Malware Protection: Looking for Systematic Testing Reports *for the Mac*

[fessen]

I've been using iantivirus, but am now planning to switch to a different antimalware / antivirus program.

The trouble is that I can't find systematic anti-malware testing for the mac environment. I see many posters on various mac boards saying "I think xxxx is the best antivirus software" or "xxxx has a great reputation" without any data to back up their opinions.

There don't seem to be any reports for OS X users akin to the very sophisticated test reports generated by av-comparatives, av-test, and virusbulletin for Windows users.

The only thing I've been able to come up with is this blog post
http://kismaxx.blogspot.com/2010/11/antivirus-for-mac-scary-results.html

But I am always leery of accepting a single report because (1) the results could just have been due to chance and, even more of a worry, (2) the author may have had undisclosed conflicts of interest that undermine the testing and/or reporting.


So does anyone know of any other recent (past year or so) reports of comparative anti-malware / anti-virus tests for OSX users?

And if you don't know of comparative tests, can you at least point me to in-depth tests of single products?
Most of the single-product reviews I've seen seem very superficial ('the software installed easily,' 'the user interface was very clean').

 

[simsaladimbamba]

If you need protection for Mac OS X malware:

Mac Virus/Malware Info by GGJstudios
There are currently no viruses for Mac OS X in public circulation, only a handful of trojans and other malware, which have to be installed manually via entering the administrator password.
The only anti-virus you need to protect your Mac is education and common sense.​

 

[GGJstudios]

You already posted this in another thread. My response is the same:

iAntiVirus is one app that makes inaccurate claims about the existence of Mac malware, in order to hype the need for their product. I don't recommend it at all. This post will give details.

Bottom line: you don't need antivirus to protect your Mac from malware. Read the link that simsaladimbamba posted.

 

[thejadedmonkey]

You already posted this in another thread. My response is the same:

Bottom line: you don't need antivirus to protect your Mac from malware. Read the link that simsaladimbamba posted.

By that logic, you don't need antivirus to protect your Windows PC from malware either.

 

[munkery]

If you are really interested in comparatives, those for Windows AV software that also make products for Mac are typically the same. Non of them are %100; that is all you really need to know.

 

[simsaladimbamba]

By that logic, you don't need antivirus to protect your Windows PC from malware either.

To which logic are you referring to exactly?

 

[GGJstudios]

By that logic, you don't need antivirus to protect your Windows PC from malware either.

Antivirus is not needed to protect from trojans, as these can be avoided by the user exercising common sense in what they install. Viruses, on the other hand, can spread without the user's knowledge or permission, so antivirus provides protection that the user can't provide from behavior alone. There are viruses in the wild that can infect Windows, but there are no viruses in the wild that can infect Mac OS X.

 

[munkery]

By that logic, you don't need antivirus to protect your Windows PC from malware either.

Unless privilege escalation, such as used in Stuxnet, becomes more prevalent in Windows malware in the wild, AV software is really only needed if users have UAC disabled in Windows Vista/7 admin accounts or are using a Windows XP admin account for day to day computing given that systems setup in these ways allow trojan installation without authentication. User knowledge is always required even if AV software is installed.

 

[jessep28]

I'll run ClamXAV a couple times a year just for fun to check and see if my machine is harboring some kind of Windows threat. I think the only hit the program's ever registered was something embedded in an email located in a Spam folder.

 

[maflynn]

Antivirus is not needed to protect from trojans, as these can be avoided by the user exercising common sense in what they install. Viruses, on the other hand, can spread without the user's knowledge or permission, so antivirus provides protection that the user can't provide from behavior alone. There are viruses in the wild that can infect Windows, but there are no viruses in the wild that can infect Mac OS X.

the problem with trojans on windows is that they can behave more like a virus and install stuff without the consumer's knowledge, particularly in windows XP.

I think a robust antivirus application for windows that protects against all forms of malware is the safest approach. Ignoring the threat because you practice "safe computing" is akin to playing with fire. At some point you'll get burned.

I'm not advocating antivirus software for OSX yet but its clear with the increase in marketshare, the threats to OSX are increasing and it may be safer to install software that continually helps protects the computer instead of relying on someone to follow certain rules - we are after all imperfect beings. More if the computer is used/access by more then one individual.

 

[GFLPraxis]

By that logic, you don't need antivirus to protect your Windows PC from malware either.

"There are no viruses for Mac, only trojans, thus I don't need to protect my Windows PC from Windows viruses"?

Does not compute.

 

[GGJstudios]

I think a robust antivirus application for windows that protects against all forms of malware is the safest approach.

I agree. When did I ever suggest that you shouldn't run AV on Windows?

I'm not advocating antivirus software for OSX yet but its clear with the increase in marketshare, the threats to OSX are increasing and it may be safer to install software that continually helps protects the computer instead of relying on someone to follow certain rules - we are after all imperfect beings.

If someone wants to run antivirus on a Mac, that's fine, as long as they don't install one that elevates a Mac's vulnerability, like Sophos, and as long as they don't have a false sense of security my mistakenly thinking their antivirus app will protect them from future threats.

 

[maflynn]

I agree. When did I ever suggest that you shouldn't run AV on Windows?

This statement

Antivirus is not needed to protect from trojans, as these can be avoided by the user exercising common sense in what they install.

