Antivrus /malware in Snow Leopard?

Discussion in 'OS X' started by Asgerhj, Aug 20, 2009.

  1. macrumors newbie

    Joined:
    Aug 20, 2009
    #1
    Hi

    Yesterday I googled for reviews of the new Playstation 3 Slim and came across a site, which looked like having a video-review.
    But clicking on the player a “QuickTimeUpdate.dmg” started downloading and mounted automatically.
    Suddenly the following warning appeared:

    “install.pkg” will damage your computer. You should move it to the Trash.

    “install.pkg” is on the disk image “QuickTimeUpdate.dmg”. Safari downloaded this disk image today at 23.25 from redrocktube.com. It contains the “OSX.RSPlug.A” malware.

    I booted into Leo and tried the same procedure and got NO warning.
    Scanning the .dmg with ClamXav I got a warning.


    So what I am basically trying to say is:

    1: I wasn't aware that SL has built in some kind of Antivirus/malware. Were you?

    2: Take care - don't feel too secure running a Mac (I still hear lots of people telling lots of other people that there is no reason to fear malware on the Mac platform......)
    Others say that the only way to get infected on a Mac is if you install the malware yourself (hence you are stupid) - but that is the whole point in trojans: You think that you are installing something useful, but...

    For my part, I was sceptical about the download, because QT updates doesn't work that way, but had it been named e.g. "videocodec.dmg" I am not sure that I wouldn't have installed it....
    Hopefully ClamXav would have caught it!
     
  2. Moderator emeritus

    r.j.s

    Joined:
    Mar 7, 2007
    Location:
    Missouri
    #2
    Turn off "Open Safe files after downloading ..." in Safari, and it won't be a problem.
     
  3. macrumors 6502a

    Joined:
    Nov 14, 2007
    #3
    Interesting.

    Would be nice if SL had this added protection. Was it a system warning or Safari? Are you running the same version on Leopard (4.0.3?)
     
  4. thread starter macrumors newbie

    Joined:
    Aug 20, 2009
    #4
    Yeah, it would be a problem if I didn't suspect that the .pkg could harm me!
     
  5. Moderator emeritus

    r.j.s

    Joined:
    Mar 7, 2007
    Location:
    Missouri
    #5
    Actually, thinking about it ... I think Leopard does the same thing. Whenever you download an app, it will ask you if you are sure you want to run it, because it was downloaded from the internet and may harm your computer.

    In Leopard:
    Picture 1.png
     
  6. thread starter macrumors newbie

    Joined:
    Aug 20, 2009
    #6
     
  7. Moderator emeritus

    r.j.s

    Joined:
    Mar 7, 2007
    Location:
    Missouri
    #7
    Can anyone else running SL confirm this?
     
  8. macrumors 6502a

    Joined:
    Nov 14, 2007
    #8
    Perhaps it scans the 'downloaded from' location and compared it to a blacklist, either as part of the system or an online database. Would be a nicer alternative to a traditional daemon that scans all file activity - yeuch!
     
  9. thread starter macrumors newbie

    Joined:
    Aug 20, 2009
    #9
    Well, the warning I got is different from the Leo-warning you mention:
    1. You were launching an app - I wasn't
    2. "My" warning also points out the exact malware (later confirmed by ClamXav)


    I could post the link so you could try for yourself, but I don't want to because of the risk...
    But read my 1.st post, and do a bit of googling then you can find it.
    :mad: BUT BEWARE!!!! This is a LIVE TROJAN :mad:
     
  10. Moderator emeritus

    r.j.s

    Joined:
    Mar 7, 2007
    Location:
    Missouri
    #10
    At first you didn't say you didn't run the package ... once you did add that part, I saw the difference.
     
  11. macrumors 65816

    uaecasher

    Joined:
    Jan 29, 2009
    Location:
    Stillwater, OK
    #11
    yes it has the same thing, will post screen shot soon
     
  12. macrumors 68000

    Joined:
    Sep 22, 2006
    #12
    You have to wonder what possesses apple to think forcefully downloading files whether you want them or not is a good feature for Safari, and then opening them by default...(PDF's and certain image formats are NOT "safe" files, same with quicktime) Its like theyre stuck in 1995 where people think the internet is safe and all downloads are useful. Not only is it extremely annoying, its just outright stupid.
     
  13. macrumors G4

    Joined:
    Jul 17, 2002
    Location:
    USA
    #13
    I'm having a really difficult time trying to figure out what you are getting at. Everyone with the sense God gave red brick knows that MacOS X system software comes exclusively from Apple and no one else. QuickTime is MacOS X system software. It is available nowhere except Apple. New releases are available exclusively through Apple's website. Updates are available via Software Update or via download from Apple's website. Unless you are dumber than a bag of hammers, there is no way to fool anyone into downloading malware that pretends to be QuickTime.
     
  14. macrumors G5

    jav6454

    Joined:
    Nov 14, 2007
    Location:
    1 Geostationary Tower Plaza
    #14
    This is really In-te-resting..... to say the least. Snow Leopard is actually scanning your files before mounting, just in case.
     
  15. macrumors newbie

    Joined:
    Aug 17, 2006
    #15
    I think maybe you should re-read the original post, you seem to have misunderstood and entirely missed the point.
     
  16. macrumors newbie

    Joined:
    Aug 25, 2009
    #16
    Please provide the link to the page where the virus-ridden package is.

    I promise to use these powers only for good -- or for awesome.
     
  17. macrumors 603

    richard.mac

    Joined:
    Feb 2, 2007
    Location:
    51.50024, -0.12662
    #17
    here is a link i found to test the anti malware protection in Snow Leopard (ive left it unlinkable on purpose to protect unsuspecting downloads)

    fishwildlife.org/lurd.php?sodini+blog WARNING: This URL contains malware and if installed will infect your Mac.

    when the disk image is mounted (may mount automatically when downloaded if you have this set in Safari) and the installer package is opened this message appears
    [​IMG]
    here is the help document that opens once you click the purple help button

     
  18. macrumors 6502

    ceezy3000

    Joined:
    Jan 10, 2009
    Location:
    The Valley!!
    #18
    dam thats a nifty feature
     

Share This Page