Should i use an Anti-Virus

osxx · Apr 19, 2012

I don't use any now and don't see that changing any time soon.

AliOop · Apr 19, 2012

Being a long time Linux user, and still using it, even some Linux aficionados have AV software installed. With the Mac OS having a much larger market stare, Apple user would do well to do the same. No need to take shots at MS as an example of a poorly designed OS. It really has no relation to the Mac user. Like another poster said, an ounce of prevention is worth a pound of cure. Too many AV software, free and paid, not to do so. And too many malcontents doing bad things not to use an AV.

For my benefit and peace of mind I'll continue to do so. After all is said and done, what does it really cost you?

TBABill · Apr 19, 2012

I have been using mostly Linux for quite some time and I have avoided using any AV on it without incident. However, as malware, trojans, etc. are being slipped into innocent websites and machines with vulnerabilities are infected while visiting those safe sites, users have little means to detect a potential problem while searching/using a trusted site. With that in mind I'm using Sophos and have seen no speed or resource drop for doing so.

Our machines are plenty powerful enough to run a decent low-resource AV so avoiding doing so is just running at risk. Sure, you may never be infected, but will you know when you are or right before you are? We can claim all the safety we want about our own practices, but if your trusted site is hacked and becomes a breeding ground for malware spread, then what? It's an innocent site with malicious contents placed there by someone other than the site owner. How do you prevent that by running without protection?

Those are questions I posed to myself. Each of us has asked ourselves how we want to handle security beyond the inherent security measures built into the OS. I lean toward the "can't hurt to be too careful" side, but I totally understand those who trust their practices and their OS to remain free of issues.

Holly21 · Apr 19, 2012

WOW, Never thought i would get so many answers!! Thank all of you for taking the time to answer a simple question. I know now i have so much more knowledge about choosing an AV. Thank you again, Holly

Lifeisabeach · Apr 20, 2012

TBABill said:
Our machines are plenty powerful enough to run a decent low-resource AV so avoiding doing so is just running at risk. Sure, you may never be infected, but will you know when you are or right before you are? We can claim all the safety we want about our own practices, but if your trusted site is hacked and becomes a breeding ground for malware spread, then what? It's an innocent site with malicious contents placed there by someone other than the site owner. How do you prevent that by running without protection?

This reminds me of an interaction I had with someone once. Years ago, when I was a regular Windows user, I was active on usenet in a PC support group. One week, we were in intense discussions about AV software. I had been reading up a lot on tests and reviews of AV software, and one thing that we had been recommending was to have two different AV software packages… one that actively scanned, a second one that you only ran on demand for a "second opinion". This came about because no single AV software was proven to catch everything. All them, without exception, missed some malware in independent tests.

So anyway, one regular was like "Well I'm fine with what I'm using. It gives me a clean scan every time, so it's doing its job just fine." I then said "How do you KNOW it's not missing anything? Just because it says you have no malware doesn't mean it's not overlooking any." So he thought about that, tried a second piece of AV software, and BAM! He had two pieces of malware running that his regular AV software (Norton or AVG i think) completely missed.

So the moral of this is that optimism and faith that your existing practices are good enough… isn't good enough. There's no reason to not have AV software on your Mac. Even if it's not actively scanning all the time, run it once a week or so just to be sure. There literally is no reason not to. Consider it a challenge. Think your habits are good enough? PROVE IT… even if only to yourself.

chas_m · Apr 20, 2012

I would remind some of the participants in this thread that all of us who are running Snow Leopard or above are ALREADY running an anti-malware program from Apple. It is what is protecting us from the earlier Flashback variants RIGHT NOW. I don't know why it couldn't be used for the Java exploit (though I have a theory on that), but generally speaking, we are ALREADY COVERED in this regard.

Lifeisabeach · Apr 20, 2012

chas_m said:
I would remind some of the participants in this thread that all of us who are running Snow Leopard or above are ALREADY running an anti-malware program from Apple. It is what is protecting us from the earlier Flashback variants RIGHT NOW. I don't know why it couldn't be used for the Java exploit (though I have a theory on that), but generally speaking, we are ALREADY COVERED in this regard.

Generally speaking, we are already covered. Except when we aren't. If it's not 100% covered, then you are at risk. "Generally" isn't cutting it.

Brunhild · Apr 20, 2012

lifeisabeach said:
This reminds me of an interaction I had with someone once. Years ago, when I was a regular Windows user, I was active on usenet in a PC support group. One week, we were in intense discussions about AV software. I had been reading up a lot on tests and reviews of AV software, and one thing that we had been recommending was to have two different AV software packages… one that actively scanned, a second one that you only ran on demand for a "second opinion". This came about because no single AV software was proven to catch everything. All them, without exception, missed some malware in independent tests.

