News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon
  • Mac Security: Antivirus and Anti-malware

    Posted on Nathan Parker Comment on the AskWoody Lounge

    Home Forums AskWoody support Other platforms – for Windows wonks macOS for Windows wonks Mac Security: Antivirus and Anti-malware

    This topic contains 11 replies, has 5 voices, and was last updated by  Nathan Parker 4 months, 1 week ago.

    • Author
      Posts
    • #344770 Reply

      Nathan Parker
      AskWoody_MVP

      Someone from the AskWoody community requested more information about Mac security. I’ve decided to post a series of articles on Mac security, beginning with the poster’s main request, antivirus and anti-malware for Mac. Other articles will cover other aspects of Mac security, including firewall, password management, junk mail protection, protecting Macs from being stolen, etc.

      First of all, some Mac users believe that switching to a Mac will eliminate all the security issues they encounter on Windows PC’s, and that “Macs are secure” and “Macs don’t get viruses”.

      It’s true that Macs generally don’t have as many security issues as Windows PC’s due to the Mac using a different system architecture from Windows, the fact that Apple has increased security measures in macOS over the years, and the fact that Macs have an overall lower market share than Windows, so malware targets would rather target larger swaths of users such as Windows users. However, this does not mean that Macs are immune to security issues, and security issues with Macs are beginning to increase as Macs become more popular, as well as Apple has made a few missteps with security in recent times.

      Therefore, understanding how to be a good, secure-conscious Mac user, is important, and all it takes is a little knowledge and some common sense.

      First off, many of the same common-sense measures that Windows users use in terms of security apply to using a Mac as well, such as: not opening suspicious emails or attachments,  not clicking on suspicious links in email messages or in a browser popup, never handing over personal information to unknown sources, limit the use of browser plugins such as Flash and Java, etc. When browsing on the web and interacting with email and messaging, use the same common-sense measures that would be used on any platform, even if your Mac won’t be infected by as much malware as what is in the wild for Windows PC’s.

      Second, I recommend Mac users review this Mac security article from Apple, as it explains what security measures are built into macOS, including runtime protections and app sandboxing. When possible, it is a good idea to use apps that take advantage of sandboxing in macOS, as it means that apps have access to fewer files that could compromise the security of your Mac (all apps on the Mac App Store are sandboxed, for non-Mac App Store apps, ask the developer).

      https://www.apple.com/macos/security/

      Third, Mac users should be cautious when there’s a prompt asking the user for their administrative password (similar to the UAC prompts that begun in Windows Vista and onward). When installing or updating a legitimate application that the user initiated, it is safe to type in the password, as it is generally required. If a prompt occurs out of nowhere, think twice before handing over the password.

      Some security experts even recommend using a standard account for work, and only use an admin account sparingly for certain activities. I’ve found working day-to-day in a standard account too limiting, so I run with an admin account daily, but I also practice caution when using my Mac. Here’s an article from Intego that explains standard accounts.

      Mac Security Tip: Use a Standard User Account

      I also do recommend selecting the option to require a password for all system-wide preferences in the System Preferences pane under Security and Privacy and Advanced. Scrolling down in this article explains how to set this.

      https://www.macworld.co.uk/how-to/mac-software/how-use-system-preferences-on-mac-3515967/

      Fourth, I do recommend keeping macOS and applications up-to-date reguarly, as Apple does include security updates in macOS updates.

      There are four kinds of updates that generally occur on every Mac:

      1. Major upgrades: Upgrades to major macOS releases, such as the latest version, Mojave.

      2. Minor updates: Minor updates to major versions of macOS, such as 10.14.1, 10.14.2, etc., both which are updates to Mojave.

      3. Supplemental or Security Updates: Occasionally Apple will issue a “Supplemental Update” to resolve security issues, or issue the update specifically as a “Security Update”. When possible, Apple tries to include these in Minor updates instead of separate updates.

      4. App Updates: App updates are generally handled via the Mac App Store or the third-party app’s app update procedure. Occasionally apps are updated using the Software Update mechanism in macOS, and all system-included apps are updated in macOS Major or Minor updates.

      My general rules when installing updates are as follows:

      1. Most app updates are generally safe to install shortly after the updates are released. If in doubt, search around about the app or read message boards about the app to see if there are any issues with the app updates. I generally either allow these to install automatically, or update them shortly after released when I have a free moment.

      2. “Supplemental Updates” and “Security Updates” (which both are rare), generally are safe to and should be installed shortly after they are released. When Apple releases these, they’re generally for a secuirty update, and the sooner they are installed, the better. I’ve seldom seen issues with such updates, although it doesn’t hurt to research before installing just as a precaution.

      3. Minor updates I generally install the following Friday after they are released (most are released on Mondays), so I have the weekend to troubleshoot to ensure the updates aren’t causing any issues with my Macs. In general, I haven’t had too many issues with Minor updates, and they usually fix more issues than cause issues for me, but I’d also recommend doing a little research first to ensure.

      4. Major updates/upgrades I generally wait on and install after the first Minor update is issued for the Major update (so for Mojave, waiting until 10.14.1 was released is a recommended solution). The .1 Minor update is similar to “Service Pack 1” on Windows. By the .1Minor update, I know many of the post-release kinks have been ironed out, and I can proceed with installing. I actually broke with that convention during Mojave and upgraded sooner since upgrading to Mojave resolved an issue I was having in High Sierra.

      Installing Mac updates are easy, and Macs can be set to install updates automatically. Minor and Supplemental/Security updates used to be installed using Software Update in System Preferences, then Apple moved these to the Mac App Store after a while. In Mojave, Apple moved them back to Software Update in System Preferences. This article explains the software update procedure:

      https://support.apple.com/en-us/HT201541

      App updates are installed either through the Mac App Store (which can also be done automatically) or through the app’s updating procedure (for non-Mac App Store apps).

