Help in understanding if my Mac has a virus/malware?

Hello,


I have some PDFs on my Mac I was scanning through VirusTotal and Hybrid Analysis and overall most of them seem okay, but a few in particular really concerned me.


These three specifically.


I am wondering if someone can tell me what the current risk is here, virus total seems to indicate some risk for these but only in the behavior section and then hybrid analysis indicates they are clean.


Additionally, is this even an issue given it is a Mac computer?


Here are the three scans:


https://www.virustotal.com/gui/file/d61e492541652b59d5bef94eb47468086325ac46cf3debcd82fc1578b9396b73/details


https://hybrid-analysis.com/sample/d61e492541652b59d5bef94eb47468086325ac46cf3debcd82fc1578b9396b73



AND


https://www.virustotal.com/gui/file/480a47618fdc64d73da36dabe0b39e5442ea75ef7ab245e6d0c7071cf0834a55/details


https://hybrid-analysis.com/sample/480a47618fdc64d73da36dabe0b39e5442ea75ef7ab245e6d0c7071cf0834a55


AND


https://www.virustotal.com/gui/file/3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031/behavior


https://hybrid-analysis.com/sample/3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031



MacBook Pro (2017 – 2020)

Posted on Oct 28, 2023 12:11 AM

Reply
Question marked as Top-ranking reply

Posted on Oct 28, 2023 2:00 PM

Of the three you posted, the results are 100% clean. So why are you even concerned about them?


As already noted, you're completely wasting your time and system resources with useless AV software. Delete them and never look back. The suggested MalwareBytes for Mac is about the only useful such software on a Mac as its main purpose is to look for malware you may have already installed and then remove, not prevent it.


Yes, a virus is malware. So is a Trojan or worm. The word malware is a generic, catch-all phrase that stands for malicious software.


There are no viruses on the Mac. Zero, nada, zip. Worms are almost non-existent. The last reported, known worm was from over a decade ago.


There are lots of Trojans, which is any malware the user needs to install in some manner. It can't get on your Mac by itself. These include key loggers, back doors, adware, ransomware, etc.

11 replies
Question marked as Top-ranking reply

Oct 28, 2023 2:00 PM in response to DELL_GONEE

Of the three you posted, the results are 100% clean. So why are you even concerned about them?


As already noted, you're completely wasting your time and system resources with useless AV software. Delete them and never look back. The suggested MalwareBytes for Mac is about the only useful such software on a Mac as its main purpose is to look for malware you may have already installed and then remove, not prevent it.


Yes, a virus is malware. So is a Trojan or worm. The word malware is a generic, catch-all phrase that stands for malicious software.


There are no viruses on the Mac. Zero, nada, zip. Worms are almost non-existent. The last reported, known worm was from over a decade ago.


There are lots of Trojans, which is any malware the user needs to install in some manner. It can't get on your Mac by itself. These include key loggers, back doors, adware, ransomware, etc.

Oct 29, 2023 7:33 AM in response to DELL_GONEE

You're worrying far too much about next to nothing. Yes, there were PDF and JPG exploits, but those were years ago and have been patched against. And places like VirusTotal go very much out of their way to find something, anything, that might be suspicious. It's how they keep people coming back. Fear.


Literally, any third party file you open, whether it's an app or data, has the possibility of including malware. All a perp has to do is add code to the file that isn't supposed to be there. The OS (doesn't matter if it's Windows, Linux, macOS, etc.) has to read the file from start to finish. In the process of doing so, it also reads and executes the attached malware.


But!, you can drive yourself crazy trying to find that 1 in a million files that may be infected. And you almost have to intentionally try to get one.


How do you avoid a Trojan? It's actually very, very simple:


Get your third party apps from reliable sources only. That means only from the original vendor. Never - and I do mean NEVER - from a P2P, file sharing or pirate site.


