Google virus warning?

Hi, I was sent this by a friend today, and thought it may be of interest. Put it in here as iot was the most likely place for it to be seen.

Mac users hit with Fake AV when using Google image search | Naked Security

Another reason not to use Safari.... IMO

I don't know why everyone rags on Safari. I have never had a problem with it on both Windows and OSX. It has always performed speedily and never crashed. It loads data faster than IE and that to me is ideal.

This MALWARE will only affect you if you are stupid enough to install and
Input your credit card details. Note: It is not a virus.

Oh and why is it you never hear in the press the self same statement about a similar fake AV scan which is embedded into many webpages that often pop up in Windows and look like an Explorer window?

The fact is there are people out there trying to exploit the foolish among us, Mac & Windows users alike.

harrisondavies said:

I don't know why everyone rags on Safari. I have never had a problem with it on both Windows and OSX. It has always performed speedily and never crashed. It loads data faster than IE and that to me is ideal.

This MALWARE will only affect you if you are stupid enough to install and
Input your credit card details. Note: It is not a virus.

Click to expand...

It's the way Safari auto-extracts zip files upon downloading them. So, it's not much of a leap to get something that ordinarily wouldn't be deliverable via a drive-by download. I haven't run across it yet, but based on the description, it appears to be specific to Safari because of this behavior. Hopefully Apple will think better of it in the future..

But I agree with you that you'd had to be pretty silly to just allow an installer to proceed when it pops up seemingly out of nowhere.

I agree. Also notice that "Sophos" implies if you use their AV software you'll be protected against this sort of thing. Kind of reminds me of the type of "Snake Oil" AV advertisements that I used to receive when running Windows.

Safari only auto extracts if you enable that option in Preferences. Otherwise it does not. Way back it was set that way out of the box.

The issue with Safari is what it deems a "safe" download and I don't think it's ever possible for a browser to know what is and isn't safe. Given the differences in everyone's browsing patterns combined with the continued creation of different forms of data, I don't think I'll ever have confidence in a browser to tell me what is and isn't safe. Now, I know what I download and I stay away from shady parts of the net but many don't and this feature will affect them the most.

At least as dtravis7 pointed out, you can disable the feature.

I believe the default setting is unchecked now. I remember last time I installed Snow Leopard on this new to me iMac, it was unchecked and I did a clean install. I hope no one checks the box to allow SAFE downloads as like you said, how does the browser for sure know if it's safe or not?

dtravis7 said:

I believe the default setting is unchecked now. I remember last time I installed Snow Leopard on this new to me iMac, it was unchecked and I did a clean install. I hope no one checks the box to allow SAFE downloads as like you said, how does the browser for sure know if it's safe or not?

Click to expand...

That's interesting because I haven't tweaked it, and it was turned on for me on my new MacBook Pro. I'm not saying you're wrong, but it doesn't appear to be a standardized setting.

cwa107 said:

That's interesting because I haven't tweaked it, and it was turned on for me on my new MacBook Pro. I'm not saying you're wrong, but it doesn't appear to be a standardized setting.

Click to expand...

Interesting, will check again next time I install a clean install of SL and see what happens.

I know back in the 10.3 and maybe even 10.4 days it was for sure checked by default. I always unchecked it just in case.

I see that a web browser isn't exactly the best thing to tell you what is and is not safe, but doesn't it already tell you if a site is safe for browsing?

Doesn't mean the files it links to are though. A site may not be registered with Google's Safe Browsing service but may link to malicious files. There's also the very real fact that a site that's malicious may not be registered with the service. It couldn't possibly have records of every site on the internet.

dtravis7 said:

I believe the default setting is unchecked now. I remember last time I installed Snow Leopard on this new to me iMac, it was unchecked and I did a clean install. I hope no one checks the box to allow SAFE downloads as like you said, how does the browser for sure know if it's safe or not?

Click to expand...

Mine came unchecked when bought new and has stayed that way.

I just checked my iMac (it is a refurbish) and it was checked "on", yes I did un-check that function. Could had been the previous owner, who knows???

dero said:

I just checked my iMac (it is a refurbish) and it was checked "on", yes I did un-check that function. Could had been the previous owner, who knows???

Click to expand...

If it was a certified Apple Refurb it will have had a completely wiped and reinstalled OS.
I wonder if Apple may have had Macs shipped checked in some OS version, and then later decided to ship them unchecked in later OS versions.