MacKeeper 2.1.2 finds malware ClamXav, VirusBarrier Express didn't

Question

Level 1

31 points

MacKeeper 2.1.2 finds malware ClamXav, VirusBarrier Express didn't

I am running Mac OS 10.7.3 on a MBP 13" with i7 processor.

Can anyone tell me why the creators of ClamXav and VirusBarrier Express would not want to do an initial scan of the folders that contain email attachments?

Two days ago I ran the free ClamXav antivirus program I downloaded through the Apple's Mac App Store and it found between 400 and 500 threats. I did not see the flashback trojan and I assumed the other threats were Windows viruses. I deleted all the threats it found. The interface for this free app was not really user friendly. I assumed that I was scanning my whole drive when I started the scan, but it did not scan all my files. I believe it scanned less than half, but can't be sure.

Since I was looking for a more user-friendly interface for family members, I decided to try VirusBarrier Express. Also free from the Mac App Store. It was slow and scanned between 400,000 and 500,000 files on my internal drive which Disk Utility says has 1,052,289 files on it. I assumed I was going to scan the who drive because I clicked on the "Full Scan" button. It found no threats, which did not surprise me because I had previously run ClamXav and chose to remove all the threats it found.

I downloaded a trial version of MacKeeper since my Mac was running slow, has too many files, and I wanted to try to speed it up by paring down the number of files. It has as part of its suite of applications, Internet Security. After running the other two free apps (ClamXav and VirusBarrier Express) I decided to try the antivirus part of this $38 app that I was trying out for free. What the heck, I thought. It ran fast and scanned approx. 935,000 of my 1,052,289 files by simply clicking on the "Start antivirus scan" button. It found 91 threats. All were in my ~/Library/Mail/V2/IMAP... folder. I checked and found that these emails arrived before I did the other two scans with ClamXav and VirusBarrier Express, so those programs should have found these threats. They did not.

Perhaps ClamXav and VirusBarrier Express would have found those 91 threats if they had been configured correctly by me. I don't know. But the point is that I thought I was going to scan everything that needed to be scanned by clicking on the buttons that these applications' creators seemed to expect my to click. With Internet Security in the MacKeeper application, I clicked on the obvious button "Start antivirus scan" and it found 91 threats the others did not find.

I did not check all 91 of these threats that MacKeeper found, but the ones I did check out in the Mail application obviously contained malware. They were poorly disguised attempts to get people to open attachments.

Full disclosure: I do not work for any entity associated with ClamXav or VirusBarrier Express or MacKeeper. I am a pastor. I used to work for an Apple Store years ago.

Message was edited by: Roger Lier1

MacBook Pro, Mac OS X (10.7.3), MBP 13" i7 Early 2011

Posted on Apr 13, 2012 8:39 AM

Reply

Answer 1

Apr 13, 2012 8:42 AM in response to Roger Lier1

See below.

https://discussions.apple.com/docs/DOC-3036

Stedman

Reply

Answer 2

Roger Lier1 Author

Level 1

31 points

Apr 13, 2012 9:18 AM in response to stedman1

Hi Stedman,

You did not answer my question nor did the discussion you referenced:

stedman1 wrote:

See below.

https://discussions.apple.com/docs/DOC-3036

Stedman

That discussion contains statement that may mislead some. "There are no viruses that can affect Apple OS X and there is therefore no reason to run anti-virus software on a Mac, but a Mac, like all computers, can transmit viruses and malware to other users particularly those running Windows"

For those who are technically educated, they know that there is a difference between viruses and trojans. Both are malware. While there are not yet viruses that can hurt Macs in the wild, there is malware that is infecting a great number of machines. I spoke to an Apple Store employee whose Mac went into a loop with the screen flashing. He could not get out of the loop because he got infected with a trojan.

As for MacKeeper, I detest their marketing. I am not thrilled with some parts of MacKeeper. And I have not yet tried to uninstall it. I did do some research before installing it. And I found differing opinions about the value of the product. Klaus1 may be right that if one searched long enough, one could find free apps that did what MacKeeper does. I searched for free apps that would help me pair down my bloated hard drive (I have been using Macs since 1984 and created a lot of files) and I could not find any that were satisfying. I did not find any differing opinions about the marketing used to sell MacKeeper. It seems everyone agrees it stinks.

