Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Ja Di ksw

macrumors 65816
Original poster
Apr 9, 2003
1,313
8
Hi everyone. So, awhile ago after my computer crashed pretty hard and I fixed it, I ran a verify/repair disk permissions. The list was HUGE (I cannot overstate that enough), but I figured it was because something was messed up from the crash and I didn't worry. Later, I ran it again and the list was giant again. I looked more closely, and it said the ARDAgent had been modified and could not be repaired. Now when I run it the list is no longer huge, but it still gives this warning:

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.

So, I did a quick google and found a Macworld article (http://www.macworld.com/article/134165/2008/06/ardagent.html) saying the ARDAgent is a big security hole. Should I be worried about this, and if so, what can be done about it?

Thanks for the help :)
 

spinnerlys

Guest
Sep 7, 2008
14,328
7
forlod bygningen
It's not a virus, it is a security hole.

They are not the same.

A computer virus is a computer program that can copy itself and infect a computer. The term "virus" is also commonly but erroneously used to refer to other types of malware, adware, and spyware programs that do not have the reproductive ability.

From Symantec:

What is the difference between viruses, worms, and Trojans?

What is a virus?
A computer virus is a small program written to alter the way a computer operates, without the permission or knowledge of the user. A virus must meet two criteria:
It must execute itself. It often places its own code in the path of execution of another program.
It must replicate itself. For example, it may replace other executable files with a copy of the virus infected file. Viruses can infect desktop computers and network servers alike.

What is a Trojan horse?
Trojan horses are impostors—files that claim to be something desirable but, in fact, are malicious. A very important distinction between Trojan horse programs and true viruses is that they do not replicate themselves. Trojan horses contain malicious code that when triggered cause loss, or even theft, of data. For a Trojan horse to spread, you must invite these programs onto your computers; for example, by opening an email attachment or downloading and running a file from the Internet.

What is a worm?
Worms are programs that replicate themselves from system to system without the use of a host file. This is in contrast to viruses, which requires the spreading of an infected host file. Although worms generally exist inside of other files, often Word or Excel documents, there is a difference between how worms and viruses use the host file. Usually the worm will release a document that already has the "worm" macro inside the document. The entire document will travel from computer to computer, so the entire document should be considered the worm.

What is a virus hoax?
Virus hoaxes are messages, almost always sent by email, that amount to little more than chain letters. Following are some of the common phrases that are used in these hoaxes:
If you receive an email titled [email virus hoax name here], do not open it!
Delete it immediately!
It contains the [hoax name] virus.
It will delete everything on your hard drive and [extreme and improbable danger specified here].
This virus was announced today by [reputable organization name here].
Forward this warning to everyone you know!
Most virus hoax warnings do not deviate far from this pattern. If you are unsure if a virus warning is legitimate or a hoax, additional information is available at the Symantec Security Response online database.

As of this time, there are NO viruses in the wild that affect current Mac OS X. In the past, there have been a few viruses that ran on older versions of the Mac operating system, but no longer.

There are, as of this time, trojans that can affect Mac OS X, but these must be downloaded and installed by the user, which involves entering the user's administrator password. Trojans can easily be avoided by the user exercising common sense and caution when installing applications. A common source of trojans is pirated software, typically downloaded from bit torrent sites.

Having virus protection software on your Mac is pointless, as far as protecting your Mac from viruses, since AV software can't detect a virus that doesn't exist. It is possible to have a file reside on your hard drive that contains a Windows virus, but since a Windows virus (program) can't run in native Mac OS X, it would be harmless to your Mac. Some choose to run AV on their Mac to scan for Windows viruses, so the Mac user can't pass a virus-infected file to a Windows user. In my opinion, a Windows user should be protected by their own AV software, so the burden of protection lies with the Windows user.

from https://forums.macrumors.com/posts/9701135/
 

Ja Di ksw

macrumors 65816
Original poster
Apr 9, 2003
1,313
8
It's not a virus, it is a security hole.

They are not the same.



from https://forums.macrumors.com/posts/9701135/

Ok, so it's not a virus, but the point isn't whether it's a virus or a trojan or a security hole or whatever. The point is, should I be worried about my computer being at risk b/c of this warning that it has been modified and is unrepairable, and what can I do about it?
 

spinnerlys

Guest
Sep 7, 2008
14,328
7
forlod bygningen
Ok, so it's not a virus, but the point isn't whether it's a virus or a trojan or a security hole or whatever. The point is, should I be worried about my computer being at risk b/c of this warning that it has been modified and is unrepairable, and what can I do about it?

I understand, but your thread title implied otherwise.

I can't answer your actual question with absolute certainty though, but if your are running Mac OS X on a secure network with a firewall, you should be safe. Or do you think you should be the target of an attack?
 

stridemat

Moderator
Staff member
Apr 2, 2008
11,364
863
UK
OP have you tried repairing permissions when booting off the OS X disk? Is this what you are doing now?
 

Ja Di ksw

macrumors 65816
Original poster
Apr 9, 2003
1,313
8
I don't think there's any reason I should be targeted over other people, was just worried after a crash, then the permissions being changed (and unable to change back) on something that allowed for remote management. The article giving a warning finally made me worry enough to ask.
 

Ja Di ksw

macrumors 65816
Original poster
Apr 9, 2003
1,313
8
OP have you tried repairing permissions when booting off the OS X disk? Is this what you are doing now?

Before I was doing it from my computer. I just tried it booting from the OS X disk, and it had an unbelievable amount of user or group differences. It kept saying the user should be 0, but was 502 (or the group should be 0, but was 20). I repaired them all, rebooted from my hard drive, and it still says there's a problem with the ARDAgent :(, even though the ARDAgent was the first one that had the incorrect user. Sigh.
 

robert05au

macrumors regular
May 19, 2005
246
7
Dubbo, NSW
Before I was doing it from my computer. I just tried it booting from the OS X disk, and it had an unbelievable amount of user or group differences. It kept saying the user should be 0, but was 502 (or the group should be 0, but was 20). I repaired them all, rebooted from my hard drive, and it still says there's a problem with the ARDAgent :(, even though the ARDAgent was the first one that had the incorrect user. Sigh.

There is nothing to be concerned about with the message as apple has said we can ignore these type of messages.

http://support.apple.com/kb/ts1448

It has a fair amount of others which apple say we can safely ignore.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.