Macs not that Impervious to Viruses

[bomalabs]

Macs not that Impervious to Viruses

Hi Folks,
I have been struggling with this problem for weeks now. It is this simple. Whenever I send mail, my system is configured to give out a "whoosh" sound.
Then, sometime weeks ago, even if I was not sending mail, I would hear that "whoosh" sound, which meant that I was sending mail. It was only a matter of time before I got email from people asking me who I was and why I was sending them email with attachments. Right now I have a Net barrier 3 installed and have been trying top rid myself of that pesky virus with the inhouse Virex to no avail. Also have Symantec but it doesn't load well. It has come to the point where I am so paranoid about the virus that I feel it is preventing the other anti-virus programs from being installed. It is a must for the Mac user to double check their firewall settings to see that nothing is checked that shouldn't be. And keep updated on Virex. But in my case, with the Net barrier, i have had the opportunity to observe how much probing we Mac users are subjected to. And trust me, it's alarming how much probing our are subjected to in an hour. Try getting a Net barrier on trial and see for yourself.
Ay Caramba! It's something I feel we all have a false sense of security about. And I guess in a way this virus came as a wake up call for us to be more wary of the danger that lurks out there. For just because you can't see it doesn't mean it isn't there. But I am in dire need of your expert advise in deleting this virus. It has come to the point where I have to use the iMac for my email and this iBook for the other stuff. Your recommendations are most welcome because I have tried all I can from the Internet, etc and nothing seems to work. Powermac is helpless also, as their stock of Norton anti-virus is yet to arrrive. My questions are: Will Symantec do the job? Will Secunia do a better job? Where can I get a hold of a disc of these things? Can anyone bring a copy to the photographers meet? I'll bring my checkbook. Unless you want to swap something like Corbon ammunition for .40 cal or 9mm haha (kidding). Please reply to this post with your ideas and recomendations as I have run out of options or feel I have.



Mabuhay ang Pilipino. Pero hindi lahat.

[directX]

Boss Gerry, can you check the Sent Mail folder and see if the email sent out are still there? This will narrow down the type of virus -- let's see if it is indeed a virus.

[berniej]

@bomalabs: In the meantime, you can try running "Little Snitch" and "Paranoid Android" and see what happens.

Little Snitch will inform you if a program is sending out packets of data outside your system while Paranoid Android will tell you if something tries to open anything in your system without your knowledge.

HTH

[bomalabs]

Hi guys,
yes, sent Mail is still there. I tried little snitch, but it was disconnected by Powermac in favor of Net Barrier 3 as they were clashing. Haven't come across Paranoid Android but I assume it's a similar type of program?

[Edited on 7-5-2004 by bomalabs]

[bomalabs]

Bernie J, Will try Paranoid Android, but with Net Barrier. Will this be similar to the configuration you propose?

[directX]

What email client are you using?

[bomalabs]

i am using mac mail

[piedad]

Forward to me the sent mail, which should contain the virus, if any. It might not be a virus but a trojan horse program which is sending out spam email.
Note that a virus per-se is defined as something that spreads without user intervention. A trojan-horse is something installed by the user without his knowing it. Kinda like the Apple Motion software spreading via Peer-to-peer, but when you install it is actually a different software. It is possible to insert a trojan program as part of an installer package of a famouse program, then spread it via peer-to-peer.
In your case, might be a specific exploit of Mac Mail...not very clever if it makes the sending sound...

[ginoledesma]

. It is possible to insert a trojan program as part of an installer package of a famouse program, then spread it via peer-to-peer.

In the words of the wise:

Anyone getting software through peer-to-peer networks should never run out screaming "I'VE A VIRUS!!!" and blame Apple or the software manufacturers. You got off an illegitimate source, you deal with it.

Bomalabs, that may be an isolated case but I am still curious about to the nature of this "virus." My Mac, which has been running continously since I got it, and connected to the Internet 24/7 (most of the time) without the firewall enabled is virus/trojan/worm-free.

Also, it is important to note that it is VERY EASY for people to spoof their from email addresses and pretend to be you. I've already received mail from people who I know will NEVER send me spam (much less DOS executables). It may not be your computer per se that's sending out the attachments. I'm guessing these attachements end in something like .pif, .scr, .exe, or whatever. Where in the world would your Mac get those?

[elbert]

Gerry,

I doubt it's a virus. Like Gino, I don't use any anti-virus nor am I using a firewall. I frequently use P2P too.

It's true, the Mac isn't impervious to a virus attack, but until we see a report on the net of a major virus affecting Mac users, then we can all breathe easy.

I've been accused of sending out viruses. Friends call me saying that they're Mac has been sending out a virus. Most of us get a "returned mail error" of messages we never sent out (to people we've never even heard of).

I believe it's all just spoofing. There have been a number of nasty worms circulating the Window$ world lately. These worms pick out e-mail addresses from others' address books or previous e-mail messages to send itself out using those addresses.

Pare, all that worrying will just add to your gray hair unnecessarily.