My question remains: Can anyone tell me why ClamXav and VirusBarrier Express, both free and highly rated in the Mac App store, did not find the 91 threats MacKeeper found? As I said before, those threats were on my drive before I scanned with ClamXav and VirusBarrier Express.

I will post an update here if I uninstall MacKeeper. So far my system seems to be working fine. The problem I was having with my USB ports appeared before I installed MacKeeper. And right now both USB ports are working.

Message was edited by: Roger Lier1

Reply

Answer 3

Kurt Lang

Level 9

57,792 points

Apr 13, 2012 9:19 AM in response to Roger Lier1

What supposed "threats" did it find? Cookies?

Reply

Answer 4

CT

Level 7

23,981 points

Apr 13, 2012 9:20 AM in response to Roger Lier1

Presumably the "91 threats" are in fact all MacKeeper malware threats.

Nice of them to be up front about it, at least.

Reply

Answer 5

Kurt Lang

Level 9

57,792 points

Apr 13, 2012 9:25 AM in response to CT

Oh! Just noticed they were all in the mailbox. So MacKeeper thinks it found 91 (likely attachments) that it thinks were threats. So what were they? All Windows malware that came in as attachments? Benign .jpg images it flagged as threats?

Reply

Answer 6

John Galt

Level 10

140,906 points

Apr 13, 2012 9:43 AM in response to Roger Lier1

MacKeeper, like nearly all similar magic potions, might work just fine right up to the point it trashes your system.

Don't be surprised if the Flashback trojan was created by the same company, its partners, or associates.

If the cure isn't selling, spread the disease - an idea as old as civilisation itself.

Reply

Answer 7

Roger Lier1 Author

Level 1

31 points

Apr 13, 2012 9:48 AM in response to Kurt Lang

Hi Kurt,

I deleted all the "threats" MacKeeper found, but I kept a screen shot of some of them. I assume they were all Windows malware. A couple contained TR/Crypt.XPACK.Gen3. A number of the "threat" files contained a description that contained the word WORM, but I did not get a screen shot of those, so I can't reproduce them.

I realize that these things almost certainly all Windows malware with a low threat to Windows users and no threat to Mac users. My question is why would the much maligned MacKeeper find them and not ClamXav or VirusBarrier Express. ClamXav did find over 400 suspect files, but not these. I don't understand why it would only search half the files that MacKeeper searched.

I guess you don't know the answer to that either.

Roger

Reply

Answer 8

Kurt Lang

Level 9

57,792 points

Apr 13, 2012 10:12 AM in response to Roger Lier1

The one you do mention is indeed a Windows Trojan. It must also be a very recent threat. You can find quite a few new pages in Google on it, asking how to remove. But neither Symantec, Panda AV or Kaspersky even recognize it in a search. So I guess you have to give credit to MacKeeper to recognizing malware the others don't even seem to have heard of yet.

Which, for at least TR/Crypt.XPACK.Gen3, would explain why ClamXAV didn't see it, either. All in all, I still wouldn't touch MacKeeper with a mile long pole. And if I did, I'd have to burn the pole.

Reply

Answer 9

etresoft

Level 8

46,062 points

Apr 13, 2012 10:24 AM in response to Roger Lier1

All of these "threats" are just Windows malware, as you suspect. I don't use any antivirus myself. I haven't seen any need for it in 12 years and I'm not going to let some fearmongering change my mind now. Once people start repeating a story, other people start believing in it without checking for themselves.

The same thing seems to have occured with MacKeeper. It has a very bad reputation here in Apple Support Communities. This morning someone even claimed it is blocking a well-known anti-MacKeeper site. That sparked my curiosity so I installed MacKeeper to see for myself. Not only was MacKeeper not blocking that website, it was very easy to uninstall. The anti-MacKeeper web site that was supposedly being blocked, was actually more malicious and fearmongering than MacKeeper itself.

