🚀 go-pugleaf

<user@ouija.demon.co.uk> wrote:

> Hello all,
> My place of work is mainly PC based, and the studio i work in is the
> only place that Macs prevail. 
> We've been asked to ensure that our small Mac network is fully
> protected against virus attacks. 

The only way to do this is make sure that the Macs are never turned on.
There's no other way of *fully* protecting a computer against virus
infection.

> I'd like some real world answers
> please. 
> How many Mac viruses exist? 

From the `Viruses and the Mac FAQ':

> 6.0  How many Mac viruses are there?
>      -------------------------------
> 
> There are around 35 Mac-specific viruses that I know of, though
> Apple are, I've heard, quoting 2-300 hundred. I don't know if
> these include every minor variant, Trojans, HyperCard infectors
> and other macro viruses. However, since Apple are not noticeably
> in the business of virus detection and disinfection, I'd as soon
> go with the estimates of those who are.
> 
> Mac users with Word 6 or versions of Excel supporting Visual
> Basic for Applications, however, are vulnerable to infection by
> macro viruses which are specific to these applications. Indeed,
> these viruses can, potentially, infect other files on any
> hardware platform supporting these versions of these
> applications. I don't know of a macro virus with a Mac-specific
> payload that actually works at present, but such a payload is
> entirely possible.
> 
> Word Mac version 5.1 and below do not support WordBasic, and are
> not, therefore, vulnerable to direct infection. Not only do these
> versions not only understand embedded macros, but they can't read
> the Word 6 file format unaided. There is, however, at least one
> freeware utility which allows Word 5.x users to read Word 6 files.
> This will not support execution of Word 6 (or WinWord 2) macros
> in Word 5.x, so I would not expect either an infection routine or
> a payload routine to be able to execute within this application.
> 
> However, Word 5.x users may contribute indirectly to the spread of
> infected files across platforms and systems, since it is perfectly
> possible for a user whose own system is uninfectable to act as a
> conduit for the transmission of infected documents, whether or not
> s/he reads it personally.
> 
> Files infected with a PC-specific file virus (this excludes macro
> viruses) can only execute on a Macintosh running DOS or DOS/Windows
> emulation, if then. They can, of course, spread across platforms
> simply by copying infected files from one system to another.
> 
> DOS diskettes infected with a boot sector virus can be read on a
> Mac with Apple File Exchange, PC Exchange, DOS Mounter etc. without
> (normally) risk to the Mac. However, leaving such an infected disk
> in the drive while booting an emulator such as SoftPC can mean that
> the virus attempts to infect the logical PC drive with unpredictable
> results.
> 
> I am aware of at least one instance of a Mac diskette which, when read
> on a PC running a utility for reading Mac-formatted disks after
> being infected with a boot-sector infector, became unreadable as
> a consequence of the boot track infection.

A new Mac virus (actually technically a worm, not a virus; not that this
really matters) has just appeared, and the author of Disinfectant has
more-or-less simultaneously decided to stop developing Disinfectant.

The new problem program is this:

> Virus: Autostart 9805
> Damage: Adds invisible files to every disk partition and periodically
>       causes extensive disk activity (and network activity if
>       network disks are mounted).  Will overwrite some data files
>       with random data.
> Spread: PowerPC systems running the MacOS or later 
>       and with mounted HFS or HFS+ volumes.  Initial infection
>       usually requires QuickTime 2.0 or above installed.
>       
> ====
> 
> Autostart-9805 is technically a worm program.  It does not change any
> existing program or file to spread itself.  Instead, it copies itself
> to other disk partitions so that it becomes active on other systems.
> 
> The first reported appearances of this software were in Hong Kong, and
> it has spread very rapidly among the desktop publishing (DTP)
> community there.
> 
> The worm can be transmitted via almost any HFS or HFS+ disk volume,
> including floppy disks, most removable cartridges drives, MO disks,
> CD-WORM disks, hard disks and even disk images.  The code requires a
> PowerPC-based system running MacOS -- a 68K-based system will fail to
> run the code.  The worm will also spread across networks to any
> mounted network file partition.

> Has anyone had one?

Some people have.  In the four years I've had a Mac, in which time I've
downloaded several gigabytes of data, I've never met a virus.  Note that
I've got nothing that can execute Word macro viruses (or similar), nor
do I exchange files other than over the 'net.

> What professional antivirus software can we buy to give excellent
> protection to the network (3 macs)? Must include regular virus
> definition updates preferably on disk.

The author of Disinfectant recommends one of these:

   Anti-Virus Toolkit. Dr. Solomon's.
   SAM. Symantec.
   Virex. Dr. Solomon's.
   VirusScan for the Mac. Network Associates.

Because I'm using a 68K Mac, and I've got no worries about macro
viruses, I'm sticking with Disinfectant and the even more out-of-date
Gatekeeper.  If I had a PowerMac, I'd be buying one of the above.  I've
tried a demo of Virex and I was *very* unimpressed with the
documentation, user interface, and so on.  This has no direct
relationship to its ability as a virus checker, but I'm inclined to the
idea that if the firm can't be bothered to pay attention to the docs and
user interface, then it's probably equally sloppy with the functional
code.  I once used Macs protected with SAM, and that struck me as much
`smoother'; it's been around for several years (at least 8 or 9; I first
met it in 1989/90)

> I thank you for taking the time to read this and for any replies.
> 
> Sick of SPAM! All email to "user" will be deleted not read! Please replace
user with my name thankyou.

If you want an email reply, use your real email address in your news
header.

Rowland.

-- 
Remove the animal for my email address:   rebecca@astrid.dog.u-net.com
Sorry - the spam got to me.                       PGP pub key A680B89D
UK biker?                    Join MAG and help keep bureaucracy at bay
                          http://dredd.meng.ucl.ac.uk/www/mag/mag.html