Replies

Search Google for “Mac Viruses”, smart ass.

I’m at work. I don’t have time to help you along to your disillusionment.

Excuse me?

My, what a mouth you have on you!

Boucheau, I don't need to google "Mac Viruses." Your ad hominem attack instruction to do so shows me that you are blowing smoke and don't know what you are talking about. I call you on your BS.

I've maintained the Mac Ping list on FreeRepublic for the last six years or so and posted on FR every one of the proposed Proof-of-Concept Mac OS X virus candidates that failed to do what they were supposed to do... I already KNOW exactly what you will find. Aside from about those seven or eight Proof-of-concept viruses and worms—that have never been seen outside of a computer security lab—and approximately 14 Trojan applications in two distinct families that require the interaction of an administrator user to install, that are easy to avoid and remove, the effective number of self-replicating, self-transmitting, self-installing OS X viruses is still ZERO!

There have been attempts to create one, but no viable viruses have been discovered in the wild in the over eight years that OS X has been exposed to hackers.

Better yet, call a Mac shop and ask how often they clean viruses.

So, if these viruses are so prevalent on the Macs you "clean," then it shouldn't be a problem for you to NAME THEM just of the top of your head. C'mon, Boucheau, let's hear them... List them. Tell us, who are Mac experts, exactly how you "clean" these viruses off of these infected Macs.

Tell you what. Here's some help with that:

Are you finding Macs infected with:

OSX.Renepo or OSX.Opener? That one was an early attempt at a Trojan... and a joke. Renepo, revealed in October 2004, is merely a UNIX shell script disguised as a utility application. In fact, the script is identical to a UNIX script from about 20 years before Renepo was seen. To install it and to have it work at all requires the user to be in ROOT, something that is disabled in every OSX default install. Installation and running of Renepo requires a ROOT Super user name and password. It's another very limited Trojan. It's simply a BASH shell script masquerading as something it is not. Yup. Another Trojan.
How about OSX.Inqtana.A? Wow! Inqtana exploited a vulnerability that had been closed for over a year... and could only supposedly spread over a bluetooth connection. The targeted computer had to accept an unknown download and install and run it, all requiring an administrator password.
Could they be OSX.LeapA-B or OSX.Oompa-LoompaA? That one is a POC worm that took four experts six hours merely to get it to copy from one Mac to another... and then it didn't work!
Maybe OSX.MacArena.A? The MacArena "virus" is actually a Trojan that could append itself to non-executable files but carried no payload. The author of Macarena imbedded the comment "So many problems for so little code" and also claimed he needed a lot of help to get working code. Graham Cluley of Sophos said of Macarena: ""This is a proof-of-concept virus with very limited spreading ability. Frankly you're more likely to be struck by lightning than troubled by Macarena." Sophos reported that the number of infections was between 0 and 50... that's true because the range includes ZERO.
Perhaps they are OSX.RSPlug.A "Intego, a Mac security software company, issued an alert 10/31/2007 warning Mac users of the OSX.RSPlug.A malware, which it describes as a Trojan horse. . . OSX.RSPlug.A disguises itself as a video codec that would ensure whatever porn video you just stumbled upon will play on your Mac. . . "But to get infected with the malware, you have to accept the invitation to download "new version of codec," open up the .dmg (disk image) file, click the installer.pkg file, and enter your administrator's password, according to Intego." This one IS in the wild, but it is not a self-replicating, self-transmitting virus.
Maybe they are the OSX.Iservice Trojan? That one, according to symantec, infected 0-49 Macs... (That range is true because it includes the number ZERO) even though a couple of Symantec's engineers claimed in a hacker journal it created a MacBot of 20,000 Macs... but no one else has ever found a member of that MacBot... not even Symantec, to whom the engineers did not report their findings.

Did all of these show up at your shop to be cleaned???

Since you haven't provided any facts, and instead refer me to what can be found on Google, and then, in the same breath, insult me with ad hominem attacks, demonstrating your lack of facts, you obviously don't know any and you are spreading FUD.

In other words, Boucheau, I still don't believe you. I work in the field daily with numerous Macs and NONE of them have ever been infected with a virus. As a test, I ran my personal G5 tower for over two years with all firewalls turned off. No infections. No invasions. Nothing.

Consequently, there’s a technician two stations down from me who repairing one of your “infallible” Mac’s [sic].

Please show me where I have ever said that Macs are infallible? All computer can have hardware failures requiring repair. I even repair Macs... but a lot less frequently than I repair PCs.

By the way, how is that technician working on repairing a Mac a consequence of your previous statements?

Up yours!

My, how mature you are. How erudite. Am I wasting my time on a 13 year old? Must be.

>> Up yours!

> My, how mature you are. How erudite. Am I wasting my time on a 13 year old? Must be.

Nah, he signed up for FR on 2001-10-19. Assuming he was at least 13 -then-, he'd be about 21 now.

But probably still living in his mom's basement. ;-) I wouldn't waste any more time on him.

Back to the topic of the thread, the situation with Win7 may not be as dire as the article claims. There are some scare-tactics going on too. I suspect anything that the anti-virus vendors publish to be self-serving at best and fraudulent at worst.

Shoot, I've seen ads for anti-malware software packages for Unix, Linux, OS-X and others, all of which, if you read the fine-print, are to "protect your Windows clients that connect to your *ix or OS-X server" or "stop the spread of viruses on your network" meaning transmission by email and/or samba shares.

And to be honest, I've thought about it from time to time... I've got both real Windows (2K3) and Unix/Samba shares on my work internal net, along with the Unix/Linux NFS and others, and our software engineers post and distribute Windows .EXE files (utilities and self-installers) on the secure external websites for download by our customers and clients.

But with good anti-virus on every user Window workstation, and a nice tight Cisco firewall at the main gate, most of the job is done at the doorway.

So I guess all the virus-writers are sticking with Windows because it's an easier and more lucrative target (not because it's the biggest one out there, but because it's the weakest one out there).

I do think it's a shame there aren't more motivated virus writers poking at OS-X and BSD Unix. I feel like the Maytag repairman... All the attacks I've seen on my out-facing systems have been user/pass attempts (which drop on the floor since I use only NetBSD and require public-key auth). Boring... ;-)