So anyway, one regular was like "Well I'm fine with what I'm using. It gives me a clean scan every time, so it's doing its job just fine." I then said "How do you KNOW it's not missing anything? Just because it says you have no malware doesn't mean it's not overlooking any." So he thought about that, tried a second piece of AV software, and BAM! He had two pieces of malware running that his regular AV software (Norton or AVG i think) completely missed.

So the moral of this is that optimism and faith that your existing practices are good enough… isn't good enough. There's no reason to not have AV software on your Mac. Even if it's not actively scanning all the time, run it once a week or so just to be sure. There literally is no reason not to. Consider it a challenge. Think your habits are good enough? PROVE IT… even if only to yourself.

How do you run two? From what Ive seen with 2 installed on occasion sometimes they pick on each other. Are there certain combinations to avoid?

Just curious,...

technologist · Apr 20, 2012

On the one hand, I agree that Apple has been lax in closing holes in its products of late.

On the other hand, the anti-malware companies aren't much better. Flashback was spreading in the wild several days before most anti-virus vendors were able to offer any protection.

chas_m said:
I don't know why it couldn't be used for the Java exploit (though I have a theory on that)

The OS X Quarantine flag is not applied to Java applets. No quarantine flag meant no XProtect scan. Instead, Java applets are supposed to be sandboxed by the JVM, but exploiting the bug in Java (that Apple was slow to release a patch for) allowed it to break out of the sandbox.

Lifeisabeach · Apr 20, 2012

Brunhild said:
How do you run two? From what Ive seen with 2 installed on occasion sometimes they pick on each other. Are there certain combinations to avoid?

Just curious,...

It's been a very long time, but only one you allow to be memory resident and scan incoming files. The other you only run on demand to scan the files on the hard drive. If both are memory resident and always actively scanning, then yes, you'd have issues.

Lifeisabeach · Apr 20, 2012

technologist said:
On the other hand, the anti-malware companies aren't much better. Flashback was spreading in the wild several days before most anti-virus vendors were able to offer any protection.

And that ultimately is the catch. No AV software will be able to defend against malware the moment it is released. It will take time for it to get someone's attention as it spreads, then for them to analyze it and release an update. Most AV software try to minimize this risk by analyzing behavior, but that's gotta be a drag on the system and prone to false warnings. Personally, I've decided to stick with running ClamXav once a week in the middle of the night as a "second opinion", but otherwise leave it to "safe" computing practices and Apple's own defenses. Come Mountain Lion, with the new Gatekeeper feature, sticking to the option to only allow signed applications should eventually prove to be adequate on its own once the developer community is on board with it and update their software.

Stanley · Apr 20, 2012

Some people are very, very risk-averse.

Some get very worked up after experiencing FUD (fear, uncertainty, and doubt) marketing tactics.

I am still trying to get a neighbor to update her PC antivirus. Her old school solutions slow her computer way, way down. But she feels safe with the bogging down "because that means it found something and is protecting me". It can take her five minutes to open an email program and get the latest emails.

It may be awhile! Both for her to get her work done, and for me to gradually update her.

But in the meantime she is happy and that is the main thing. She has a technology solution that works for her.

z3braman · Apr 20, 2012

mac anti anything (e.g., virus)

So it isn't the PC or OS that we are now concerned with. The designers are having success pretending to be you. Under windows it was due to the myriad of security holes that were exploited. Now, irrespective of OS, the system gains access to privileged services and starts sending your data out to the web.

So the question is where is the breach and what is to be done about it. Is fixing the problem on a mac the same as on windows? In other words, is it because the legacy vulnerabilities get passed on due to built in legacy support or is due to third party apps opening ports?

Running macros in Word on PCs has always been a dangerous proposition since Word could control the PC. Does the mac have the same problem? If it was java that opened the door why is a mac any different?

I think the antimalware vendors are making money off this. Does that mean they are fanning the flames?
I guess this is more of additional questions than any answers.

Cozmot · Apr 21, 2012

chas_m said:
I continue to maintain that an "anti-virus" for the Mac is unnecessary. Yes, some third-party essentials that are included (or in the case of Java, not included as of Lion) in OS X can be vulnerable to malware. And yes, the so-called "anti-virus" programs may catch these faster than Apple.

I still don't think the trade-off is ultimately worth it, however. There has yet to be a malware threat to the Mac that wasn't comically easy to avoid, and for all the hype this latest malware got -- the servers it was supposed to report it got shut down early on, meaning even those who were "infected" didn't actually have anything happen to them other than that. I would call that "overblown."

Java is rarely used on the Mac anymore (at least via the web browser), so for most people I'd say simply turn it off and see if you don't need it (the final "fix" from Apple essentially does that already). Most of the infected machines, from what I've read, were running outdated software. For them, you need to disable Java period full stop until you update to a more modern system.

