• Welcome to the Off-Topic/Schweb's Lounge

    In addition to the Mac-Forums Community Guidelines, there are a few things you should pay attention to while in The Lounge.

    Lounge Rules
    • If your post belongs in a different forum, please post it there.
    • While this area is for off-topic conversations, that doesn't mean that every conversation will be permitted. The moderators will, at their sole discretion, close or delete any threads which do not serve a beneficial purpose to the community.

    Understand that while The Lounge is here as a place to relax and discuss random topics, that doesn't mean we will allow any topic. Topics which are inflammatory, hurtful, or otherwise clash with our Mac-Forums Community Guidelines will be removed.

Ransomware

Joined
Oct 16, 2010
Messages
17,542
Reaction score
1,576
Points
113
Location
Brentwood Bay, BC, Canada
Your Mac's Specs
2011 27" iMac, 1TB(partitioned) SSD, 20GB, OS X 10.11.6 El Capitan

Rod


Joined
Jun 12, 2011
Messages
9,704
Reaction score
1,892
Points
113
Location
Melbourne, Australia and Ubud, Bali, Indonesia
Your Mac's Specs
2021 M1 MacBook Pro 14" macOS 14.4.1, Mid 2010MacBook 13" iPhone 13 Pro max, iPad 6, Apple Watch SE.
I noticed, however I have installed it on my 2010 MacBook because it's running High Sierra (as high as it can go) and being unsupported it needs as much protection as it can get.
It certainly uses very little of system resources. Less than 0.2% CPU.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
What is "RansomWhere"? Is that "where" the ransom is? :goofy

It's "ransomware" guys.
 

Rod


Joined
Jun 12, 2011
Messages
9,704
Reaction score
1,892
Points
113
Location
Melbourne, Australia and Ubud, Bali, Indonesia
Your Mac's Specs
2021 M1 MacBook Pro 14" macOS 14.4.1, Mid 2010MacBook 13" iPhone 13 Pro max, iPad 6, Apple Watch SE.
It's the name of the Utility, I'm sure you knew that Chas.:D
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Just teasing you and Patrick. I figured Patrick was asking for ransom but didn't know "where" it was. :p

By the way, that small utility "RansomWhere" seems to run in the background similar to that of a real time virus checker that's resident. At least that's what I got from reading the description.
 

Rod


Joined
Jun 12, 2011
Messages
9,704
Reaction score
1,892
Points
113
Location
Melbourne, Australia and Ubud, Bali, Indonesia
Your Mac's Specs
2021 M1 MacBook Pro 14" macOS 14.4.1, Mid 2010MacBook 13" iPhone 13 Pro max, iPad 6, Apple Watch SE.
By the way, that small utility "RansomWhere" seems to run in the background similar to that of a real time virus checker that's resident. At least that's what I got from reading the description.
Yep, once installed it's essentially invisible, the only place I can find it is in Activity Monitor. Possibly why they advise keeping the Installer for Uninstall if required. After it's initial scan it settled down to 0.1% CPU.
 
Joined
Aug 29, 2009
Messages
142
Reaction score
33
Points
28
Location
New York City
Your Mac's Specs
2021 M1 Mini, 2020 MacBook Air
I keep a bootable clone in my desk drawer, and refresh it once a week, as my insurance against ransomware. Easy for me and my one Mac, but in a large corporation, backing up every one of hundreds (or thousands) of desktop and laptop computers, and whatever central servers are in use, is a huge logistical problem. Do you hand an external drive to every single user, with instructions, and hope for the best? Send out the IT guys every week, to visit every computer user, to do the job for them? A centralized backup system has to be kept off-line to be immune from ransomware, so how do you do that while also backing up via the network?

100% of these attacks start out by spearphishing a gullible employee. What I'm seeing more and more frequently are company computers being locked down, so the user can't install any software at all. Often, the USB ports are disabled as well, and MS Office is blocked from executing macros. Email attachments are heavily scanned, and users just have to live with a sluggish email system. (Merck did this after getting slammed a couple of years ago, by the same malware that crippled Ukraine and Britain's hospitals.)
 
Joined
Jan 1, 2009
Messages
15,512
Reaction score
3,876
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
I keep a bootable clone in my desk drawer, and refresh it once a week, as my insurance against ransomware. Easy for me and my one Mac, but in a large corporation, backing up every one of hundreds (or thousands) of desktop and laptop computers, and whatever central servers are in use, is a huge logistical problem. Do you hand an external drive to every single user, with instructions, and hope for the best? Send out the IT guys every week, to visit every computer user, to do the job for them? A centralized backup system has to be kept off-line to be immune from ransomware, so how do you do that while also backing up via the network?

