is apple security center safe?

babowa wrote:

As far as I know, the only problem at the moment is the current threat of trojans; that is not a virus, so no AV software will protect you.{…} So, if nothing is installed, then how will AV software help?

I know from firsthand experience that Sophos detects & warns you about the current variants of the MacDefender/Protector/Apple Security Center malware if & when it is downloaded, before you install it. From what I understand from others that use them, so does ClamXav & Intego VirusBarrier X6.

That doesn't make these products a substitute for common sense & care, but they do add another layer of protection that some users find useful.

R C-R wrote:

That applies no less to my personal recommendation, which is Sophos Home Edition for Macs. I like it because it is totally free, based on industrial grade commercial products, well maintained, & has detected every variant of this malware I can find well before ClamXav has.

Actually, Mark Allan and the clamav.net signature team (with help from this forum) beat both Sophos and MacScan to at least one version which was documented on the VirusTotal site, but in general you are correct. It is difficult for a volunteer force that have "real jobs" to compete with commercial vendors who have 24/7 AV crisis centers working these things.

Can I assume that you have read the warning at the VirusTotal site that it was not designed as a tool to perform AV comparative analyses, & why it is a bad idea to try to use it for that purpose?

Got this on Chrome the IP is http://178.xx.xxx.165/ < Edited by Host >

It seems to have popped up after failing to connect to www.hydrogentoday.us. I'm not sure it is related as I've been out for hours and returned to my Mac and see this in my tabs. I'll read the thread but what's up with this?

iMac 10.6.7

Chrome 12.0.742.60 beta

That's exactly what you do NOT want. That is what it looks like. It wants you to download or is downloading something in the background. It wants you to install and give them your credit card number.

Don't do anything. Get rid of the window. Check your download folder (if it's there, delete and empty trash), don't install anything and read this thread and the yellow sticky article from Apple at the top of the iMac and SL forums.

Thanks babowa! I closed the window, checked my downloads; nothing there. I also deleted an extension in Chrome I installed yesterday as I suspect it could have harbored the latent tab opening command. I forgot the name of it but will post if it comes back to me.

You should be fine then - I was the lucky recipient a couple of days ago......

I have no idea if this is the source but the timeline in my history show that the Drudge Report having been left open and refreshes automatically was left open on my desktop while I when to visit my father in law at the VA.

Check the timeline and what opened....

Is it logical that this is related?

The file downloaded is named "anti-malware.zip" and is a Trojan named Trojan-Downloader.OSX.Fav.A

DO NOT OPEN anti-malware.zip!

Scanned and identified by ClamXav

RandypTulsa wrote:

The file downloaded is named "anti-malware.zip" and is a Trojan named Trojan-Downloader.OSX.Fav.A

DO NOT OPEN anti-malware.zip!

Scanned and identified by ClamXav

That is correct, it is the compressed version of a small installer package that will probably install a small application called avRunner in your Applications folder and automatically launch it. That, in turn, will download an application called MacGuard in your Applications folder, launch it and delete the previously downloaded/installed files. The fact that you still have it is good evidence that things went no further than that, but you might want to double-check if you haven't already.

These people (IP address 178.xx) are infiltritating many websites - I got it by going to my open Yahoo Inbox tab (obviously, for now, I am logging in and out instead!).

Why would logging in and out make a difference? It sounded like for some people, just going to a website got the thing started. Why is it not safe once you have logged in safely the first time? I must be missing something obvious. Thank you,

laverne's mom

Actually, I have no idea - it just seemed to make sense that if I got it while I was logged in (safely I thought), it would be better not to have a tab open because that appears to be how they're getting there. Look at Randyp's post - he wasn't home but had tabs open and it took over a tab while he was gone and not actively doing anything. Of course, I may be wrong, but it makes me feel as though I'm being pro-active instituting preventive measures.

that's true. I hadn't thought about that but my email tabs do refresh themselves when I'm not on them. what a pain! Just another one of things we have to learn to put up with, I guess. I'm going to probably have to start making some of the changes that I was putting off - switching to a standard account and other advice I have read much about. Since I am the only one who uses the mac, if anything goes wrong I am the only one I can blame!

thank you,

laverne's mom

🙂

interesting. I just checked and gmail is a secure site (https). do you think that makes a difference. the comcast email site isn't. just wondering what you thought about that.

Message was edited by: laverne's mom

interesting. I just checked and gmail is a secure site (https). do you think that makes a difference. the comcast email site isn't. just wondering what you thought about that.

I'm sure you could get a really good technical explanation to this question; my gut instinct (which has saved my bacon untold times throughout my life!!) is telling me to be extra cautious and don't trust anything at the moment. If they haven't found a way to infiltrate an https site, they probably will. As for Comcast, I have them but I try to avoid their website (email or anything else) at all costs - don't need them, takes too many clicks to check mail, and I have to endure ads (I am allergic to ads 😝 ).