From Newsgroup: comp.sys.mac.system

On the Mac side I regularly warn folks to NOT use Symantec's Norton
Anti-Virus due to its consistent bugginess and security vulnerabilities. Ironic, eh?

Well, yet another security problem with Symantec software has been
discovered and patched. Here are the details:

:-Derek
====================================

<http://www.symantec.com/avcenter/security/Content/2006.04.17b.html>

Symantec Alert SYM06-007 warns of a LiveUpdate security problem:

Some components of Symantec's LiveUpdate for Macintosh do not set their execution path environment. A non-privileged user can change their
execution path environment. If the user then executes one of these
components, it will inherit the changed environment and use it to locate system commands. These components are configured to run with System Administrative privileges (SUID) and are vulnerable to a potential
Trojan horse attack. ... A patch has been created and made available for
all affected versions of the product through Symantec LiveUpdate.

--
Fortune Magazine, 11-29-05: What's your computer setup today?
Frederick Brooks: I happily use a Macintosh. It's not been equalled for ease of use, and I want my computer to be a tool, not a challenge. <http://money.cnn.com/magazines/fortune/fortune_archive/2005/12/12/8363107/> [Frederick Brooks is the author of 'The Mythical Man Month'. He spearheaded the movement to modernize computer software engineering in 1975]
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

Derek -

What do you use for your anti-virus, etc if you don't use Symantec? I
am new to the Mac and am looking for comprehensive protection.

Thanks -

Deirdre

--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

Deirdre wrote:

Derek -

What do you use for your anti-virus, etc if you don't use Symantec? I
am new to the Mac and am looking for comprehensive protection.

<Derek costume>

At this moment in time, there are no *malware issues in the wild for
Macs running OS X. Thus, anti-virus software for Macs is like wearing
a raincoat on a sunny day at the beach.

(Okay, given the incidence of skin cancers and perverts, perhaps this
isn't the best analogy.)

If/when OS X malware does become a real issue, as opposed to a
hypothetical one, it's my considered, albeit non-expert yet still of
some value, opinion that "anything but Symantec" will be the
catchphrase of the moment.

</Derek costume>

Welcome to a brave new world of not needing comprehensive protection
for your computer. Welcome to Macintosh©

Copyright J. Steinberg 2006. All Rights Reversed.

--
-John Steinberg
email: not@thistime.invalid

*Malware: Trojans, Viruses, Adware, Spyware, Windows
(that last one is a funny -- insert chortle)
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

I used to use Symantec, but have moved to Clamxav
(http://clamxav.com/). It's free and the performance of my computer
seems to have increased by quite a bit. Also I found that it was more
able to detect the test virus from EICAR.

cheers,

rod

--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

John, all of that is so true. However I do think it is a good idea to
atleast have a scanner on your PC .That way if you receive files from a
Windows user that you need to share with other Windows users there is
less chance of you passing on some kind of bird flu to them.

The only virus I ever had on the Mac was a false report, in fact it was Symantec detecting one of its own bugs!

cheers,

rod

--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

rodmc wrote:

I used to use Symantec, but have moved to Clamxav
<http://clamxav.com/>

Thanks for that. That's new to me. I love clams.

. It's free and the performance of my computer
seems to have increased by quite a bit.

Really? Could you expand on this a bit, Rod?

Also I found that it was more
able to detect the test virus from EICAR.

I'm a Merkin. I worry more about NASCAR viruses. </joke>

--
-John Steinberg
email: not@thistime.invalid
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

On Thu, 20 Apr 2006 06:24:47 -0500, John Steinberg wrote
(in article <200420060724472317%seesig@bottom.invalid>):

I'm a Merkin. I worry more about NASCAR viruses. </joke>

You're a what? From the dictionary furnished with OS X (I'm running 10.4.6).....

merkin |?m?rk?n| |?m?rk?n| |?m??k?n|
noun
an artificial covering of hair for the pubic area.

--
James Leo Ryan ..... Austin, Texas ..... taliesinsoft@mac.com

--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

TaliesinSoft wrote:

You're a what? From the dictionary furnished with OS X (I'm running 10.4.6).....

merkin |?m?rk?n| |?m?rk?n| |?m??k?n|
noun
an artificial covering of hair for the pubic area.

It's also --believe it or not -- a rug for chest hair.

(Ahh, the things I learned during my brief interniship in the porn
industry.) *cough*

A Merkin, James. As in where are you from?

