[jam8]

I bought my first Mac about a month ago and i love it. However, i do have a pc backround, which makes me very wary.... read on.


I had to type a proposal for hurricane katrina relief concert. I did this in microsoft word. Then, i sent it to an associate to proof. She was using a pc. She makes some alterations, and sends it back to me. Everything is fine. Then, i send it to a friend, also on a pc, to see what she thinks of it. Outlook express does not let her open it, saying that it's identified a virus, etc.

Now, to my pc mind, i'm in BIG trouble.

I've opened the "infected" file that was sent to me. I've had no problems with my apple that i notice yet, but now i'm really worried.

I really don't know much about this stuff. Can a pc virus effect a mac? I've heard all of this talk about macs being virtually insucceptible to all of the virus crap that is known to ruin the pc.
how true is this? am i in a serious red zone?

is there a free virus scanner for macs that anyone knows about?

i'm really worried about this. I have not noticed anything at all with my computer yet, and i did the work on the letter a few hours ago; but i havn't restarted yet.

I'm going to pray to the Apple lord that i didn't get a virus or anything malicious of that nature.

PLEASE HELP! Thankyou!

[Ω]

A PC virus will not effect a mac.

You can however pass this infection on. Being a good internet neighbour, you should have a virus checker to help out our poorer cousins.

I am a bad neighbour. They bought a PC, why should I have to deal with their issues.

[zenatek]

A Virus coded for a PC (windows/Linux) can not affect your Mac. Its like wondering if a broken part of a Ford could be put in a chevy and cause it to also have a malfunction. You can't even get the Ford part in the Chevy.

I know cheesy analogy but it works.

[zenatek]

Amen to wasting our time and processor power to helping PC users...its there fault if they get a virus.

[Big Mac]

Now let's hold on a second, Word macro viruses are still cross platform correct? If the security settings on Office allows those macros to run, they could still present a threat to OS X I believe.

[esXXI]

Originally Posted by Big Mac

Now let's hold on a second, Word macro viruses are still cross platform correct? If the security settings on Office allows those macros to run, they could still present a threat to OS X I believe.

I thought that was only OS 9 days? I've never heard of any Office macro viruses working on OS X.

[jam8]

Lets hope not!

For the record, i have not noticed any problems whatsoever at this point... I've restarted, put it to sleep multiple times, etc. to make sure everything is working right. I also deleted the file that was apparently infected.

Thankyou all for the insight on the topic. i really appreciate your help.

Does anyone know about the potential risk due to office being cross platform?

[TETENAL]

PC viruses can not affect Macs. Now with Office macro viruses I'm not so sure. I believe they could in theory affect Office in some way but often rely on Window paths and such things and therefore don't work. I don't have Office though so I don't know for sure. Anyway, it's wise to turn off macro functionality in Office.

http://www.markallan.co.uk/clamXav/

You can use the free virus scanner clamXav to scan documents so that you don't accidently pass a virus from one PC user to another (like it likely happened in your case).

[Chuckit]

Like TETENAL said, a macro virus could conceivably run, but what could it really do? There's no Registry or files in the same locations. Unless it was specifically coded for Mac OS X (haven't heard of such a thing), there wouldn't be much on your system for it to infect. So you were almost certainly an immune carrier.

So for peace of mind, check your system with ClamXAV. Then, disable running of macros in Word's preferences so there's no possibility at all they could ever do anything.

[alphasubzero949]

JFC. Do people even search the forums anymore?

[Chuckit]

Not when they're panicking, I guess. (Does your kernel search MacNN for solutions to the problem when it's panicking? I think not.)

[OreoCookie]

First of all, there is no (read: 0) MacOS X virus known yet. As for macro viruses, the infection must have happened on a pc, so you could have acted as a carrier.

I also don't think macro viri can do a lot of damage to Macs, because (i) even macro viri are not designed for Macs and (ii) they don't share the same vulnerabilities as windows pcs do.

[Orion27]

I think if you don't send attachments as window's friendly they will be rejected by Outlook as viral. I don't think it was an issue from the beginning.

[budster101]

Just disable macros in Word. Who uses them anyway?