I think good computing practices will go a lot further towards keeping you out of trouble than an "anti-virus." While Flash and Java have been compromised, I notice that neither of those things are parts of OS X, so I still have great confindence in it.

I couldn't agree more. Keep in mind that Windows PCs with AV software get malware too. Most AV software interferes with the OS, slows it down, makes some programs uninstallable, etc. Sensible and informed computing practices will keep your Apple devices malware free.

chas_m · Apr 21, 2012

Thanks, Cozmot.

I've also mentioned elsewhere (but not here, apparently) that if you are running Snow Leopard or Lion, you are already running anti-malware software (called XProtect) -- it's baked right into those systems, and updated silently so you won't see anything in Software Update about it.

For reasons not known to me, the Java exploit could not be dealt with by XProtect, but rest assured it is already, automatically, stopping other (earlier) Flashback variants and other bad stuff. If Apple learned anything from this latest scare, it would likely be that they need to do better about a) eliminating dependencies on shaky third-party software (Flash, Java) and b) no more napping on the job for the XProtect people (who have traditionally been a little slow to update the program).

In short, however, that's all the anti-malware I think I need, thanks. I guess there's no real harm in running other anti-malware programs if you want, but I'm gonna stay barefoot for a while longer I think.

Larry H · Apr 21, 2012

My Mac Mini has been in service since Nov 09 without any AV program. With all the discussions of to run or not to run AV, I decided to download ClamXav and scan my computer.

Program downloaded, entire computer scanned. Nothing found.

I also did the check for Flashback prior to the Apple fix, and found nothing there either. I have disabled Java. I did apply the Apple fix.

At this point, I don't think I need to worry about viruses, or malware, but I will maintain vigilance and perhaps scan weekly or monthly.

Thanks to all the forum experts who have offered opinions.

Fisher85 · Apr 21, 2012

My two cents is that no matter what kind of machine, be it PC or Mac, if it's connected to the Internet, you should have some form of AV protection running. The more popular Macs become, the higher the likelihood that new viruses will appear for Macs.....these Trojans that have been reported are just the beginning.

Eventually, a Mac will be just as vulnerable to a virus as a PC is. Heck, I care not what anyone says, but I DO have AV running on my MacBook Air. Better safe than sorry

chas_m · Apr 22, 2012

Fisher85 said:
The more popular Macs become, the higher the likelihood that new viruses will appear for Macs.

Eventually, a Mac will be just as vulnerable to a virus as a PC is.

I know you're just repeating stuff you've been told, so I don't blame you ... but I am so very, very tired of this long-discredited nonsense.

On the first point:
The Mac Malware Myth — RoughlyDrafted Magazine

On the second point: Anyone who knows *anything* about UNIX knows this is pure ... um, malarkey.

Since it evidently bears repeating, here it is again:

1. MALWARE ≠ VIRUS.
2. There are still no viruses on the Mac. None. Zip. Zero. Nada. Nil.
3. The two big malware exploits that have affected the Mac so far were based on FLASH (not made by Apple) and JAVA (not made by Apple). Security problems in Java (which have been very well-documented) was one of the leading reasons Apple opted not to include it by default in Lion, and (again well-documented) security problems in Flash was one of the reasons it was not included in iOS and was discontinued (by Adobe) for the mobile platform entirely.

So now you know. And knowing is half the battle!

Ctrl-Opt-Del · Apr 26, 2012

I've never understood why it isn't possible to put anti-virus software on all the web servers in the world & protect all computers - be they Windows PC, Mac, or any other flavour of machine - from viruses at the source of the infection...

chas_m · Apr 26, 2012

Ctrl-Opt-Del said:
I've never understood why it isn't possible to put anti-virus software on all the web servers in the world & protect all computers - be they Windows PC, Mac, or any other flavour of machine - from viruses at the source of the infection...

This is a good question. Sadly, it has a few answers:

1. There is no such thing as an anti-virus program that is 100 percent effective.

2. New malware and viruses are being created all the time. An anti-virus can't stop something it's never encountered before.

3. A lot of Windows malware/viruses are disguised so that the owner has very little clue that they have one or that it is doing anything. That's why I laugh at those Windows owners who claim they don't run anti-virus and "have never had problem." THOSE are the people behind the bot-nets, the zombie attacks, the DDoS attacks, etc.

I could go on, but you get the picture ...

Should i use an Anti-Virus

osxx

AliOop

TBABill

Holly21

Lifeisabeach

chas_m

Guest

Lifeisabeach

Brunhild

technologist

Lifeisabeach

Lifeisabeach

Stanley

z3braman

Cozmot

chas_m

Guest

Larry H

Fisher85

chas_m

Guest

Ctrl-Opt-Del

chas_m

Guest

Shop Amazon