My reply: Merica.

Therefore, I'm a Merkin (and/or a decider.)

--
-John Steinberg
email: not@thistime.invalid
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

Deirdre wrote:

Derek -

What do you use for your anti-virus, etc if you don't use Symantec? I
am new to the Mac and am looking for comprehensive protection.

If you are using OS X, then you won't need Symantec. It'll be a waste
of good money. I'm not using any AV software and haven't for two years running.

--
Where are we going?
And why am I in this handbasket?
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

rodmc wrote:

John, all of that is so true. However I do think it is a good idea to
atleast have a scanner on your PC .That way if you receive files from a Windows user that you need to share with other Windows users there is
less chance of you passing on some kind of bird flu to them.

The only virus I ever had on the Mac was a false report, in fact it was Symantec detecting one of its own bugs!

I'd say that it is the windows users responsibility for providing for
their own protection. Since when are users of other platforms have to
be responsible for M$ insecure O/S?


--
Where are we going?
And why am I in this handbasket?
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

In article <1145529718.792721.119350@t31g2000cwb.googlegroups.com>,
"Deirdre" <dhonner@gmail.com> wrote:

Derek -

What do you use for your anti-virus, etc if you don't use Symantec? I
am new to the Mac and am looking for comprehensive protection.

Thanks -

Deirdre

I am glad to help.

This reply ended up being comprehensive enough that I thought I should
also post it as its own thread entitled "Mac OS X Available/Recommended Anti-Virus Apps".

1) Virex: $40.21 per license (but note that you have to buy 5 licenses
at a time). I have been using Virex for many years. In the days of Mac
OS 7, 8 an 9 it was easily the best due to a nice feature where it
checked if files had been modified since the last time it had run. Its
speed was remarkably fast because it knew when it could skip over files
it had previously checked.

Then McAfee bought it, tossed out the old programming and made it just
another anti-virus program without any speed advantage. But I have stuck
with it. The fact that it was free at .Mac until 2006 has helped.

Great things that remains about Virex are that its virus definitions are updated for FREE very regularly, McAfee have a top notch virus
information center, and I have never heard of it messing with anyone's
system. It simply works.

Well, actually I have read about the virex background engine, called
VShield, hogging the CPU. In reality it only does this if you have its services activated in the Virex preferences, and only when your CPU is otherwise at rest. VShield is set with a low CPU priority. If it bothers
you it is very easy to remove it from your startup items. It really
serves no purpose, so far, since there are still no Mac viruses 'in the
wild' to worry about. Instead you should regularly start up the Virex application alone and have it check your entire computer on a regular
basis. I do this at very least every time there is a new virus
definitions update, which is about every 2 weeks. Occasionally it
discovers some Windows virus sent to me in email. I have never had it
report a false-positive virus discovery (unlike Norton Anti-Virus!).

Sadly, McAfee now only sell Virex 7.7, the latest MOSX 10.4 compatible version, in lots of 5. You can't buy individual copies. I've talked to
them about this, but they refuse to provide alternatives. They only want
to sell Virex to enterprise computing environments. You can download a
demo version.

<http://www.versiontracker.com/dyn/moreinfo/macosx/10355> <http://www.mcafee.com/us/enterprise/products/anti_virus/file_servers_des ktops/virex.html>


2) ClamXav: FREE, Open Source and cross platform. It's virus definitions
are regularly updated. But it is very primitive and clunky. With time it
is getting better. Sadly, a few weeks ago a number of security
vulnerabilities were been found in the current version. (Echoes of
Symantec!). But it much better than not using an anti-virus at all. I
expect it's holes will be patched in the coming month. The patches have already begun on Linux and will soon filter over to Mac.

Other points: If you dig around you can find a beta version that worked
on MOSX 10.2.x. Don't bother, it is total garbage. Also, ClamXav is incompatible with MOSX Server 10.4.x. It has been reported to conflict
with some other applications like TigerCacheCleaner. Its scheduling
system has problems.

<http://www.versiontracker.com/dyn/moreinfo/macosx/24449> <http://www.markallan.co.uk/clamXav/>


3) Intego VirusBarrier: $70 + $30 per year for virus definition updates
(after the first year). This is the newcomer to the anti-virus business.
But it already has a better reputation than Virex, going by ratings over
at Version Tracker. It is a Universal Binary that runs natively on
Macintels. It has a niffy kewl GUI, and has built-in automated virus definition updates. Its best feature is the one that Virex used to have: Speed. It indexes as it scans, allowing it to skip files that have not
been modified. Instabilities have been reported, as well as a propensity
to toss up annoying modal message boxes. Thankfully Intego keep
improving it with regular updates.

