Opinions on Norton AntiVirus 10?

In comp.sys.mac.system Verne Arase <VerneA RemoveThis @pobox.com> wrote:
> On my system, iChat is:
>
> drwxrwxr-x 3 root admin 102 Mar 1 20:31 iChat.app/
>
> which would mean I'd have to authenticate to modify it.

Unless you were running as an admin user. If so, a trojan could modify
iChat without your knowledge.

Which is why OS X users should not run as admin unless necessary.

--
K.

Lang may your lum reek.
 >> Stay informed about: Opinions on Norton AntiVirus 10? 

On Thu, 14 Feb 2008 11:03:42 -0600, Mr. Strat wrote
(in article <140220080903428671%rag@nospam.techline.com>):

>> Thus far, none of the data security officers at work has come anywhere
>> near close to justifying their recommendation. Fortunately, I have enough
>> seniority that I can get a way with that approach.
>
> Windows people just don't get it.

That's because you don't walk around with a "Kick Me" sign on your back and a
bullseye painted on your butt (which is very much like running a Windows OS).

For a Windows user, a Kevlar vest is not just a fashion statement.

For a while there, we had trouble installing a clean copy of Windows because
an install would get infected before we could get Microsoft Update to update
the machine.

I ended up bringing in a small portable LinkSys cable/dsl router to put a NAT
between the subject machine and the network.

Later, we ended up with an infestation visiting machines which ran an older
version of NAV and had stopped updating automagically. Turns out the
infestation came in using a vulnerability in that version of NAV.

The last version of NAV I ran on my Mac caused a kernel panic as I was
running installs in fink. I had to run a disk repair each time (off another
disk) since in each instance there were about 25 crosslinked files (this was
prior to HFS+ journaling).

As I recall, Symantec Tech Support wouldn't look into it because I didn't
produce a panic log.

IIRC, that version of MacOS X stored panic data in PRAM and would write it
out to disk after the system was rebooted - but I was unwilling to simply
boot that system with 25 crosslinked files and would fix it from another
disk.

The long and short of it is, Symantec Tech Support wouldn't look into the
problem - despite my giving them information about how to reproduce the
situation - and I ripped out Norton SystemWorks and all of its lovely little
pieces. (You should've seen the pile of Kernel Extensions after I was done).

Symantec has never again gotten me to purchase another piece of their Mac
software.
 >> Stay informed about: Opinions on Norton AntiVirus 10? 

On Tue, 4 Mar 2008 08:39:15 -0600, Király wrote
(in article <nadzj.62600$w57.53245@edtnps90>):

> In comp.sys.mac.system Verne Arase <VerneA.RemoveThis@pobox.com> wrote:
>> On my system, iChat is:
>>
>> drwxrwxr-x 3 root admin 102 Mar 1 20:31 iChat.app/
>>
>> which would mean I'd have to authenticate to modify it.
>
> Unless you were running as an admin user. If so, a trojan could modify
> iChat without your knowledge.
>
> Which is why OS X users should not run as admin unless necessary.

Belonging to group admin is not the same as being a MacOS X administrative
user.

AFAIK, you'd still have to authenticate.
 >> Stay informed about: Opinions on Norton AntiVirus 10? 

On Tue, 4 Mar 2008 07:56:32 -0600, nospam wrote
(in article <040320080556323564%nospam@nospam.invalid>):

> In article <0001HW.C3F2AB6B0024A95FF040E6D8 DeleteThis @news.giganews.com>, Verne
> Arase <VerneA DeleteThis @pobox.com> wrote:
>
>>> You paid for antivirus software so you can play nanny to all your
>>> Windows-using friends then.
>>
>> You don't look very professional if you send someone a document which will
>> infect his/her system.
>
> which is why you don't blindly send attachments without knowing what's
> in them. no need for anti-virus software to babysit you.

You don't understand.

I'd opened a document containing a Word Macro virus. It infected my Word
template, and I passed it on after creating a new docuemnt and sending it.

(I don't remember which version of Word I was running at the time, but it was
probably Office 98).
 >> Stay informed about: Opinions on Norton AntiVirus 10? 

On Tue, 4 Mar 2008 08:14:04 -0600, Jolly Roger wrote
(in article
<jollyroger-1DF7E6.08140304032008.TakeThisOut@earthlink.vsrv-sjc.supernews.net>):

> So don't do that. It's not like you need antivirus software to prevent
> it. Don't send attachments you don't create yourself. Problem solved -
> no antivirus software needed.

That's not how it worked - see my follow up.
 >> Stay informed about: Opinions on Norton AntiVirus 10? 

In article <0001HW.C3F4BB5C0024F858F02066D8 DeleteThis @news.giganews.com>,
Verne Arase <VerneA DeleteThis @pobox.com> wrote:

> On Tue, 4 Mar 2008 08:39:15 -0600, Király wrote
> (in article <nadzj.62600$w57.53245@edtnps90>):
>
> > In comp.sys.mac.system Verne Arase <VerneA DeleteThis @pobox.com> wrote:
> >> On my system, iChat is:
> >>
> >> drwxrwxr-x 3 root admin 102 Mar 1 20:31 iChat.app/
> >>
> >> which would mean I'd have to authenticate to modify it.
> >
> > Unless you were running as an admin user. If so, a trojan could modify
> > iChat without your knowledge.
> >
> > Which is why OS X users should not run as admin unless necessary.
>
> Belonging to group admin is not the same as being a MacOS X administrative
> user.
>
> AFAIK, you'd still have to authenticate.

If you ran as admin, you wouldn't have to consciously type in a username
*other* than your own.

If you ran without admin, you would have to supply both the username and
the password of an admin account.

The chances for error are smaller.

--
Note: Please send all responses to the relevant news group. E-mail
sent to this address may be devoured by my very hungry SPAM filter.

JR
 >> Stay informed about: Opinions on Norton AntiVirus 10? 

In comp.sys.mac.system Verne Arase <VerneA.DeleteThis@pobox.com> wrote:
> > Unless you were running as an admin user. If so, a trojan could modify
> > iChat without your knowledge.
> >
> > Which is why OS X users should not run as admin unless necessary.
>
> Belonging to group admin is not the same as being a MacOS X administrative
> user.
>
> AFAIK, you'd still have to authenticate.

Nope. Not with the example I gave. iChat is writable by the admin
group. Any process running under an admin user can modify iChat,
Safari, Mail.app, etc;, without having to authenticate.

An authentication prompt *would* pop up if the trojan's target was in
the System folder. But not an item in the Applications folder when the
user is an admin user.

Don't run unnecessarily as admin. There's no reason to.

--
K.

Lang may your lum reek.
 >> Stay informed about: Opinions on Norton AntiVirus 10?