Posts Tagged ‘antivirus’

Apple Snow Leopard Security Criticized

Tuesday, September 1st, 2009

Apple Snow Leopard Security Criticized

Mac users are getting new security features with the arrival of Apple’s Mac OS X 10.6, but some security vendors say those enhancements are lightweight.

The release on Friday of Apple’s Mac OS X 10.6, known as “Snow Leopard,” has elicited criticism from security companies, which may have business to lose if Apple’s latest operating system reduces interest in third-party security software.

Snow Leopard includes several security enhancements. According to Apple, Snow Leopard supports 64-bit applications, which the company claims are more secure than 32-bit applications because of the way the operating system handles function-passing. Mac OS X 10.6 also includes hardware-based execution control for heap memory, stronger checksums for preventing memory corruption attacks, and antivirus capabilities.

Symantec, a leading maker of security software, says Snow Leopard’s File Quarantine feature only offers basic malware protection. “It is not a full-featured antivirus solution and does not have the ability to remove malware from the system,” the company said in an e-mailed statement. “File Quarantine is also signature-based only. Malware signatures are only as good as the definitions, requiring Apple to provide regular, timely updates.”

Symantec also notes that Mac OS X’s Software Update mechanism is not fully automatic and lacks a user interface to see which signatures have been downloaded.

Symantec also observes that Apple’s security enhancements do not protect against unauthorized access to sensitive files or block the transmission of sensitive information, like Norton Internet Security for the Mac. The company also says that Mac OS X’s firewall is turned off by default and isn’t as configurable as its product.

Symantec adds that Apple’s reliance on lists for phishing protection isn’t wise because phishing site lists become out-of-date quickly.

Symantec’s criticism of Apple’s efforts stands in contrast to the response of AVG when Microsoft said it would offer free security software, Microsoft Security Essentials, with Windows. In June, J.R. Smith, CEO of AVG, said that Microsoft’s offering would be good for consumers and good for the security market overall because it would raise awareness that security products are necessary.

(more…)

ZoneAlarm updates Extreme Security suite to handle new kinds of threats

Tuesday, September 1st, 2009

ZoneAlarm updates Extreme Security suite to handle new kinds of threats

About 10 million Americans were victims of identity theft last year, about 22 percent more than the year before. Those are always good numbers to trot out when you’re introducing a new security software suite.

Check Point’s Zone Alarm division is refreshing its Zone Alarm Extreme Security Suite today. The software has more than a dozen components aimed at protecting users from viruses, identity theft, spyware and all sorts of other malware. The changes to this year’s software reflect the evolving nature of threats.

extremeCheck Point Software Technologies, a publicly traded software firm, bought Zone Alarm six years ago. Back then, the company had firewall software that offered basic protection for a computer. This year’s firewall offers 90 percent fewer alerts — meaning it raises fewer false alarms — than last year’s. Zone Alarm now protects more than 60 million computers. But a firewall isn’t enough anymore.

With so many different things to protect against, security software companies are moving to layered defenses. Some of them block threats automatically, while some have to detect patterns of behavior and then act based on the likelihood of a threat or a false alarm. The basic antivirus software protects your email against known threats such as Conficker. Firewalls block malicious programs while allowing authorized communications.

But that’s not enough. While emails once delivered most of the threats, now you can get infections just by going to the wrong web sites. A virus dubbed Gumblar appeared in February that can attach itself to Adobe PDF files and infect a machine upon being downloaded. You don’t have to click on an email or do anything at all.

ZoneAlarm has virtualization software to deal with such attacks. It can create an independent partition within your computer’s hard drive and place suspicious files in it. If a download is not authorized by a user and happens automatically, ZoneAlarm’s Force Field software places it in a partition where it can be isolated. ZoneAlarm has also added “advanced download protection.” That screens user-approved downloads and isolates them. It checks against its own records and then offers advice on whether to warn the user or not.

(more…)

New virus infects programs built with Delphi

Wednesday, August 19th, 2009

New virus infects programs built with Delphi

Researchers said on Tuesday that they are seeing something unusual in the malware world–a virus that targets a development environment.

The virus, dubbed Win32.Induc, was written to infect applications built with Delphi, according to Nick Bilogorskiy, manager of antivirus researcher at Sonicwall. Delphi is used to write Windows programs, including database applications.

When an infected program is run on a machine running Delphi, the virus infects any software that gets compiled on that machine. The virus spreads the executable file of itself as well as the source code. It looks for a compiler on the infected system and re-compiles the source code, inserting its code into any programs compiled on the system.

“This malware just spreads; it doesn’t delete files or do anything malicious,” he said. “But if you create software and you have this code in it, the software will be blocked by antivirus (technology).”

(more…)

Eliminating a Word Macro Virus

Tuesday, August 18th, 2009

Eliminating a Word Macro Virus

A reader who wishes to remain anonymous has acquired a Word cootie and is at a loss as how to deal with it. Anonymous Person writes:

My copy of Microsoft Office 2004 seems to have picked up a virus, or some such thing. I’ve used McAfee’s Virus Scan for Mac to clean one of my Macs, but don’t have that available for the other three affected Macs (one of them still has Word X for Mac). The virus shows up as W97M/Thus.gen. Although our own Office programs seem to function just fine, Office documents show up on non-Macs as having a virus. This has become quite a problem.

You’ve managed to acquire a Word macro virus. Dealing with it is a two-step process. First, you need to clean the documents you have, and next, prevent further infections.

Because you have an antivirus application on hand, I’d suggest you take all your Word documents, bung ‘em into a folder, copy that folder to the Mac that has the antivirus applications, and run them through the application to clean them. When you’re certain that they’re clean and that they open as they should, delete the originals on the other Macs.

Before copying them back to the other Macs, open Word on each of these Macs, select Preferences from the Word menu, and in the resulting window, select Security. In the Macro Security area of that window, enable the Warn Before Opening a File That Contains Macros option. With this option enabled, any time you open a Word file that contains a macro, you’ll be given the option to enable or disable those macros. If you weren’t expecting a document to contain a macro (indicating it’s probably infected), open it after disabling macros and then copy and paste its contents into a new document. This will remove the macro virus from that document. Then trash the original, infected file.

(more…)

AVG antivirus update attacks Apple’s iTunes

Tuesday, July 28th, 2009

AVG antivirus update attacks Apple’s iTunes

A database update from AVG over the weekend made the Windows antivirus software attack users’ iTunes installations, mistakenly viewing the application’s library files as a Trojan virus and placing them in quarantine.

After the update was released, numerous users began voicing their complaints on Apple’s support forums and AVG’s official forums. AVG responded by releasing a new database update that fixes the problem.

“Unfortunately, a recent virus database update resulted in iTunes being detected as a Trojan by AVG security products,” the company wrote. “We can confirm that it was a false alarm. AVG immediately released a new virus database update (definition file 270.13.29/2260) that corrected this issue.”

With the update, AVG would recognize iTunes DLL files in Windows as infected with the “Small.BOG” Trojan virus. After the files were quarantined, iTunes would not run.

One user on the AVG forums said they tried to reinstall iTunes, but AVG recognized all of the application’s localization DLL files as threats. Others said their antivirus software saw an iTunes update as a virus.

(more…)