My reservation here is the money sucking. No way do I want buy into a
virus application so I can pay $30 per year for new virus definitions. I
could justify paying if I ran a facility of Macs, but not for just me
and my PowerBook. There is no demo available.

<http://www.versiontracker.com/dyn/moreinfo/macosx/16289> <http://www.intego.com/virusbarrier/>


4) Sophos Anti-Virus: $?? (The price is not available on their website.
You know what that means). This is a professional grade virus program, designed for businesses with a network of computers. The Sophos virus information center is excellent. It is a great place to visit regularly
even if you never use their software. As for the program itself, the
debate about it is quite contentious. Some people have found it buggy
and unstable. Some consider the GUI out of date. It has been known to
make false-positive virus discoveries. And then there are some people
who like it just fine. They have a 30 day demo. You want the standalone
Mac OS X version.

<http://www.versiontracker.com/dyn/moreinfo/macosx/9815> <http://www.sophos.com/products/es/endpoint-server/sav-mac.html>


5) TigerCacheCleaner: $9 shareware. It had to happen, and I am glad TigerCacheCleaner did it first. This inexpensive shareware program
integrates ClamXav virus scanning, including scheduling! It is a
Universal Binary that runs natively on Macintels. The only problems I
have read about are instability and occasionally flaky behavior.
Thankfully it is regularly updated. Beside virus checking this utility
does nearly 40 other things related to Mac OS X. Essentially it
integrates the abilities of scores of other utilities at a decent price.

NOTE: TCC is supposed to work on MOSX 10.1 - 10.4.x. I have not verified
this. It is typical for Universal Binaries to only work on MOSX 10.3.9
and above, despite claims to the contrary.

Also Note: The developer is offering a bundle of TCC with their Lights
Out program for $1 more. "Lights Out is an application designed to give
users more control over Apple's Energy Saver." Check their website.

<http://www.versiontracker.com/dyn/moreinfo/macosx/16494> <http://www.northernsoftworks.com/tigercachecleaner.html>


CONCLUSIONS:
- Intego VirusBarrier gets the bells and whistles award. But you pay
for it, every year.
- Virex works fine, but you basically have to already have it, or
obtain it by some circuitous route, to use it. Virex 7.2.1 and 7.6/7.7
work fine with MOSX 10.4.x. Virex 7.5.1 does not, only with 10.2.x and
10.3.x.
- ClamXav is a good idea and very decent for free, but it is not
exactly ready for prime time.
- TigerCacheCleaner looks like a better alternative to the ClamXav application, providing all its capabilities along with a zillion other features for cheap.
- Forget about Sophos software unless you are an enterprise. But most definitely visit their website to learn about viruses! It is a great
place.

Further EXCELLENT information about Mac OS X malware and vulnerabilities
is available from Secunia. You can sign up for their weekly summary
email list. You can visit them at:
<http://secunia.com/>

Every week (or so) I post a 'Mac Security' thread here at CSMA and CSMS
where you can find out the latest news being reported regarding MOSX vulnerabilites and patches.

:-Derek

--
Fortune Magazine, 11-29-05: What's your computer setup today?
Frederick Brooks: I happily use a Macintosh. It's not been equalled for ease of use, and I want my computer to be a tool, not a challenge. <http://money.cnn.com/magazines/fortune/fortune_archive/2005/12/12/8363107/> [Frederick Brooks is the author of 'The Mythical Man Month'. He spearheaded the movement to modernize computer software engineering in 1975]
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

In article <200420060704138280%seesig@bottom.net>,
John Steinberg <seesig@bottom.net> wrote:

<Derek costume>

At this moment in time, there are no *malware issues in the wild for
Macs running OS X. Thus, anti-virus software for Macs is like wearing
a raincoat on a sunny day at the beach.

(Okay, given the incidence of skin cancers and perverts, perhaps this
isn't the best analogy.)

If/when OS X malware does become a real issue, as opposed to a
hypothetical one, it's my considered, albeit non-expert yet still of
some value, opinion that "anything but Symantec" will be the
catchphrase of the moment.

</Derek costume>

Welcome to a brave new world of not needing comprehensive protection
for your computer. Welcome to Macintosh©

Copyright J. Steinberg 2006. All Rights Reversed.

