Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: Cieritaqt
Cieritaqt Author
User level: Level 1
0 points

Does my new Macbook Pro need Antivirus? Best Buy gave me the Webroot...

I just brought my Macbook Pro home. This is my first Apple computer so I am learning. Best Buy gave me the 6 month free Webroot, and told me I needed it. Do Macs get viruses, I have read that they are 80% secure but there is a 20% chance. Should I install Webroot or not? Thanks

MacBook Pro, OS X Mountain Lion (10.8)

Posted on Oct 19, 2013 10:16 AM

Reply
21 replies
User profile for user: OGELTHORPE
OGELTHORPE
User level: Level 9
57,305 points

Oct 19, 2013 10:39 AM in response to Cieritaqt

You have been misled. Macs do not need any AV protection at this time. Webroot may actually have a negative affect on the operation of your MBP. If you want to occasionally check your unit, download Sophos from the Internet. It is FREE.


Ciao.


On the basis of our resident AV expert, I also recommend either VirusBarrier Express or Dr. Web Light, both from the App Store. They're both free, and since they're from the App Store, they can't destabilize the system. Both have some of the best detection rates out there, according to his testing.


Message was edited by: OGELTHORPE

Reply
User profile for user: Linc Davis
Linc Davis
User level: Level 10
209,541 points

Oct 19, 2013 10:42 AM in response to Cieritaqt

1. This comment applies to malicious software ("malware") that's installed unwittingly by the victim of a network attack. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the victim's computer. That threat is in a different category, and there's no easy way to defend against it. If you have reason to suspect that you're the target of such an attack, you need expert help.

If you find this comment too long or too technical, read only sections 5, 6, and 10.

OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.

2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user, but internally Apple calls it "XProtect." The malware recognition database is automatically checked for updates once a day; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.

The following caveats apply to XProtect:

  • It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
  • It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated " Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)

Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:

  • It can easily be disabled or overridden by the user.
  • A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
  • An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.

For the reasons given above, App Store products, and other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. OS X security is based on user input. Never click through any request for authorization without thinking.

4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.


5. The built-in security features of OS X reduce the risk of malware attack, but they're not absolute protection. The first and best line of defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and the malware attacker. If you're smarter than he thinks you are, you'll win.

That means, in practice, that you never use software that comes from an untrustworthy source, or that does something inherently untrustworthy. How do you know what is trustworthy?

  • Any website that prompts you to install a “codec,” “plug-in,” "player," "extractor," or “certificate” that comes from that same site, or an unknown one, is untrustworthy.
  • A web operator who tells you that you have a “virus,” or that anything else is wrong with your computer, or that you have won a prize in a contest you never entered, is trying to commit a crime with you as the victim. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
  • Pirated copies or "cracks" of commercial software, no matter where they come from, are unsafe.
  • Software of any kind downloaded from a BitTorrent or from a Usenet binary newsgroup is unsafe.
  • Software that purports to help you do something that's illegal or that infringes copyright, such as saving streamed audio or video for reuse without permission, is unsafe. All YouTube "downloaders" are in this category, though not all are necessarily harmful.
  • Software with a corporate brand, such as Adobe Flash Player, must be downloaded directly from the developer’s website. If it comes from any other source, it's unsafe.
  • Even signed applications, no matter what the source, should not be trusted if they do something unexpected, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
6. Java on the Web ( not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.

Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.

Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it — not JavaScript — in your browsers.

Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.
Follow the above guidelines, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself from malware.

7. Never install any commercial "anti-virus" or "Internet security" products for the Mac, as they all do more harm than good, if they do any good at all. Any database of known threats is always going to be out of date. Most of the danger is from unknown threats. If you need to be able to detect Windows malware in your files, use one of the free anti-virus products in the Mac App Store — nothing else.

Why shouldn't you use commercial "anti-virus" products?
  • Their design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere.
  • In order to meet that nonexistent threat, the software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
  • By modifying the operating system, the software itself may create weaknesses that could be exploited by malware attackers.

8. An anti-malware product from the App Store, such as "ClamXav," doesn't have these drawbacks. That doesn't mean it's entirely safe. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.

An anti-virus app is not needed, and should not be relied upon, for protection against OS X malware. It's useful only for detecting Windows malware. Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else.

A Windows malware attachment in email is usually easy to recognize. The file name will often be targeted at people who aren't very bright; for example:

♥♥♥♥♥♥♥♥♥♥♥♥♥♥!!!!!!!H0TBABEZ4U!!!!!!!.AVI♥♥♥♥♥♥♥♥♥♥♥♥♥♥.exe

Anti-virus software may be able to tell you which particular virus or trojan it is, but do you care? In practice, there's seldom a reason to use the software unless a network administrator requires you to do it.

The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have the disadvantages mentioned in section 7.

9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.

10. As a Mac user you don't have to live in fear that your computer is going to be infected every time you install an application, read email, or visit a web page. But neither should you have the false idea that you will always be safe, no matter what you do. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.
Reply
User profile for user: John Galt
John Galt
User level: Level 10
140,948 points

Oct 19, 2013 12:17 PM in response to Cieritaqt

Cieritaqt wrote:


... Should I install Webroot or not? Thanks


Not.


