XP Internet Security 2011 Virus

[MacGyver]

Wrong.

The Mac's UNIX underpinnings make it far less susceptible to this type of problem. There are no confirmed Mac viruses "in the wild." There are some "Trojan Horses" in existence. They are very different. These programs purport to be something you want (say, nude pics of a celebrity) but in reality turn out to be something different. It cannot spread without the assistance of the user. The easy way to prevent it? Don't click on that kind of crap… and never download files that you didn't request from a source you can't verify.

A trojan horse is no different than a guy standing outside an ATM that tells you he works for the bank and it is OK to give him your account information and he will give you $20. Would you do that? No. That is exactly how a trojan horse works. They cannot do ANYTHING to your computer without YOU giving them permission–just like the guy outside the ATM.

A virus is very different. If jumps on your pc through whatever means it can–usually without your knowledge–and starts doing something malicious, from harvesting your email addresses to deleting files. That cannot happen on a modern Mac with anywhere near a recent operating system on it…

Don't let the fanboys fool you.

The only reason that Macs haven't had more viruses over the years is that they represented such a small portion of the total user base. As more users switch to Apple products, you're going to see more viruses. We're already tracking binaries that are targeting Mac users. They're out there.

Criminals, especially organized criminals are drawn to where the money is. A bunch of college students running Macs, who don't yet know appropriate online behavior, and who think there Macs are unsusceptible to malware make a pretty nice target. And a growing target at that.

That said, the way criminal networks access your data is evolving with the advent social networking. Why spend all this time and effort writing a rootkit to try and get low level hooks into your system, when I can just put up a facebook app? I don't have to steal your data - in a lot of cases you're willing to give it away just to plant some pretend vegetables or something.

[Caster]

Thanks to everyone, except you Mac Fanboys, you suck with your fancy virus proof boxes! Is the iPhone as bullet proof as the Mac OS's?

My wife has hers surgically grafted to her hand. Never an issue unless she forgets to charge it, but then again she'll just cuddle up with her iPad if that happens. I use my iPod to surf sometimes, it's slow but I'v never had a moments trouble out of it. I don't care what the masses use, Mac is where it's at.

[LagerHead]

Buy a Mac?

Worked for me.

LOL...Mac's are no longer that safe....BAWHAHAHAHAHA

It's relative. Online safety on a Mac vs. a PC right now is comparable to the difference between riding down the interstate going 90 while standing on top of your car vs. being in a Volvo station wagon with your seatbelt on in your driveway while surrounded by 10 airbags.

Worst virus I have ever seen for a PC.........Windows.

Same here. I used to defend Windoze. Until I just got tired of fixing the PC of every person I know. I don't begrudge people that use Windows - there's no doubt it has way more programs and is much more widely supported - but I will never buy another Windoze product again.

[Reservoir Dog]

Have you tried Combofix? A guide and tutorial on using ComboFix

This.

Our computer at work got infected with the XP Security virus, and our IT guy cleared it up with ComboFix.

[Guest db99wj]

This.

Our computer at work got infected with the XP Security virus, and our IT guy cleared it up with ComboFix.

I saw that on bleepingcomputer and was hesitant due to some of the warnings. If this thing comes back, I will definitely run that.

[Guest nicemac]

Don't let the fanboys fool you.

The only reason that Macs haven't had more viruses over the years is that they represented such a small portion of the total user base. As more users switch to Apple products, you're going to see more viruses. We're already tracking binaries that are targeting Mac users. They're out there.

Criminals, especially organized criminals are drawn to where the money is. A bunch of college students running Macs, who don't yet know appropriate online behavior, and who think there Macs are unsusceptible to malware make a pretty nice target. And a growing target at that.

That said, the way criminal networks access your data is evolving with the advent social networking. Why spend all this time and effort writing a rootkit to try and get low level hooks into your system, when I can just put up a facebook app? I don't have to steal your data - in a lot of cases you're willing to give it away just to plant some pretend vegetables or something.

