Previous 1 2 Next 28 Replies Latest reply: Oct 22, 2013 7:49 AM by seventy one Branched to a new discussion.
Roverlen Level 1 (0 points)

Is there a Virus checker program that can run via a DVD or external to the hard drive? I would like to do a scan for any virus on the HD but do not want a resident one due to impeding speed of daily operation. The other alternative could  be a check from within OS Lion utilities if there is something there?


As a rule, I do not open any unidentified attachment unless it's a friend and the file is not of a Macro nature.


Any suggestions would be appreciated.



iPhone 4
  • Carolyn Samit Level 10 (103,360 points)

    There are no Mac viruses currently.


    The best way to prevent malware is to enable Gatekeeper.


    Open System Preferences > Security & Privacy then select the General tab.


    Make sure either Mac App Store or Mac App Store and identified developers is selected. If that area is grayed out, click the padlock icon to proceed.


    OS X: About Gatekeeper


    Good read here >  Viruses, Trojans, Malware - and other aspects of Internet Security: Apple Support Communities


    Running anti virus software from an external drive won't work regardless.

  • WZZZ Level 6 (12,845 points)

    I realize that by "virus" you mean malware in general. Thomas Reed, who is probably the most qualified helper here on ASC in this area is recommending VirusBarrier Express, which is free from the Mac App Store. In recent tests it came out rather well in detecting Mac malware. It only runs on demand scans, doesn't install any system modifications and won't permanently slow anything down. But you do have to have it on the drive to which you are booted, which would mean the internal drive.


    For more see



    But don't let any A-V lead you into becoming complacent about where you browse and what you download. No A-V will find something that is emerging or yet to be cataloged. And no A-V will catch everything.

  • Rudegar Level 7 (25,460 points)

    I run virusbarrier express once in awhile and also bitdefender virus scanner both free from app store

    so far they havent come across anything shady

  • WZZZ Level 6 (12,845 points)

    Just to be certain I gave the correct information, it must be installed and scan on the boot volume, or does it have an option to scan other volumes?

  • Linc Davis Level 10 (192,265 points)

    1. This comment applies to malicious software ("malware") that's installed unwittingly by the victim of a network attack. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the victim's computer. That threat is in a different category, and there's no easy way to defend against it. If you have reason to suspect that you're the target of such an attack, you need expert help.
    If you find this comment too long or too technical, read only sections 5, 6, and 10.
    OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.

    2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user, but internally Apple calls it "XProtect." The malware recognition database is automatically checked for updates once a day; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
    The following caveats apply to XProtect:
    • It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
    • It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
    3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
    Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
    • It can easily be disabled or overridden by the user.
    • A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
    • An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
    For the reasons given above, App Store products, and other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. OS X security is based on user input. Never click through any request for authorization without thinking.
    4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
    5. The built-in security features of OS X reduce the risk of malware attack, but they're not absolute protection. The first and best line of defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and the malware attacker. If you're smarter than he thinks you are, you'll win.
    That means, in practice, that you never use software that comes from an untrustworthy source, or that does something inherently untrustworthy. How do you know what is trustworthy?
    • Any website that prompts you to install a “codec,” “plug-in,” "player," "extractor," or “certificate” that comes from that same site, or an unknown one, is untrustworthy.
    • A web operator who tells you that you have a “virus,” or that anything else is wrong with your computer, or that you have won a prize in a contest you never entered, is trying to commit a crime with you as the victim. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
    • Pirated copies or "cracks" of commercial software, no matter where they come from, are unsafe.
    • Software of any kind downloaded from a BitTorrent or from a Usenet binary newsgroup is unsafe.
    • Software that purports to help you do something that's illegal or that infringes copyright, such as saving streamed audio or video for reuse without permission, is unsafe. All YouTube "downloaders" are in this category, though not all are necessarily harmful.
    • Software with a corporate brand, such as Adobe Flash Player, must be downloaded directly from the developer’s website. If it comes from any other source, it's unsafe.
    • Even signed applications, no matter what the source, should not be trusted if they do something unexpected, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
    6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
    Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
    Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable itnot JavaScript — in your browsers.
    Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.

    Follow the above guidelines, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself from malware.

    7. Never install any commercial "anti-virus" or "Internet security" products for the Mac, as they all do more harm than good, if they do any good at all. Any database of known threats is always going to be out of date. Most of the danger is from unknown threats. If you need to be able to detect Windows malware in your files, use one of the free anti-virus products in the Mac App Store — nothing else.
    Why shouldn't you use commercial "anti-virus" products?
    • Their design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere.
    • In order to meet that nonexistent threat, the software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
    • By modifying the operating system, the software itself may create weaknesses that could be exploited by malware attackers.
    8. An anti-malware product from the App Store, such as "ClamXav," doesn't have these drawbacks. That doesn't mean it's entirely safe. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
    An anti-virus app is not needed, and should not be relied upon, for protection against OS X malware. It's useful only for detecting Windows malware. Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else.
    A Windows malware attachment in email is usually easy to recognize. The file name will often be targeted at people who aren't very bright; for example:
    Anti-virus software may be able to tell you which particular virus or trojan it is, but do you care? In practice, there's seldom a reason to use the software unless a network administrator requires you to do it.
    The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have the disadvantages mentioned in section 7.
    9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
    10. As a Mac user you don't have to live in fear that your computer is going to be infected every time you install an application, read email, or visit a web page. But neither should you have the false idea that you will always be safe, no matter what you do. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

  • WZZZ Level 6 (12,845 points)

    A FYI, ClamXav has fallen behind dramatically in detecting OSX Malware.