[ghporter]

Originally Posted by OreoCookie

First of all, there is no (read: 0) MacOS X virus known yet. As for macro viruses, the infection must have happened on a pc, so you could have acted as a carrier.

I also don't think macro viri can do a lot of damage to Macs, because (i) even macro viri are not designed for Macs and (ii) they don't share the same vulnerabilities as windows pcs do.

Correction: No MacOS X viruses in the wild yet. (Remember, I'm the gloomy gus that still tries to warn people to be prepared for when Macs are common enough that the script kiddies start messing with us...) The architecture of the two operating systems is very much different, but that does NOT mean that MacOS is permanently immune to all viruses for ever and ever. To believe so would be naieve at the very least.

Also, unless you have configured your Office programs to at least warn you that a document has a macro in it and give you the option of whether or not to run that macro, YOU CAN be infected by an Office macro virus. That doesn't mean it can wreak havoc on your computer, but it can goober things up as far as Office goes. It is supposed to be configured that way by default, but it's always good to check.

No Mac viruses in the wild right now just means that we aren't a juicy enough target for the bad guys, but have you noticed how the Mac market share is increasing? Somebody is eventually going to get the bright idea that he can mess with OS X and will work at it until he succeeds. At that point a lot of people will be hosed because they don't believe in the possibility of a virus on a Mac.

Now back to the OP's question. Outlook Express is supposed to be very conservative. But it is also kind of simple-minded too. What version of Word did you use, and is the computer that reported the virus problem running a version that can open YOUR document? Your version of Word should tell you about a macro if you tried to open the edited document, (and you can tell it NOT to run the macro and still be safe) so see what happens. Also, what virus did OE tell the other user was in that document? It does make a difference.

[OreoCookie]

Originally Posted by ghporter

Correction: No MacOS X viruses in the wild yet. (Remember, I'm the gloomy gus that still tries to warn people to be prepared for when Macs are common enough that the script kiddies start messing with us...) The architecture of the two operating systems is very much different, but that does NOT mean that MacOS is permanently immune to all viruses for ever and ever. To believe so would be naieve at the very least.

Also, unless you have configured your Office programs to at least warn you that a document has a macro in it and give you the option of whether or not to run that macro, YOU CAN be infected by an Office macro virus. That doesn't mean it can wreak havoc on your computer, but it can goober things up as far as Office goes. It is supposed to be configured that way by default, but it's always good to check.

No Mac viruses in the wild right now just means that we aren't a juicy enough target for the bad guys, but have you noticed how the Mac market share is increasing? Somebody is eventually going to get the bright idea that he can mess with OS X and will work at it until he succeeds. At that point a lot of people will be hosed because they don't believe in the possibility of a virus on a Mac.

Now back to the OP's question. Outlook Express is supposed to be very conservative. But it is also kind of simple-minded too. What version of Word did you use, and is the computer that reported the virus problem running a version that can open YOUR document? Your version of Word should tell you about a macro if you tried to open the edited document, (and you can tell it NOT to run the macro and still be safe) so see what happens. Also, what virus did OE tell the other user was in that document? It does make a difference.

Yes, true, but I was trying to answer the OP's questions instead of being as general as possible. Eventually there might be a MacOS X virus, but up until now, I haven't heard of one which caused some damage. Some proofs of concepts were heralded as first virus, but I've yet to see one infection which actually spreads beyond laboratories.

However, the OP was afraid his computer might be infected with a Windows virus (which is impossible for general viri and unlikely for macro viri), and I think he just acted as a carrier.

I would second Budster's suggestion to deactivate macros. Suggest your colleagues to do the same unless you are sure you need them.

[gdiddy]

I have to ask the doom and gloom believers - Why hasn't a virus been created for the Mac yet?

As far as I can tell from what I've read, hackers who create viruses do it for two reasons -

1) to get personal info off of your computer and use it

2) to cause major chaos and get "Prop" from all the other hackers out there.