Whatever Best Buy tells you do to, you will probably be better off doing the opposite. "80% secure / 20% chance" is a ludicrously inappropriate metric.


Do not install Webroot. If you already did, uninstall it according to its uninstallation instructions, and ensure its complete and total eradication from your new Mac. The vast majority of complaints on this support site are directly attributable to using useless junk like Webroot.


OS X already includes everything it needs to protect itself from viruses and malware. Keep it updated with software updates from Apple.


A much better question is "how should I protect my Mac":


  • Never install any product that claims to "speed up", "clean up", "optimize", or "accelerate" your Mac. Without exception, they will do the opposite.
  • Never install pirated or "cracked" software, software obtained from dubious websites, or other questionable sources. Illegally obtained software is almost certain to contain malware.
  • Don’t supply your password in response to a popup window requesting it, unless you know what it is and the reason your credentials are required.
  • Don’t open email attachments from email addresses that you do not recognize, or click links contained in an email:
    • Most of these are scams that direct you to fraudulent sites that attempt to convince you to disclose personal information.
    • Such "phishing" attempts are the 21st century equivalent of a social exploit that has existed since the dawn of civilization. Don’t fall for it.
    • Apple will never ask you to reveal personal information in an email. If you receive an unexpected email from Apple saying your account will be closed unless you take immediate action, just ignore it. If your iTunes or App Store account becomes disabled for valid reasons, you will know when you try to buy something or log in to this support site, and are unable to.
  • Don’t install browser extensions unless you understand their purpose. Go to the Safari menu > Preferences > Extensions. If you see any extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone.
  • Don’t install Java unless you are certain that you need it:
    • Java, a non-Apple product, is a potential vector for malware. If you are required to use Java, be mindful of that possibility.
    • Disable Java in Safari > Preferences > Security.
    • Despite its name JavaScript is unrelated to Java. No malware can infect your Mac through JavaScript. It’s OK to leave it enabled.
  • Block browser popups: Safari menu > Preferences > Security > and check "Block popup windows":
    • Popup windows are useful and required for some websites, but popups have devolved to become a common means to deliver targeted advertising that you probably do not want.
    • Popups themselves cannot infect your Mac, but many contain resource-hungry code that will slow down Internet browsing.
    • If you ever see a popup indicating it detected registry errors, that your Mac is infected with some ick, or that you won some prize, it is 100% fraudulent. Ignore it.
  • Ignore hyperventilating popular media outlets that thrive by promoting fear and discord with entertainment products arrogantly presented as "news". Learn what real threats actually exist and how to arm yourself against them:
    • The most serious threat to your data security is phishing. To date, most of these attempts have been pathetic and are easily recognized, but that is likely to change in the future as criminals become more clever.
    • OS X viruses do not exist, but intentionally malicious or poorly written code, created by either nefarious or inept individuals, is nothing new.
    • Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.
    • If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
    • Most such utilities will only slow down and destabilize your Mac while they look for viruses that do not exist, conveying no benefit whatsoever - other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.
  • Do install updates from Apple as they become available. No one knows more about Macs and how to protect them than the company that builds them.


Summary: Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.

Reply
User profile for user: MadMacs0
MadMacs0
User level: Level 5
5,221 points

Oct 19, 2013 12:29 PM in response to Cieritaqt

Cieritaqt wrote:


Best Buy gave me the 6 month free Webroot, and told me I needed it.

BB did you a disservice as it's simply a ploy to get you to pay for something you probably don't need six months from now. This testing was done back in January, but note that Webroot performed at the bottom of the list of A-V software tested. If you decide you need it, there are many better choices, many of them free.

Reply
User profile for user: Tooray1313
Tooray1313
User level: Level 1
0 points

Mar 13, 2014 12:55 PM in response to Cieritaqt

Okay you guys are a little delusional, it is just as easy to get a virus on a MAC as it is a PC, and most people get infected without even knowing i recommend that you go take a look at this site http://www.reedcorner.net/mmg/. Also there is a history of keyloggers and other malware on the MAC. So anyone who says a MAC can not get infected is wrong.


The big thing to remember is that make sure you do not open emails with attachments from people you do not know, and also do not got running oud websites that you do not recognize. I have had more that one friend get java and flash infections that wreak havoc. Also that Crpto locker virus it will work on a mac and that thing is EVIL. The major reason MAC's do not have as many infections is because you are the minority. The goal of most infections is to steal information and passwords so if your goal was to was to get your infection on the most systems possible who would you target, the minority or the vast overwhelming majority of systems.

Reply
User profile for user: MadMacs0
MadMacs0
User level: Level 5
5,221 points

Mar 13, 2014 3:31 PM in response to Tooray1313

Tooray1313 wrote:


it is just as easy to get a virus on a MAC as it is a PC

That isn't really true, for a number of reasons, but I don't think it's really worth discussing here. I understand your point.


Most of what you've said is generally true but not exactly.


There has never been a reported instance of being infected by simply reading an e-mail. Following a link or opening an attachment, yes, but so far reading and not acting won't infect you.


