Welcome to the MacNN Forums.

Dark Sailor · 10:37 AM

OK...I was thinking of posting this as I woke up this morning. When I checked the forum, I saw the post below (Put Up Or Shut Up: No Viruses On OSX), and was going to add this comment to that thread, but it looks like it developed into a semantic discussion on "perfect" code (which is fine by me, but beyond the present topic). That said, read on...

I ran Norton the other night on my hard drive and was a little displeased (and disturbed) at its findings (check the picture below.) My questions are:

1. What is up with this stuff (and what's the worst that can come of it)?
2. What sketchy things have you found on your HD?

[removed oversize image --tooki]

Philip J. Fry · Oct 2, 2005, 02:14 PM

I've had that. It's not OS X specific for viruses, just java which any machine can get. That's why I set my java prefs to not cache anything.

Cadaver · Oct 3, 2005, 09:35 PM

This is going to be a lonely thread. There are no known MacOS X viruses/trojans in the wild.
If you experience odd behavior on your Mac, its NOT from a virus.

Dark Sailor · Oct 4, 2005, 09:59 PM

Originally Posted by Cadaver

There are no known MacOS X viruses/trojans in the wild.

"Known" would be the key word there...

Gelfling · Oct 4, 2005, 10:04 PM

Originally Posted by Dark Sailor

"Known" would be the key word there...

The antivirus companies are clearly desperate for OS X to have a virus. I'm sure if there *were* any in the wild, they would be pouncing on it and letting us know in know uncertain terms. Therefore I think it is safe to assume that no "Known" viruses is basically no viruses.

Quite frankly the scare tactics they have been using are disgusting, and the fact this thread exists at all shows that unfortunately they have not been entirely ineffective.

Horsepoo!!! · Oct 4, 2005, 10:27 PM

My Mac was once infected by something called Norton.

Apfhex · Oct 5, 2005, 02:33 AM

Haha, well put.

I ran ClamXav the other day, did a deep scan and it found some "virus" files in my Java cache. Seems that's the extent of it, at this point in time.

Jacob · Oct 5, 2005, 03:12 AM

*laughs*

alphasubzero949 · Oct 6, 2005, 01:54 AM

Sevendust, 1998, Mac OS 8.1.

It wasn't really a virus either; just a rogue extension.

SMacTech · Oct 6, 2005, 09:24 AM

Originally Posted by Dark Sailor

"Known" would be the key word there...

If there was one, even the hint of a real one, it would be well "known".

Salty · Oct 6, 2005, 01:02 PM

Wait now really you COULD try and install a virus and see if it ran in Classic

JMII · Oct 6, 2005, 01:45 PM

Originally Posted by Cadaver

If you experience odd behavior on your Mac, its NOT from a virus.

But it might have been hacked. We just found out that our xServer has been compromised, still investigating how this happend. No damaged done, but one of the user accounts was acting odd and after some sniffing around it seems someone was trying to install UNIX scripts on the box. These attempts were unsuccessful, but that fact they got in is bit upsetting.

I've only had to deal with ONE Mac virus in the 15 years...
The "Autostart" worm!
Read more at http://www.macintouch.com/hkvirus.html

The only damage was it kept coping itself over the network thus slowing things down to a crawl. The problem was every disk you mounted got the worm, so it took several weeks of scanning each Syquest removable (remember those?) before we killed all the copies. Even months later we would run into an old disc from a vendor that was still infected.

Cadaver · Oct 7, 2005, 11:43 PM

Originally Posted by JMII

But it might have been hacked. We just found out that our xServer has been compromised, still investigating how this happend. No damaged done, but one of the user accounts was acting odd and after some sniffing around it seems someone was trying to install UNIX scripts on the box. These attempts were unsuccessful, but that fact they got in is bit upsetting.

I used to run a very lightweight webserver from a PowerMac G4 (MacOS X 10.3.x client). While I saw in the log lots of SSH, FTP, odd URLs, etc., attempts at access, none were successful. Used to get port-scanned constantly since it was running a static IP address at a big-10 university. I suppose it was at some risk, since I needed ssh/remote access enabled for that machine for me to do other things on it from home - and someone could have potentially guessed/bruteforced my admin username & password, the odds of that were very slim (essentially random alphanumeric and non-alphanumeric characters for each). I'd be more apt to blame a user with a simple name/password than a flaw in OS X that would allow someone to install & execute shell scripts from the outside.

Cadaver · Oct 7, 2005, 11:46 PM

Originally Posted by Dark Sailor

"Known" would be the key word there...

And if you're the first person to acquire the first previously unknown actual MacOS X virus, then you've got other problems than simply the virus...