Wouldn't the hacker who created a working Mac virus be a hero to all the PC world? How many PC users have had to come up against a smug Mac user and have the security issue rubbed in their face? Have they tried and just given up? While the amount of chaos created would be small - only a percentage of the already small 7-10% of Mac users - the creator would have to be regarded as a GOD!

I think to pass off the lack of viruses due to the small percentage of Mac users is to ignore the mindset of the hacker.

[budster101]

They hate M$. M$ = Bad, Mac = Good.

I don't know.

[Chuckit]

Originally Posted by gdiddy

Wouldn't the hacker who created a working Mac virus be a hero to all the PC world? How many PC users have had to come up against a smug Mac user and have the security issue rubbed in their face? Have they tried and just given up? While the amount of chaos created would be small - only a percentage of the already small 7-10% of Mac users - the creator would have to be regarded as a GOD!

I think to pass off the lack of viruses due to the small percentage of Mac users is to ignore the mindset of the hacker.

I feel quite confident I could create Mac malware with not too much effort. The reason nobody wants to do this is, as you said, the amount of chaos you could potentially cause is really small. But to create an Anna Kournikova screensaver that deletes your home folder while it works? Easy. One that sends itself to people in your address book? Just embed an SMTP server.

The thing is that the Mac is not an attractive market. It's small and the damage you can cause (and ease of infection) is even more miniscule compared to Windows.

[jam8]

Outlook Express is supposed to be very conservative. But it is also kind of simple-minded too. What version of Word did you use, and is the computer that reported the virus problem running a version that can open YOUR document? Your version of Word should tell you about a macro if you tried to open the edited document, (and you can tell it NOT to run the macro and still be safe) so see what happens. Also, what virus did OE tell the other user was in that document? It does make a difference

I used Microsoft Word X for Mac Service Release 1. I've never had problems opening files from word that were written on a different version of the program.

I just turned on a macro virus warning thing via preferences. I can't figure out how to disable macros though. How do i do this?

I'm really not sure of what virus OE said was received. I don't think that I send a "windows friendly" attachment...maybe that could have been the cause of this whole mess?

[ghporter]

Chuckit has said it pretty well. Most virus writers are more interested in notariety than anything else-the majority of them are "script kiddies" who couldn't write a "Hello World" program with somebody holding their hands. BUT--they can use virus toolkits to make their "mark" much like gang bangers spraypaint stuff to mark their turf...or dogs peeing on trees for that matter.

There are fairly good coders out there who write viruses, but most of them are still interested in messing with the most people, or figuring out how something works by tinkering with it (the original definition of "hacker") and then letting their work get out of hand. Very few original viruses are written to harvest personal data, though the virus toolkits make that fairly easy to do. It's easier to phish for that sort of thing anyway.

Finally, Windows is just easier to poke into than Mac OS is. Windows is made from so many bits and pieces that have been around for years and years-and NEVER tested for security-that nobody can possibly know where all the holes might be. Mac OS, with its basis being Open BSD, is built from well crafted, well tested modules. Further, much of Windows rests on a maze of interconnected and interdependent units that may or may not work as expected when strange things happen, while Mac OS is built of much more independent units that, while they depend on other units to do their jobs, gracefully handle problems because they were designed to do so. It's harder to mess with a well built brick wall than with a stack of bricks, blocks and beams, though you can poke holes in both of them if you work at it.

[JKT]

Originally Posted by jam8

[i]I'm really not sure of what virus OE said was received. I don't think that I send a "windows friendly" attachment...maybe that could have been the cause of this whole mess?

In Mail, select the Edit>Attachments>Always send Windows friendly attachments option.

[Chuckit]

Originally Posted by jam8

I'm really not sure of what virus OE said was received. I don't think that I send a "windows friendly" attachment...maybe that could have been the cause of this whole mess?

No. Sending a Windows-friendly attachment has nothing to do with macro viruses.

[I was David B.]

Originally Posted by jam8

I've opened the "infected" file that was sent to me. I've had no problems with my apple that i notice yet, but now i'm really worried.

I really don't know much about this stuff. Can a pc virus effect a mac?

I try to think back to the times when I was writing Office macros (last century):

You always get a virus warning if an office document contains any macro. That can be an absolutely harmless macro that only supports your document, but you get the warning unless you disable the warnings (don't!).

