Apple support told not to assist in removal of malware

[The Pontificator]

http://www.zdnet.com/blog/bott/apple-to-support-reps-do-not-attempt-to-remove-malware/3362?tag=content;feature-roto

While technically this issue is not exactly related to a security flaw in OS X or Safari, there is something to be said for TAKING THE HIGH ROAD instead of brushing it off as "not our problem".

Apple has a golden opportunity to play the hero and they're going to blow it.

All they have to do is post information on their support page with instructions on how to remove the malware and prevent safari from auto-opening downloaded attachments. Evidently this is too much to ask.

An otherwise great company appears to have taken a giant step backward in public relations and customer service.

[Bandit Bill]

Apple is not "brushing the customer off". AppleCare just doesn't cover the removal of malware or viruses. Unless Apple starts making their own virus/malware protection software, they do not make product recommendations either.

We will see how this plays out. If you read the Apple internal document, it says to handle the call with these guidelines. That doesn't mean that Apple won't help you out or make future changes. Apple has to draw a line as to what is or is not covered by AppleCare, however, it's not always so black and white, this is why they use the word guidelines.

Apple should at least have "open "safe" files after downloading" unchecked (instead of checked) by default within Safari. They should include this with the next security update.

Apple will direct the user to information about malware. They will also direct the person to the App store, where they themselves can decide what third party apps they may want to install to protect themselves/remove malware/viruses etc.

http://docs.info.apple.com/article.html?path=Mac/10.6/en/27449.html

https://support.apple.com/kb/HT2128

Apple can aim to educate users, but they can not fully protect users from their own stupidity.

Quote from Apple
"Avoid opening items downloaded from websites and email messages unless you are certain that they come from a legitimate, trusted source. If you are uncertain about the source of a downloaded item, it is best to delete the item. You can always download it again later, after you have made certain that the item is not malware."

Has anyone who has been effected by Mac Defender followed this advice? I think not. In the case of Mac Defender the user didn't manually download it, but they certainly typed in their admin password to install it.

[The Pontificator]

I looked at both ClamX AV and Sophos Anti-Virus Home Version (both free) and am considering Sophos.

Anyone have any experience?

[swordsandtequila]

[The Pontificator]

A couple of years ago there was another Mac malware disguised as a video codec (OSX Jahlav-C). Like the current crop of malware, Jahlav-C was a social engineering scam. I don't think it automatically force-downloaded something to one's downloads folder, though.

But what we are seeing are incremental leaps in sophistication.

For now, I'm content to be on my toes and not download or give root permission to install anything I haven't check out beforehand.

Knowing that AV programs can often cause more headaches than cures, I need to see more on Sophos home version before installing it.

[The Pontificator]

Here is a review of Sophos that goes over each and every feature:

http://www.securemac.com/sophos-anti-virus-review.php