100% of these attacks start out by spearphishing a gullible employee. What I'm seeing more and more frequently are company computers being locked down, so the user can't install any software at all. Often, the USB ports are disabled as well, and MS Office is blocked from executing macros. Email attachments are heavily scanned, and users just have to live with a sluggish email system. (Merck did this after getting slammed a couple of years ago, by the same malware that crippled Ukraine and Britain's hospitals.)
Wrong approach. I ran a data center with multiple central servers and 4000+ users. Didn't back up the individual machines, just told the users to do so. Backed up the central servers daily, keeping daily, weekly, monthly and quarterly backups both onsite and offsite. If a user complained about their machine not working right and no backup, we just reinstalled the approved image to their drive and they started again. Lost documents? Not IT's problems, clearly spelled out that backups were the individual employee responsibility. Failing to do so and causing business issues was cause for dismissal. Not three strikes, one and done, goodbye. All of this was covered in the employee orientation and in an annual required training that would not let the employee log into their machine until the training was completed and logged in.

I read the report from the pipeline CEO. I think he overreacted but I wasn't there. From what I read, he was concerned about how far the ransomware went. The pipeline could have been run manually, IMHO, but as I said, I wasn't there so maybe there was more of a problem than just losing billing.
 
Joined
Aug 29, 2009
Messages
142
Reaction score
33
Points
28
Location
New York City
Your Mac's Specs
2021 M1 Mini, 2020 MacBook Air
clearly spelled out that backups were the individual employee responsibility

Small consolation when mission-critical docs go missing. If there's a litigation hold on records, and they go "poof", you're on the hook for what might be a 7- or 8-figure sum. Don't know where you worked, but in big pharma you don't leave it up to the employees.
 
Joined
Jan 1, 2009
Messages
15,512
Reaction score
3,876
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
It was a Fortune 50 IT consulting company. And it worked very well. The organization used Lotus Notes as the main tool for email and document storage, essentially all of the business, which meant that the central units stored the basic Notes databases there. The only documents for the individual consultant were her/his own documents that were work papers prior to being entered in Notes. As I said, backups of user data on individual machines were the responsibility of the employee. Backup of the central Notes servers were the responsibility of central tech management. So if an employee came in with hardware issues, the tech staff either replaced the unit or the drive and restored the approved image. Then the employee could restore from his own backups those work papers. If they didn't have a backup, they would have to redo the work. What most of us did was to work in Word or Excel, for example, and as soon as the document was saved, store it in the Notes database for that client. That way the most you could lose in a catastrophic failure would be a document "in flight." People who didn't take care of their work papers didn't tend to be there very long. I think the most I had to backup for myself was a couple of hundred meg at any one time. I tended to do my work within the Notes framework, even for draft and "thought" pieces. Just easier to do it that way. My data to backup was more along the lines of expense items, maybe some personal data about preferred hotels/restaurants/etc (I was a road warrior, on the road 48 weeks/year. I put my backups on flash cards, mostly. In the seven years I spent on the road I had one hard drive failure and one logic board failure. In both cases I was issued a new Thinkpad and sent on my way. I restored my personal data from the backup and was back in business within hours. About the only really critical information I needed was the security file I needed to log into Notes. But if that got lost, the IT guys could reset the password and make a new security file for me. Had to go through a boss to get it delivered to me, which made it awkward because I was on the road, but it never really caused any issues for me. I learned to keep multiple copies of that critical security file in different locations. There wasn't any risk to doing that because all that encrypted file got you was access to the login process for Notes, which was AFTER login to my account on the Thinkpad. So if a bad guy got the security file, it really didn't do them any good because the data on the file tied my login on my local machine to the central security for the Notes server to allow it to show the login screen, where I had to log in with a different user name and separate password.

I suspect in big pharma, as in other businesses, there are different rules, mostly because the data that may be on the machines may be more critical to projects/drugs in development. And maybe big pharma doesn't want to use a central database system like Lotus Notes, but for us, it worked extremely well. I seem to recall having about 40-50 databases, one for each client for whom I did consulting. Might have been more, it's been a while...

Bottom line, backup strategy is not a "one size fits all" proposition. The approach and tools need to be configured to fit the individual needs.
 
Joined
Jul 19, 2021
Messages
4
Reaction score
0
Points
1
To answer your questions,

your new drive will not have the ransomware,

but,

your new drive will be just as vulnerable as your original and infected drive.

Get Sophos, it's rated the best by PCMAG and MACWORLD. :)
 
Joined
Feb 1, 2011
Messages
4,435
Reaction score
2,153
Points
113
Location
Sacramento, California
Get Sophos, it's rated the best by PCMAG and MACWORLD.

I can tell you from hearing from a LOT of users that this is really bad advice.

First, I don't take Macintosh advice from Windows magazines. They don't have a clue about the Macintosh. I only take Macintosh advice from Macintosh authorities.