The CryptoLocker virus does not work on a Mac. There is a Fake CryptoLocker site that uses JavaScript to make you think you have been infected, but you can easily back out of the site and reset the browser to get rid of it. There is no actual encryption but you can be fooled into paying to have it unlocked, which doesn't happen and isn't needed.


Keyloggers for OS X are almost all commercial or hack software that has legitamate purposes (e.g. parental control), requires physical access or approved sharing of the computer and won't be detected by most all A-V software for fear of causing False Alarms. Governments may have found ways to do it through malware, but I doubt anybody really knows enough to comment here.


Almost all of this is explained on Mr. Reed's site. I've read it all, refer users to it all the time and am a frequent contributor.

Reply
User profile for user: thomas_r.
thomas_r.
User level: Level 7
31,989 points

Mar 13, 2014 3:49 PM in response to Tooray1313

Please don't use my site as an excuse to attack people, especially when you follow up the link to my site with some outright misinformation (like the claim that CryptoLocker works on the Mac - it does not). Also, note that nobody here said anything about it being impossible for Macs to be infected with malware, so calling these folks "delusional" on that basis makes absolutely no sense whatsoever.


It's hard enough to have reasonable, rational discussions of anti-virus software here without throwing things like name-calling and inaccurate information into the mix. You are not helping your cause.

Reply
User profile for user: MadMacs0
MadMacs0
User level: Level 5
5,221 points

Nov 6, 2014 10:27 PM in response to Michsunshine

Michsunshine wrote:


I did turn my firewall on, so I should turn it off? I do use file sharing with my iPad. Also what is your opinion for using 1 password for my banking, credit cards etc,?

Link doesn't usually respond to requests such as this and may no longer be monitoring the discussion.


As far as your Firewall is concerned, I don't think there is much more to be said beyond what he already wrote:

It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services.

So you didn't tell us your circumstances. If you are wired into your router or using WiFi with a strong WPA2 password and your router hasn't been hacked then it's firewall will fully protect you there. Leaving it on will very slightly slow your internet connections, but I doubt that you would even notice it. If you carry your computer to Starbucks, then you must turn your Firewall on. For additional information read Do I need a firewall from a colleague of mine.


If 1Password works for you, then you should probably use it. I own it, but have continued to use LastPass for several months now.

Reply
User profile for user: Zontania
Zontania
User level: Level 1
0 points

Nov 7, 2014 1:56 AM in response to Linc Davis

This is very informative. Thank you.


I have been using Kaspersky for my Windows laptop and noticed they now make a version for Macs so I downloaded the free trial. Last night, whilst using Pages to edit some of my writing, the cursor got stuck in one location and the keyboard would not work even though I could move a copy of the cursor "I" on the screen but it would do nothing and the other cursor (the real one) was still stuck in the same location on the text. I tried to do the alt-command-escape which I saw is the equivalent of control-alt-del but nothing happened. The MacBook Pro Retina went to sleep. I woke it up. Never got the login screen which I normally get. In the end, desperate to end this crash, I turned off the netbook using the on/off key. When I switched it back on again, everything was working as expected, but I was scared to go back to editing lest it would happen again. Now I am thinking that maybe it was the Kaspersky that caused the crash. Kaspersky has been a very reliable provider of internet security all these years and is recommended by my bank which actually provides me with free copies. In their site, they mention that as Macs are becoming ever more popular, the hackers are now turning their attention to them. It is hard to know what to believe.


With regards to key loggers, I agree that someone must actually gain access to your unit to install one. My ex did that. He was one jealous and sad person! but it was upsetting when I discovered it because I could see all my activity and passwords which made me feel really insecure and exposed.


About Java: I need it to play my favourite game (RuneScape). Are you saying that by granting permission to this page to run, I am exposing myself to threats? (other than 13 year old PKers? LOL) And what about the Adobe Flash Player that most games are using nowadays? Is this unsafe, too?

Reply
User profile for user: MadMacs0
MadMacs0
User level: Level 5
5,221 points

Nov 7, 2014 2:07 AM in response to Zontania

Linc rarely responds to requests from others, especially older ones such as this and may not even be monitoring it any longer, so I'll give it a try.

Zontania wrote:


About Java: I need it to play my favourite game (RuneScape). Are you saying that by granting permission to this page to run, I am exposing myself to threats?

Yes, but depending on what versions of OS X and Java you are using, that threat may be minimized. Oracle and Apple have become much better at keeping on top of these things and will disable older versions when necessary. Just be rigorous about keeping your Mac fully up-to-date.

And what about the Adobe Flash Player that most games are using nowadays? Is this unsafe, too?

The current version is not known to be unsafe, but that last version was and Apple blocks it in Snow Leopard 10.6.8 and above. Again, the latest versions of OS X have the means to better manage and "sandbox" it's use, which goes a long way to keeping any threat under control. Flash is notoriously vulnerable in many ways and will almost certainly never be bug free, so for now keep it up-to-date and hope that more sites eliminate it's use in favor of safer, more powerful technologies.

Reply

Does my new Macbook Pro need Antivirus? Best Buy gave me the Webroot...

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up