Deleted my Anti-Virus

[MrRiplEy[H]]

malware on windows does not silently install, it requires user interaction. If someone emails me a virus, I do not get infected by opening the email. I must first open the attachment, then depending on the level  of UAC settings it may install with or without prompts. You're confusing a worm with malware.

And for all the rarity you claim of macdefender applecare appears to be flooded with calls from infected users.

Finally some mac users are reporting it is phoning home. That my friend is a perfect example of a malware payload.

Sorry but there are a gazillion malwares which silently install on windows through browsers, especially through IE. The user doesn't have to go through a several step standard GUI installation. Situation is a little bit better on w7/Vista where the user might get an UAC prompt all by sudden which he can guess might not be valid but no indication an installation is in process and only if the user has left UAC on. Many haven't.

Macdefender is automatically loaded by the Safari browser if the 'run safe attachment automatically' option is on in Safari. It automatically extracts the zip file which will then execute a .dmg installation package. The user will then have to click through a standard installation procedure. At any time the user can stop the install and even after installation the removal can be done like to any regular program.

Those reports of apple care being 'flooded' are sensationalist exaggerations coming out of mac haters such as a certain few on this forum

And no, I'm not confusing a worm with malware.

[Vulcan]

Sorry but there are a gazillion malwares which silently install on windows through browsers, especially through IE. The user doesn't have to go through a several step standard GUI installation.

Be interested to see an example of malware which does not require a user to click on something, open something, or run something on the Windows platform within the last 5 years.

[MrRiplEy[H]]

Be interested to see an example of malware which does not require a user to click on something, open something, or run something on the Windows platform within the last 5 years.

http://www.h-online.com/security/news/item/Exploit-for-new-Flash-vulnerability-spreading-fast-1019485.html

All you need to do is view a video and rest is automatic. x86 code execution on runtime and rest is history

With this kind of holes in the open I'm pretty satisfied with having 20 exploits in the wild vs 2 million. Odds are stacked heavy in my favour not to get hit by one.

More info on drive-by downloads and installs at http://www.malware-info.com/mal_faq_inject.html

[Vulcan]

http://www.h-online.com/security/news/item/Exploit-for-new-Flash-vulnerability-spreading-fast-1019485.html

All you need to do is view a video and rest is automatic. x86 code execution on runtime and rest is history

With this kind of holes in the open I'm pretty satisfied with having 20 exploits in the wild vs 2 million. Odds are stacked heavy in my favour not to get hit by one.

More info on drive-by downloads and installs at http://www.malware-info.com/mal_faq_inject.html

Well, first you have to download and open the PDF. So your example fails right there.

[Vulcan]

and lets have a look at the CERT notes for the exploit:

A critical vulnerability exists in Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh and UNIX operating systems. This vulnerability (CVE-2010-1297) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat.

So in summary...
you have to download the PDF
you have to open the PDF
the vulnerability is multi platform including Mac OS X

How would this flow in the real world... on a typical Windows system these are your security mechanisms on order of prevention:
 - AV signature spots malware and isolates download
 - AV prevents execution from TEMP directory
 - DEP prevents exploit (Win XP SP2 on)
 - UAC prompts user for app installation

On a typical Mac system
 - DEP prevents exploit
 - user prompted for app app installation

The last two mechanisms are debateable though. DEP on Safari has proven easy to circumvent ( http://appleheadlines.com/2011/03/10/apple-safari-browser-gets-hacked-in-5-seconds/ ) and I'm sure the same applies for other OS's (these guys reckon they can get passed Chrome easily) - and users... well no explanation necessary.

So... as I already noted the exploit is not as silent at getting into the system as you think, and exploitable on an OS X system with typically less security mechanisms in place to prevent infection.

[MrRiplEy[H]]

Well, first you have to download and open the PDF. So your example fails right there.

You didn't even read the link. It's a FLASH vulnerability meaning any website with a malicious code injected flash advertisement will infect your computer. Your only protection is to prevent flash video from loading at all.