Office macros can make use of all office objects. That means the worst thing they can do macrowise is to open a file, modify, write it back and destroy some files on your disk. But, if the macro has been written for windows and the programmer was not smart (having also macs in mind), any file operation might begin with c : \ and thus nothing will happen on your mac.

The real dangerous power of office macros is that they can make use of activex and the whole windows api. Thus they can perform nearly every operation on windows and really trash the system. But, the Macintosh api is not the windows api and activex is not present on the mac (what a pity ).

So I guess the risk for you is really low. Macros on the mac should be mostly interpreted scripts that are more or less harmless. Calls to really dangerous apis will not work on the mac.

My information is a little bit dated. But since Microsoft is slow with innovations and the mac unit is even more behind adapting the vba suite I assume that you are pretty safe.

I myself have a couple of windows worms and viruses in my mailbox. They simply rest there in piece and cannot do anything.

Seems that your platform choice has been a good one this time, so welcome here.

[gdiddy]

"But to create an Anna Kournikova screensaver that deletes your home folder while it works?"

But wouldn't the screensaver have to ask for permission before it could delete the home folder?

[alphasubzero949]

Originally Posted by gdiddy

"But to create an Anna Kournikova screensaver that deletes your home folder while it works?"

But wouldn't the screensaver have to ask for permission before it could delete the home folder?

Not only that, but the Trojan would be a dead giveaway especially if you're using column view, just like the "proof-of-concept" MP3 showing up as an app.

[I was David B.]

Originally Posted by gdiddy

"But to create an Anna Kournikova screensaver that deletes your home folder while it works?"

But wouldn't the screensaver have to ask for permission before it could delete the home folder?

Any macro inherits the users permissions to change files etc. If you don't open your macro files with administrator permissions (you don't, do you ), they will not be able to destroy your home folder.

On windows it is a bad behaviour that the admin is the default user and most windows users are too lazy to create a non admin user account for daily use that has only restricted permssions.

[TETENAL]

Originally Posted by I was David B.

Any macro inherits the users permissions to change files etc. If you don't open your macro files with administrator permissions (you don't, do you ), they will not be able to destroy your home folder.

I have permissions to delete files in my home folder, so so does any trojan I launch. Maybe my home folder would still be there, but it would be empty.

[I was David B.]

Originally Posted by TETENAL

I have permissions to delete files in my home folder, so so does any trojan I launch. Maybe my home folder would still be there, but it would be empty.

yes, thats true.

[Chuckit]

Originally Posted by gdiddy

"But to create an Anna Kournikova screensaver that deletes your home folder while it works?"

But wouldn't the screensaver have to ask for permission before it could delete the home folder?

Nope. Remember: You have permission to delete anything in your home folder, and programs you run have permission to do the same things you do.

Originally Posted by alphasubzero949

Not only that, but the Trojan would be a dead giveaway especially if you're using column view, just like the "proof-of-concept" MP3 showing up as an app.

Except I'm not talking about disguising executable code as a music document; I'm talking about disguising malicious executable code as harmless executable code. There would be no need to try and trick the OS. It would be exactly the kind of file it says it is.

[analogika]

Originally Posted by Chuckit

Nope. Remember: You have permission to delete anything in your home folder, and programs you run have permission to do the same things you do.


Except I'm not talking about disguising executable code as a music document; I'm talking about disguising malicious executable code as harmless executable code. There would be no need to try and trick the OS. It would be exactly the kind of file it says it is.

Well, yes.

But that would be utterly pointless. A trojan that deletes some files on a few select users' machines. Anything beyond that requires an admin password.

Woo.

No real glamour in that, nor money - which takes all the fun out of writing such a piece of malware.

If you manage to make it self-replicating via the Address Book and an embedded SMTP server just before it goes to work on the home folder, everybody who has it sent to them needs to a) double-click the attachment, and b) answer the dialog box about the program "xyz" running for the first time.

'twould not be a much worthy subject.

Especially since the machine in question would be completely useless for all future hacking use.