Ever amusing John. You are a fine actor.

Luckily I don't have to put on a costume, and what I say here really is
my opinion.

I can't say your point of view is particularly dangerous or 'CRITICAL'
as the say at the virus sites. But it verges on arrogance and ignorance.

Here I go with numbering things again:

1) Windows users, including credible almost intelligent users (yes, they exist) rightfully point out that there is no such thing as perfect
security. The more sensitive among them go on to say that they are fed
up with Mac user's lax attitude toward security, that we are all going
to get ours, just wait and see, their time will come, then they will
stand around getting drunk in celebration ranting 'I told you so you
stupid Mac fanboys, blah blah blah.'

2) It has already been proven that it is possible to write dangerous
malware for Mac OS X. In the future someone will write MOSX malware than
is more than some lame proof-of-concept and I personally would rather we
were both knowledgeable and prepared. This is why I started posting the
'Mac Security' thread every week in these newsgroups. This is why I tell
folks to listen to the 'Security Now!' podcast every week.

3) ClamXav is FREE. TigerCacheCleaner, which integrates ClamXav as well
as about 40 other utility tasks, is a measely $9. If you can find an old
copy of Virex 7.x that works with your OS version then all the virus definition updates are free. There really is no excuse for not having an up-to-date anti-virus program for your Mac.

4) Despite the lack of MOSX malware 'in the wild' there is an
unimaginably massive amount of it for Windows. I am regularly emailed
some hunk of malware from some Windows user. Most of it is caught by my
ISP. But more recent stuff sneaks through about once a month. I like
knowing that my anti-virus app detects and kills it. Yeah, it is
extremely unlikely I am going to forward malware to some Windows user,
but at least I am removing the possibility.

5) 'Anything but Symantec' indeed.
(A) Buggy, OS crashing NAV
(B) Security hole infested NAV
(C) FUD mongering Symantec
(D) Historic Mac-hating Symantec

I honestly wish they would finally give up making MOSX software and
spare us all from their lame programming and moronic contemptuous
rhetoric. Let the Windows users have Symantec. They deserve them.


Darn, now I am all pissed off again. Make me smile John!

:-D

--
Fortune Magazine, 11-29-05: What's your computer setup today?
Frederick Brooks: I happily use a Macintosh. It's not been equalled for ease of use, and I want my computer to be a tool, not a challenge. <http://money.cnn.com/magazines/fortune/fortune_archive/2005/12/12/8363107/> [Frederick Brooks is the author of 'The Mythical Man Month'. He spearheaded the movement to modernize computer software engineering in 1975]
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

In article <mc2dnRNMkc07VdrZRVn-rA@bresnan.com>,
GreyCloud <mist@cumulus.com> wrote:

Deirdre wrote:

Derek -

What do you use for your anti-virus, etc if you don't use Symantec? I
am new to the Mac and am looking for comprehensive protection.

If you are using OS X, then you won't need Symantec. It'll be a waste
of good money. I'm not using any AV software and haven't for two years running.

Same here.

I was actually running without a firewall, too, for awhile. But when I realized, I turned it back on. I'm not sure that it does me any good,
but maybe it will reduce any unwanted network traffic. And it's free
and built in, too!

--
Differentiation is an integral part of calculus.
--- Synchronet 3.18b-Win32 NewsLink 1.113

From Newsgroup: comp.sys.mac.system

Paul wrote:

In article <mc2dnRNMkc07VdrZRVn-rA@bresnan.com>,
GreyCloud <mist@cumulus.com> wrote:

Deirdre wrote:

Derek -

What do you use for your anti-virus, etc if you don't use Symantec? I
am new to the Mac and am looking for comprehensive protection.

If you are using OS X, then you won't need Symantec. It'll be a waste
of good money. I'm not using any AV software and haven't for two years >>running.

Same here.

I was actually running without a firewall, too, for awhile. But when I realized, I turned it back on. I'm not sure that it does me any good,
but maybe it will reduce any unwanted network traffic. And it's free
and built in, too!

For about 6 months I ran the first mac on broadband without any hardware firewall. But then I wanted to put a few more computers onto the
network, so a good cisco router was put in. Two macs, one Sun, one old
DEC VAX, and one Windows box.


--
Where are we going?
And why am I in this handbasket?
--- Synchronet 3.18b-Win32 NewsLink 1.113