I still don't recommend MacKeeper or any antivirus software. The Mac isn't windows. The security architecture is different. The kinds of threats that Windows users have to worry about simply don't exist on the Mac and they can't exist. The Flashback trojan clearly demonstrated that because it could not infect any system files without asking for a password, which a few people unfortunately provided.

There is no easy answer. If you truly believe the fearmongering, then the only truly 100% safe answer is to install all three anti-virus products. After all, if one can't catch all the threats, then you must install them all. Don't forget Norton. You didn't try it. It also has a very bad reputation here in Apple Support Communities. Maybe it is worth investigating. Confused yet?

Perhaps the Mac malware will get so bad one day that Apple has to display big red warning notices like Microsoft does if you aren't running antivirus. Until that happens, I'm not going to worry about it.

Reply

Answer 10

ds store

Level 7

30,705 points

Apr 13, 2012 10:30 AM in response to Roger Lier1

Roger Lier1 wrote:

Can anyone tell me why ClamXav and VirusBarrier Express, both free and highly rated in the Mac App store, did not find the 91 threats MacKeeper found?

We hear this same load of baloney on Windows between anti-virus companies, "we found this and they didn't find that"

The fact is nobody finds everything all the time, next week ClamXav will find something and the others won't.

The fact remains, WE DON'T LIKE MACKEEPER, we don't like or trust the source, we don't like the MacKeeper lies they say about themselves to promote their products to unsuspecting users,

We do like and trust the source of ClamXav, and we will do everything in our power to astroturf MacKeeper until it's gone.

If your happy with MacKrapper, fine, but they have blown it in the minds of seasoned users who see right through their shady tactics and worthless offerings.

The best thing Zeobit (what the heck is that?) can do is wrap the whole show up, learn from their mistakes and go pander to Windows users who do need crapware to keep their machines running.

Mac's don't need MacKeeper. MacKeeper didn't stop MacDefender or Flashback.

Mac's don't even need ClamXav, because there are no viruses for Mac's, we just run that to clean Windows files. 😁

What likely happended is YOU didn't operate the program correctly, I have ClamXav scanning my whole drive no problem.

If you have a advisement to make ClamXav work better, send them a polite email.

But don't come here dragging their good name into the dirt with johnny come later MacKeeper.

Reply

Answer 11

MadMacs0

Level 5

5,221 points

Apr 13, 2012 11:31 AM in response to Roger Lier1

Roger Lier1 wrote:

I am running Mac OS 10.7.3 on a MBP 13" with i7 processor.

Can anyone tell me why the creators of ClamXav and VirusBarrier Express would not want to do an initial scan of the folders that contain email attachments?

Two days ago I ran the free ClamXav antivirus program I downloaded through the Apple's Mac App Store and it found between 400 and 500 threats. I did not see the flashback trojan and I assumed the other threats were Windows viruses. I deleted all the threats it found. The interface for this free app was not really user friendly. I assumed that I was scanning my whole drive when I started the scan, but it did not scan all my files. I believe it scanned less than half, but can't be sure.

The developer of ClamXav has purposely configured his application to do nothing without user approval, so many of the preferences default to being off. That includes checking e-mail content (as opposed to attachments) for malware and phishing. That's partly because there is no known malware that impacts OS X in e-mail content (although there could be in the future) and also because using ClamXav to delete or quarantine an e-mail file will corrupt the mailbox index which could cause other problems.

Another important thing to note is that ClamXav is an individual user application and will not violate other users privacy by scanning files they own. The developer is sensitive to privacy issues and this has been a long standing policy, so ClamXav will only scan files the current user has read access to. I believe that may explain why at least some of those files were skipped. There are other limitations as to file size and type that are imposed by the folks that provide the clamav scanning engine (used by also by Mac OS X server, Windows and Unix platforms) that are beyond the developers control and too technical for this discussion which can also cause some files to be skipped.

Should you ever decide to try ClamXav again, I encourage you to visit the ClamXav site for documentation and the ClamXav Forum for advise and assistance from other users.

FD: I do uncompensated Tech Support for the ClamXav Forum.

Reply