0AoPxw
2Wp0aG5rX+ICA8cis2EF2IWg
=He6T
-----END PGP SIGNATURE-----

--Apple-Mail-1-994001500--

On 9/15/2004 8:27 AM, "WGibson648" <wgibson648mac.com> wrote:
> However, after 2 weeks, .Mac no longer has Virex 7.5 on it, but Virex 7.2.1
> back. Does anyone know what is going on? Am I the only one who is unaware of
> what Virex/McAfee/Dr. Solomon/NAI is up to? And, why would .Mac post the
> software for download without either a) testing it, or b) providing some
> support (even in the FAQ section)?

Virex 7.5 had serious problems with a number of applications and data types,
so it was pulled. If you've installed it, I'd recommend uninstalling it
until a new, "fixed" version is posted.

(Sadly, the bugs in Virex 7.5 -- which can result in significant data loss
-- were documented *months* ago, and yet still existed in the final release
version.)

On 9/15/2004 8:27, "WGibson648" <wgibson648mac.com> wrote:

> Am I the only one who is unaware of what Virex/McAfee/Dr. Solomon/NAI is up
> to? And, why would .Mac post the software for download without either a)
> testing it, or b) providing some support (even in the FAQ section)?
>
> By the way, it still is in beta, isn't it?

<sarcasm>
No, I think each of the three companies is unaware of what they are up to.
</sarcasm>

The Virex 7.5 that was on .Mac--not marked as beta--was *supposed* not to be
beta. However, it shared with the beta versions the unfortunate habit of
deleting an email message containing a virus by deleting the entire file
containing the message. That *seems* to have been why Apple pulled it.

Above based on various Mac sites over the past few weeks.

  --John

I've had trouble with all the dotMac Virex updates from the beginning.
Then along came Virex 7.5, I installed it, and everything is fine. I
never even see it, since it functions entirely in the background. I
know it's in there, because I can call up its components on my Finder.

Sometimes I get notices that an incoming email has been stripped due to
a virus hitchhiking in. I never see the name Virex in the notice tho.
That I never see it, bothers me. Eery.

On the other hand, all the disasters that appear, for instance, in
MacFixIt, upset me also; but so far, I just have nothing to complain
about. Any advice?

On 9/16/2004 8:34, "Albert Gedraitis" <owlbirdsympatico.ca> wrote:

> Sometimes I get notices that an incoming email has been stripped due to
> a virus hitchhiking in. I never see the name Virex in the notice tho.
> That I never see it, bothers me. Eery.

Those notices likely come from your ISP's mail server.

  --John

I almost lost mailbox data in the Virex 7.5 debacle. Retrospect back
ups saved the day. I removed 7.5 but lost confidence in 7.2 since
despite its obvious flaws, 7.5 had detected suspicious files on the
computer which had been sitting undetected despite daily scans using
the older software.

Recently I've been using clamXav.

http://www.markallan.co.uk/clamXav

There's not much automation and the app doesn't remember preferences
very well, but manually updating virus definitions feels more
proactive, and any suspicious files it finds are moved to a designated
quarantine folder before being dealt with.

Until Virex/.Mac get their act together...

Will Percy

--On Thursday, September 16, 2004 8:34 AM -0700 Albert Gedraitis
<owlbirdsympatico.ca> wrote:

> On the other hand, all the disasters that appear, for instance, in
> MacFixIt, upset me also; but so far, I just have nothing to complain
> about. Any advice?

Don't run any anti-virus software. I've never had any anti-virus software
save me on a Mac and too many problems caused by the software itself. I
don't run as an admin level user and I do backup my data files on a regular
basis.