I am not a fanboy–I have made my living for the past 14 years supporting Macs in a professional environment. There are approximately 30 million Macs in use daily in the US. No (zero) viruses since the adoption of OS X- nearly ten years ago. When Microsoft Windows XP was released to the 14,000 beta testers that initially got it, it only took ONE WEEK for a virus to appear for the OS. There were only 14,000 beta testers. No money in that…

The security-through-obscurity myth is just that, a myth. Don't you think by now, after 10 years that a virus writer would have written a virus for the Mac just to wipe the smug smile off of Steve Jobs face? Sure they would have.

The Mac OS is secure because it is UNIX. Period.

Now having said all that, you are correct about one thing–social media sites like Facebook are a problem. HOWEVER, users of Macs only have to worry about what someone tricks them out of–just like the guy I referenced earlier standing outside an ATM trying to get your personal data. FaceBook apps cannot breach the Mac OS security…

BTW, Symantec anti-virus has around 76,000 virus definitions in its database. There are three for the Mac. They are all proof-of-concept viruses that have never been released in the wild. The newest of three is from 2004…

Edited May 18, 2011 by nicemac

[Guest Lester Weevils]

Be highly vigilant in checking your bank account and credit info if you've done any online shopping or banking from this computer. Most of the binaries that we've unpacked have got keystone loggers set to forward your username and password when you hit any of the major financial sites.

MacGyver, do you have ideas of the best way to sweep for keyloggers? I haven't searched lately, but last time I looked, there didn't appear to be a sure-fire way to make sure you don't have a keylogger. At that time it seemed you could run tools that would look for keyloggers, but just because the tool didn't find a keylogger, was not a guarantee you were clean.

At that time was trying to find out how a credit card password got stolen. It was suggested that most likely the password was hacked somewhere else rather than from my puter. But ever since, keyloggers have been a worry. Even paranoid people can have enemies!

[MacGyver]

I am not a fanboy–I have made my living for the past 14 years supporting Macs in a professional environment. There are approximately 30 million Macs in use daily in the US. No (zero) viruses since the adoption of OS X- nearly ten years ago. When Microsoft Windows XP was released to the 14,000 beta testers that initially got it, it only took ONE WEEK for a virus to appear for the OS. There were only 14,000 beta testers. No money in that…

The security-through-obscurity myth is just that, a myth. Don't you think by now, after 10 years that a virus writer would have written a virus for the Mac just to wipe the smug smile off of Steve Jobs face? Sure they would have.

The Mac OS is secure because it is UNIX. Period.

Now having said all that, you are correct about one thing–social media sites like Facebook are a problem. HOWEVER, users of Macs only have to worry about what someone tricks them out of–just like the guy I referenced earlier standing outside an ATM trying to get your personal data. FaceBook apps cannot breach the Mac OS security…

BTW, Symantec anti-virus has around 76,000 virus definitions in its database. There are three for the Mac. They are all proof-of-concept viruses that have never been released in the wild. The newest of three is from 2004…

Listen, I'm a huge apple fan. I'm not calling you out here. Most users have been very happy with their Macs, and quite secure for some time.

The world is changing, though. Microsoft is no longer really seen as the evil empire they used to be. Apple's user base is growing rapidly - because they make a great product. But, they've also surpassed Microsoft now from a market cap perspective, and there is always that segment of the population that likes to hurt the big guy just to hurt them. Look at the Sony breach that has been going on for a month now.

When there is money to be made by stealing identities, the criminal element is going to take aim at you. Period. We teach our clients every day that security by obsurity is an awful strategy to build your business on, but many companies do exactly that.

Most of the big cybercrime we're tracking and investigating right now is coming from former Soviet bloc countries and China. The scary thing about both of these groups is that they have real intelligence gathering capabilities and real skills. We've already seen plenty of MacOS based 0-day exploits and unpatched vulnerabilities sell on the black market. It's only a matter of time before someone takes one of those and weaponizes it to hit the masses.