Leaving it up to a person or persons not to do something opens the door to attack, particularly on windows. With OSX, people are generally prompted for a password, even this is not fool proof when a users just blindly types their password. I think a lot of OSX users are so accustomed to typing in their password they do it without thinking.

 

[Just "Vinnie"]

There don't seem to be any reports for OS X users akin to the very sophisticated test reports generated by av-comparatives, av-test, and virusbulletin for Windows users.

What do you think this tells you?

 

[GGJstudios]

This statement

I was referring to OS X, not Windows.

 

[maflynn]

I was referring to OS X, not Windows.

You were responding to thejadedmonkey's post about window's antivirus so I thought you were talking about that.

 

[GGJstudios]

You were responding to thejadedmonkey's post about window's antivirus so I thought you were talking about that.

My point was that even if a Windows user chose not to use antivirus to protect against trojans, there are still Windows viruses in the wild that a user can't defend against without antivirus protection. In other words, all the current Mac OS X threats can be successfully avoided without the need for antivirus. The same is not true for all current Windows threats.

 

[fessen]

If someone wants to run antivirus on a Mac, that's fine, as long as they don't install one that elevates a Mac's vulnerability, like Sophos

How does Sophos elevate a mac's vulnerability?

 

[fessen]

While I sincerely appreciate the interest in this thread and the time that each has contributed in submitting a post in the hope of offering help, none of the responses has really addressed the question initially posed, save for that posted by munkery (post 5).

The question wasn't whether running antivirus / antimalware software in OS X is necessary or useful or advisable. It was

does anyone know of any other recent (past year or so) reports of comparative anti-malware / anti-virus tests for OSX users?

And if you don't know of comparative tests, can you at least point me to in-depth tests of single products?

 

[GGJstudios]

How does Sophos elevate a mac's vulnerability?

If you read the Mac Virus/Malware Info, you'll find a link to details about Sophos under "What about sending files to Windows users?".

 

[MisterMe]

While I sincerely appreciate the interest in this thread and the time that each has contributed in submitting a post in the hope of offering help, none of the responses has really addressed the question initially posed, save for that posted by munkery (post 5).

The question wasn't whether running antivirus / antimalware software in OS X is necessary or useful or advisable. It was

You are being obtuse. Whether this is deliberate or by accident, only you know. The only test of an antivirus program is whether or not it removes infections and leaves uninfected files alone. The best MacOS X antivirus utility will find zero MacOS X viruses, because there are zero MacOS X viruses, and zero false positives. In other words, the best Mac AV utility will find nothing at all. This is indistinguishable from a utility that does not work.

What about Windows viruses? Well, that's just it. The best MacOS X AV utility is not the one that can remove MacOS X viruses, but rather an AV utility that accurately and effectively identifies and removes Windows malware.

I have a confession to make. I have Norton AV on two of my Macs. I work in a Windows environment and a I don't want my Mac [falsely] identified as a source of viruses. Before hard drive space ran low, I had Fink installed on my system. The Fink installation included the Unix version of ClamAV. Norton identified ClamAV as a virus. Actually, it identified the virus definition files of ClamAV as viruses. These virus definition files were the only files on the system ever identified as viruses.

A word to the wise. Over the last week or so, there has a been a lot of talk about a couple trojans that bedevil Macs. What has been lost in the discussion is that the unfounded fear of viruses is the essential element of any success that either trojan may have. The user is supposed to Google search for the trojan, where a clickable link will be found. Clicking the link takes the browser to the site where a Windows-like warning appears and the trojan is downloaded. The user must be sufficiently fearful of viruses that he/she gives permission to install the trojan. The fear of viruses must then be so great that the user types in a credit card number to pay for virus protection.

U. S. President Franklin D. Roosevelt (1933-1945) said it best:

"The only thing we have to fear is fear itself."

 

[GGJstudios]

The user is supposed to Google search for the trojan, where a clickable link will be found. Clicking the link takes the browser to the site where a Windows-like warning appears and the trojan is downloaded.

I understand and agree with your point about fear-driven foolish decisions on the part of gullible users. There are a few corrections, though. The MacDefender "threat" is encountered during a Google search for images, not searching for the trojan. Also, the bogus site that appears has been updated to be a Mac-like warning. It no longer looks like Windows.

 

[MisterMe]

I understand and agree with your point about fear-driven foolish decisions on the part of gullible users. There are a few corrections, though. The MacDefender "threat" is encountered during a Google search for images, not searching for the trojan. Also, the bogus site that appears has been updated to be a Mac-like warning. It no longer looks like Windows.

It is important that we provide information that is as accurate as possible. I admire your Herculean efforts in this regard. Thank you for the correction and update.

 

[bearcatrp]

I ran this for awhile. Pretty good.
http://www.intego.com/

But as said earlier, no virus at this time. Some trojans. But better to do this:
1. Make another account. Make it a admin user.
2. Change your current to regular user.
3. Change all your setting to request permission before doing anything. It's sometimes a pain but nothing will get in unless you ok it. At least you will know IF something tries to get in.

If you share files with windows users, you can pass a virus on. Won't affect your Mac though. I wouldn't waste the money personally unless I was told I passed one one. Only happened once, about 5 years ago. Never since.