Beyond that, read this excellent treatise by fellow user, John Galt:


https://discussions.apple.com/docs/DOC-8841


And just to give you an idea of how little I worry about such things, I haven't used any type of AV software since the release of Windows 95. And then I only had it for the year of updates it got, realized I was wasting computer resources looking for nothing, and removed it.

Oct 28, 2023 7:20 AM in response to DELL_GONEE

It's all bogus and you need to get rid of all the AV scanners and any "helper" type apps you have installed and disregard the websites. That just want you to ultimately buy a product. None of them are of any use and locally installed apps often disrupt system operations.


There are no Mac viruses in the wild and if you have malware, what you need to do is scan for it specifically


Download and install MalwareBytes (the free version is all that's needed) then run the scanner to remove any malware that may be present.


https://www.malwarebytes.com/

Oct 28, 2023 7:45 AM in response to DELL_GONEE

Nothing to worry about there. The Mac OS is sealed in a read only partition that prevents any viruses from changing its system files. Virus Scanners for a Mac are only there to scare you into giving them money to solve a problem you do not have. You should not use any Virus Scanners or apps that claim to speed up your Mac.


As noted above MalwareBytes is the only app that has been shown to be helpful with Malware. Even with this app, you would only want to do the free scan and there is no need for constant monitoring. Malware is different from Viruses and will not infect files on your computer. Malware usually gets installed through a web pop up that claims to do one thing, but does something else. The most common pop ups are from virus scanners or a fake "Update Flash Player" pop up. The symptoms of Malware are notifications or popups that claim you have a problem and want you to spend money to fix it. Another type will redirect your web searches to another site to display more ads. These are not viruses and will not be detected by virus scanners. Malware is easily removed and is always inadvertently installed by you and does not spread. You will know when you have Malware, because its only motivation is money and it will make its presence known by a constant barrage of notifications or ads to generate money for them.

Oct 28, 2023 1:06 PM in response to stumpy1946

So I downloaded what you recommended but it does not allow for individual file scanning. Is there a way to scan a specific file, virus total and hybrid analysis are both considered to be pretty legitimate sites for scanning things before they are downloaded and so I would like to be able to get some kind of confirmation. I move files between different computer environments, I wouldn't want to move this file/send it to someone else and then find out it is infected. Is there any way to get this figured out?

Oct 28, 2023 1:32 PM in response to Mac Jim ID

So I downloaded what you recommended but it does not allow for individual file scanning. Is there a way to scan a specific file, virus total and hybrid analysis are both considered to be pretty legitimate sites for scanning things before they are downloaded and so I would like to be able to get some kind of confirmation. I move files between different computer environments, I wouldn't want to move this file/send it to someone else and then find out it is infected. Is there any way to get this figured out?

Oct 28, 2023 3:37 PM in response to Kurt Lang

Of the three I posted there were some flags in the “behavior” section on virus total. They were clean otherwise, but the virus total scan found some risks. One actually was some sort of similarity to a Trojan or something.


and as for the AV software, they aren’t downloaded. They are just websites you go to and upload a file to. They aren’t taking any space or anything and are actually usually pretty helpful for me.


I think the thing I’m worried about is exactly what you mentioned, that I have a Trojan of some kind. You mentioned they require the user to install. Would that be simply the act of me downloading the concerning PDF I’m mentioning? Or do you mean install something separately from a pdf? As in like a driver something not just downloading a PDF?


also, if I did have a Trojan that I installed (I certainly could have done something like that accidentally) how would I be able to see that I did this? I looked in terms of what has access to my full disk drive and nothing was too concerning that I could tell. I didn’t have xprotect updating automatically for some reason but did switch that back on and gave it access as well as downloaded malewarebytes.


I guess I’m just worried that the virus total scan of the PDF that says a possible Trojan was in the “behavior” section could be messing up my Mac and I don’t really know is if it is and if so how to tell?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Help in understanding if my Mac has a virus/malware?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.