I agree that historically, UNIX based systems have proven more secure. There are many academic discussions to be had on the reasons for that. I certainly have my own opinions. But, the MacOS is not a holy grail. You can't approach it with the same skill sets or tools, but that's not to say it's a challenge that can't be met. They will have their day.

My fear is that when some widespread Mac stuff does hit, Apple is really going to have its work cut out for them in getting the message out to their users, because many of them do live in that, "I've got a Mac, I can't be hit" dreamworld.

MacGyver, do you have ideas of the best way to sweep for keyloggers? I haven't searched lately, but last time I looked, there didn't appear to be a sure-fire way to make sure you don't have a keylogger. At that time it seemed you could run tools that would look for keyloggers, but just because the tool didn't find a keylogger, was not a guarantee you were clean.

At that time was trying to find out how a credit card password got stolen. It was suggested that most likely the password was hacked somewhere else rather than from my puter. But ever since, keyloggers have been a worry. Even paranoid people can have enemies!

Lester, we trade off with them all the time. We take a step and they take two. We get ahead and then they change the game. I'll tell you our approach as a forensics firm, and note that your mileage with it may vary.

We don't use AdAware, Spybot S&D, Malwarebytes or anything. From a software perspective, we have a corporate TrendMicro subscription covering anti-virus, and that's it for our workstations. We do however, because of the nature of things that we work on have some fairly serious controls. We wipe and reimage every one of our machines once a quarter, whether "it needs it or not". This is across all platforms and OSs. If we mount a drive up in one of our forensic workstations, it gets wiped and reimaged after we finish the case. We've got a sandbox in our lab, where nothing goes in or out.

As sad as it sounds, I apply this in my personal life as well. My personal stuff gets the same treatment from a reimaging perspective. It's effective.

The internet is one huge experiment in social anarchy. It's the wild west. Prepare accordingly.

That said, your card really more safe with a reputable merchant online than it is when you hand it to a server who takes it out of your sight at a restaurant. The criminal networks have gotten so good, that when a mule swipes your magstripe data at a restaurant, there is already someone standing in line at Best Buy with a big screen TV. They can literally commit thousands of dollars worth of identity theft before you sign your receipt for your meal.

Edited May 18, 2011 by MacGyver

[Guest Lester Weevils]

Thanks for the good ideas, MacGyver

Routine erase and restore sounds good.

My financial stuff is quarantined to a MacBook. WIFI is turned off and ethernet rarely gets plugged in. It is never used for recreational surfing. Perhaps a low exposure profile, but anything can be hacked.

====

Dunno much about security and I like Macs and PCs about the same. I don't use anti-malware software on Macs. Not from a feeling of invulnerability. Just dunno of one that would offer protection worth the money and trouble.

Maybe one Mac security risk--

MacOS pops up the admin password dialog so often that the typical user probably just automatically types it in and hits Enter.

It would seem easy to write a free trivial program and then take over a bunch of machines in short order? User runs the installer, installer gets the admin password, then installer gives you the free program plus a keylogger?

Talented programmers live all over the world. Some fine open source programmers (great fellows) live the same places as the criminal hackers.

Downloaded a great hex editor from Russia a couple of years ago. A Chinese fellow writes an excellent Mac chm viewer. A paranoid person might wonder if such things contain time bombs. OTOH a program downloaded from NY or TN could pose the same risk.

I search for malware reports before downloading programs. However, an excellent-written sleeper program would not do anything obvious enough to be noticed. Perhaps a sneaky-enough Trojan could lurk for years without raising alarm?

Then there are the open source developer tools. When you run an SVN script and it downloads a zillion updated files (written by people from all over the world) then asks for your admin password and compiles all of them, streaming thousands of lines across the terminal window. Maybe one of those lines says, "You fool. Now your machine is a bitch in my spam harem!" How many people are gonna read all that stuff?

[enfield]

I got tired of stripping and reloading my wife's XP laptop so I've been running IOLO System Mechanic on if for a couple of years now. Not free, but inexpensive and very effective.

I run Linux on the computers I use.