Second, back when Macworld was a reputable publication (before they fired their entire staff and stopped publishing a magazine), they DID NOT rate Sophos "the best". If they do now, I would not find it pursuasive, as they have totally lost all credibiliy since discontinuing their print publication. If you have read some of their recent stuff, it mostly sounds like paid advertising.

Third, while all fully interactive anti-virus software have tended to be implicated with nasty Mac slowdowns (not for everyone, and not all the time, but way too often, and when it occurs it's really serious), Sophos has been by far the worst of the offenders. I've heard from too many Sophos users to count about this. Sophos may be free, but it isn't a good deal.


In my personal opinion, fully interactive anti-virus software tends to be more trouble than it's worth.
 

IWT


Joined
Jan 23, 2009
Messages
10,292
Reaction score
2,231
Points
113
Location
Born Scotland. Worked all over UK. Live in Wales
Your Mac's Specs
M2 Max Studio Extra, 32GB memory, 4TB, Sonoma 14.4.1 Apple 5K Retina Studio Monitor
Get Sophos, it's rated the best by PCMAG and MACWORLD

Never, ever get this product. It's clumsy, hogs the CPU, slows the Mac miserably and is near impossible to uninstall.

Our forums are crowded with users who have tried Sophos and similar (eg Norton, Avast etc) and had multiple problems.

That's the warning; but I am the first to recognise these are personal choices. It's your Mac, your choice. We can only advise.

Ian
 
Joined
Jul 19, 2021
Messages
4
Reaction score
0
Points
1
Never, ever get this product. It's clumsy, hogs the CPU, slows the Mac miserably and is near impossible to uninstall.

Our forums are crowded with users who have tried Sophos and similar (eg Norton, Avast etc) and had multiple problems.

That's the warning; but I am the first to recognise these are personal choices. It's your Mac, your choice. We can only advise.

Ian

So what do you recommend? I currently use Norton.
 

IWT


Joined
Jan 23, 2009
Messages
10,292
Reaction score
2,231
Points
113
Location
Born Scotland. Worked all over UK. Live in Wales
Your Mac's Specs
M2 Max Studio Extra, 32GB memory, 4TB, Sonoma 14.4.1 Apple 5K Retina Studio Monitor
So what do you recommend? I currently use Norton.

Don't use Norton either. Same ghastly problems (I mentioned Norton in parenthesis above).

Two free apps will suffice : Intego's Virus Barrier Scanner from the App store and DetectX Swift from here: DetectX

Only run them very occasionally, NOT all the time.
These products catch the malware/ransomware/scareware things. No "real" viruses in the wild for a Mac.

Ian
 

Slydude

Well-known member
Staff member
Moderator
Joined
Nov 15, 2009
Messages
17,616
Reaction score
1,079
Points
113
Location
North Louisiana, USA
Your Mac's Specs
M1 MacMini 16 GB - Ventura, iPhone 14 Pro Max, 2015 iMac 16 GB Monterey
Good advice, Ian.

Others may disagree, but I have not used any Norton product on my Macs for about two decades. The last time I had it on one of our Macs, it turned out to be the cause of a problem that took me several days to resolve. That includes about an hour talking to a couple of very nice people at an Apple Genius Bar.
 

Rod


Joined
Jun 12, 2011
Messages
9,704
Reaction score
1,892
Points
113
Location
Melbourne, Australia and Ubud, Bali, Indonesia
Your Mac's Specs
2021 M1 MacBook Pro 14" macOS 14.4.1, Mid 2010MacBook 13" iPhone 13 Pro max, iPad 6, Apple Watch SE.
I'm in agreement with the above comments, Sophos, Norton, Avast they're all too complex and heavy handed on a system that is already well protected. Not to mention expensive, I think Sophos Home is about AU$100/year.
They all chew up CPU resources and can often cause more problems than they solve for the home user.
One thing I do spend about AU$100/year is for Express VPN. I also have RansomWhere installed and use Vivaldi Or Brave browser with their inbuilt anti tracking and ad blocking options on high.
I haven't had a ransomware attempt since 2004, before I had the above.
My experience with Norton was much the same as Ian's disastrous and hard to fix.
Like Ian I also use Intego's Virus Barrier Scanner from the App store and DetectX Swift occasionally if anything seems "odd".
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
So what do you recommend? I currently use Norton.

Welcome to our forums.

Very good advice from our membership. Consider removing Norton and instead use the products recommended by Ian in post #36.
 

Rod


Joined
Jun 12, 2011
Messages
9,704
Reaction score
1,892
Points
113
Location
Melbourne, Australia and Ubud, Bali, Indonesia
Your Mac's Specs
2021 M1 MacBook Pro 14" macOS 14.4.1, Mid 2010MacBook 13" iPhone 13 Pro max, iPad 6, Apple Watch SE.
I should add, the $100.00 I do spend on my VPN covers 5 devices, two of which are my wife's.
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top