UAC and antiviruses can and will be bypassed with ease. It has happened a million times and will happen again. Most people who get infected actively use antiviruses.

So, every system can be bypassed and infected. Linux/Mac have perhaps 20 active infections in the wild vs 2 million for windows. You'd have to win the lottery to run into one online.

[Vulcan]

You didn't even read the link. It's a FLASH vulnerability meaning any website with a malicious code injected flash advertisement will infect your computer. Your only protection is to prevent flash video from loading at all.

I did read the link, as well as the secondary link on that page that describes how the exploit is used via a PDF which is needed to provision the exploit properly. Just a plain flash video with the exploit will result in a flash player crash with no security impact.

Looks like you didn't even read the link thoroughly.

[MrRiplEy[H]]

I did read the link, as well as the secondary link on that page that describes how the exploit is used via a PDF which is needed to provision the exploit properly. Just a plain flash video with the exploit will result in a flash player crash with no security impact.

Looks like you didn't even read the link thoroughly.

The link was just one of the daily new flash exploits, there is no need for pdf or user interaction. It's a drive-by infection.

A drive-by download attack refers to the process of a user visiting an infected page and subsequently gets installed with malware, without his/her knowledge and without having him/her to click on or to agree to anything. Our previous post on HDD spreading itself via malvertising is a typical example of this type of threat.

http://blog.armorize.com/2011/04/newest-adobe-flash-0-day-used-in-new.html

[Vulcan]

The link was just one of the daily new flash exploits, there is no need for pdf or user interaction. It's a drive-by infection.

http://blog.armorize.com/2011/04/newest-adobe-flash-0-day-used-in-new.html

Once again the infection needs to be carried inside something else carrying the payload: http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx

(note this is an analysis of an actual in the wild infection, not some "we think this is how it happens", even so your example notes it as a "drive-by cache is used instead of drive-by download".

[MrRiplEy[H]]

Once again the infection needs to be carried inside something else carrying the payload: http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx

(note this is an analysis of an actual in the wild infection, not some "we think this is how it happens", even so your example notes it as a "drive-by cache is used instead of drive-by download".

Drive-by infections are a daily fact of life. Even many members of AH forums have been exposed to them. I find pretty dumbfounding that you try to deny their existence considering last forum member reported of such just a couple weeks ago.

You can't deny that a windows user has a 2 000 000 to 20 higher chance of ever landing to an infected site or infected file compared to a Mac or Linux user. In fact the ratio is even more jilted since there are multiple copies of the 2 000 000 variants running wild. You can't deny that running advanced heuristics will eat a lot of cpu power and doing network filtering will cause net lag and unexpected behaviour. You can't deny that the higher detection rate a heuristic system has, the more false positives it will create and stop even legit programs from working as expected - and the fact that when ensuring compatibility it means letting some viruses slip past.

You can't deny there is no antivirus software ever built that could stop all the viruses, 0-day or even known ones.

So, you can choose to wear a flakjacket and a helmet and go running in front of a firing squad or choose to wear a hawaian shirt and go to places where there's practically no shooting at all. I prefer to dress light.

http://en.wikipedia.org/wiki/CoolWebSearch

[LThunderpocket]

your best anti virus would to stay away from porn

[guncrasher]

your best anti virus would to stay away from porn

skuzzy mentioned in another thread about a banking webpage being infected.

semp

[LThunderpocket]

skuzzy mentioned in another thread about a banking webpage being infected.

semp

ive heard that "mycleanpc.com" speeds up your computer only to crash within the next few days cause of a super virus that speeds it up past what your computer can handle.but it might not be true.

[guncrasher]

ive heard that "mycleanpc.com" speeds up your computer only to crash within the next few days cause of a super virus that speeds it up past what your computer can handle.but it might not be true.

mycleanpc.com has so many bad reviews, I wouldnt even bother to go their website.  even wot has it redflagged. 

semp