    ClamXav took a pretty big hit knocking it out of the 60-80% detection rate and was moved to the 60% or lower list. After testing the product for this long and seeing no improvement there is no reason to expect improvement anytime soon...


    After adding the new samples VirusBarrier still performs really well and detects all of them right away. This gives me hope because I mentioned in a previous comment it looked like they just added all the signatures in this list to look good in the test. While this may still have been the case, the fact that all new samples were detected before this list went live shows they have done their homework. VirusBarrier 2013 now dominates first place and the older X6 version a very close second place.




    Why multiple layers of security are important


  • seventy one Level 6 (13,210 points)

    Hi WZZZ,


    Just observation but Virus Barrier Express has a pretty miserable rating and comments are not encouraging.   But I notice Virus Barrier plus at £6.99 and wonder if that's the one you feel quite happy with.


    I know ratings are not always a good guide, especially when there are few to read through, but you have to go by something.

  • WZZZ Level 6 (12,845 points)

    Not sure where you're seeing all the bad ratings. There are some, but from 2012. And this is a recent one from T. Reed. This version gets 3.5 out of 5, based on 31 reviews.


    Screen shot 2013-10-21 at 1.11.06 PM.png

  • thomas_r. Level 7 (30,707 points)

    I just wanted to chime in here and support what WZZZ is saying. One of the App Store apps (VirusBarrier Express would be my top choice for detecting Mac malware) would meet your requirement that it not interfere with speed of daily operation. If you have one of those apps installed, they won't be doing anything unless you open them and start a scan.


    As for the requirement that it sit on a separate drive... Mac OS X is designed for apps to go in the Applications folder on the boot drive. Some apps won't work at all if you put them anywhere else. I've honestly never tested to see if App Store apps can be moved or not, so I'm not sure whether you could put VBE on an external drive... but there would be no point. It wouldn't improve performance in the slightest. You could put VBE on an external drive with its own bootable system, and restart from that system to scan your internal drive... but again, there would be no point. You'd be adding a lot of extra work to something that wouldn't really benefit from it.

  • WZZZ Level 6 (12,845 points)

    I would say you're basically chiming in to support yourself, since almost everything I wrote was from you in the first place. icon_lol.gif

  • Roverlen Level 1 (0 points)

    Thanks for the quick reply. I guess it's the 'Gatekeeper' if I want protection. However, I was hoping to run something via a DVD similar to when I was a PC user. In any case, I have had this iMac for five years and it runs perfectlly every day but it would add peace of mind if I ran something just to check for viruses.


    I noted in your reply that any form of checking for virus remote fromthe iMAC is not possible????? I assume that the checker has to be resident on the HD in order to check for any Malware. Since I am not familar with Malware and my boys no longer have access to this machine, what would the symptoms be of a Malware attack?


    regards, Roverlen   

  • Roverlen Level 1 (0 points)

    Thanks WZZZ:


    I'll check out the virus App since it is what I preferably want. As a rule , nothing is downloaded without considerable thought and site verification. I guess I am just paranoid since being a Corporate person and a PC user, slow and debilitated by McAfee was the norm.


    regards, Roverlen

  • WZZZ Level 6 (12,845 points)

    what would the symptoms be of a Malware attack?

    I'll let Thomas answer this one in full, but there would probably be zero symptoms. Almost all OSX malware is now profit driven (stealing sensitive data can be one) and if the malware authors write code that creates symptoms, that may mean the presence of their malware may be discovered, which is the last thing they want to do.* Malware is no longer being written by kids intent on computer vandalism for kicks.


    Almost all the posts here beginning with "do I have a virus" turn out to be nothing to do with malware, but rather other kinds of totally unrelated problems.


    *One prominent exception to this was, or is, the FBI Ransomware exploit which displays a notice and freezes the computer until the user pays up. In OSX it is easily defeated.

  • WZZZ Level 6 (12,845 points)

    The FBI Ransomware exploit goes by different names depending on the country of the target. I think there is at least one version for PC which may be harder to remove.


    Not that Macs are immune to malware--that is a myth--but a lot of the "virus" scares here are coming from former PC users, or tales they have heard from PC users. There is a whole industry  of scammers who are trying to profit off of that.

Previous 1 2 Next