      Major updates/upgrades are installed through the Mac App Store, which then launches an installer to complete the process. It’s similar to going out and “buying” a new major release to Windows and installing the upgrade (just without paying for it since macOS upgrades are now free; they used not to be!) or using the Windows 10 upgrade tool to upgrade to Windows 10. It’s fairly easy to upgrade to new major macOS releases with a few clicks and a lot of downloading/installing.

      Next, I want to talk about built in anti-malware protection into the Mac. The Mac includes two security measures that work together to combat anti-malware. The first is known as “Gatekeeper”, although you won’t see an app or preference with that name. The feature is instead on the Security and Privacy, General, section of System Preferences. In newer macOS releases, there are two options: allow apps downloaded from the Mac App Store, and allow apps downloaded from the Mac App Store and identified developers. Older macOS releases offered a third option to allow apps downloaded from anywhere, which has now been removed.

      While the Mac App Store is generally a safe place to download apps since Apple has an app approval process developers must go through (although Apple has made a few slip ups before if you read Mac news), not all the apps I run are on the Mac App Store, and even  some of the ones I do run that have options on the Mac App Store I can generally qualify for better pricing off the Mac App Store (such as educational pricing and upgrade pricing, in which Apple doesn’t offer upgrade pricing on the Mac App Store), plus I can get faster updates off the Mac App Store than on the Mac App Store. While some of the apps I use are on the Mac App Store, I keep the option checked to allow both Mac App Store and identified developer apps to be installed, which allows me to easily use both types of apps.

      Identified developers have to pay an annual fee to Apple and sign their apps with a certificate verifying the application that allows Apple to “notarize” the app.

      Occasionally, I’ll run into an app from a legitimate developer who hasn’t signed their app as an identified app, in which GateKeeper throws up the error message and refuses to allow the app to launch. In this case, to override GateKeeper and allow the app to launch (this only needs to be done once), all one needs to do is hit Control when clicking the app to bring up the “right-click menu”, then click Open. There will be a prompt to allow the override. I only recommend doing this on apps you know are legitimate, and I also recommend informing app developers to become identified developers with Apple to allow future versions to be considered “notarized”.

      All the details about GateKeeper are in this article:

      https://support.apple.com/en-us/HT202491

      The other feature Apple has built into macOS that works in conjunction with GateKeeper is called XProtect, although again, it works transparent behind-the-scenes, so you won’t see an XProtect app on your Mac. When a file with known malware is clicked, Apple will prompt a similar prompt with GateKeeper, but inform you the file can damage your Mac, recommend you trash it, and offer to report it to Apple. This article from Malwarebytes explains the basics of XProtect:

      How does macOS protect against malware?

      This article from How to Geek explains how to ensure XProtect updates automatically (on Mojave, these options are under Software Update instead):

      https://www.howtogeek.com/217043/xprotect-explained-how-your-macs-built-in-anti-malware-works/

      And if you want to know what “version” of XProtect you’re running, check out this OS X Daily article:

      http://osxdaily.com/2017/05/01/check-xprotect-version-mac/

      While GateKeeper and XProtect are good built-in security measures, XProtect doesn’t always get updated quickly with new malware definitions (at times it does, but at other times, Apple has dropped the ball on updates). Therefore, I still recommend some form of antivirus and anti-malware protection for macOS.

      AppleCare Support teams personally recommend Malwarebytes for Mac. I’ve used the free version for years, and I’ve been testing the Premium version for a few months, and so far so good. One thing to note, however, is Malwarebytes Premium for Mac doesn’t offer all the same functionality as Malwarebytes Premium for Windows, nor does it offer any protection against Windows viruses. I still highly recommend every Mac user run at least Malwarebytes free, and Malwarebytes Premium is a nice plus if you want automated protection. It’s also a solid choice or Mac malware protection in general.

      https://www.malwarebytes.com/mac/

      Years ago, I also used a Mac anti-spyware tool I paid about $35 for, but I can’t for the life of me remember the name of it or how effective it was.

      In some cases, however, you may want to supplement with protection that includes antivirus and anti-malware for preventing Windows viruses and malware as well. One reason is if you have Windows running on your Mac under Parallels or VMWare Fusion, and you wouldn’t want a Windows virus transmitted to the Windows VM (although it’s also a good idea to use some form of protection on the Windows VM as well, Windows Defender at a bare minimum). Another reason is to ensure you’re not transmitting Windows viruses onto Windows PC users through email or external hard drives or USB flash drives (while most email services include virus filtering, I’ve found an occasional virus sneak through company email virus scanners at places I’ve worked for).

      One antivirus product I’ve used in the past which offers the most Mac-friendly user interface, as well as protection against Mac and Windows viruses and malware is Intego. They’ve even offered “dual protection” editions with a Windows antivirus vendor to offer protection for Windows VM’s or Boot Camp paritions. Overall, I was happy with using Intego. I haven’t used them in a while since I haven’t seen any virus lab tests on Intego lately and not sure if the protection is still solid.

      https://www.intego.com/antivirus-mac-internet-security

      Another antivirus product I’ve used in the past is Thirtyseven4 (they also offer protection for Windows users as well), which is based on the QuickHeal antivirus engine. Their Mac antivirus product offered protection against both Mac and Windows viruses, with an overall simple interface (although not quite as Mac-friendly as Intego). Their support was solid to work with as well. The only reason I’m not currently running Thirtyseven4 on my Mac is at last check, their Mac version is 32 Bit only, and with 32 Bit apps coming to an end with the next major macOS release, I need something future proof.

      Total Security for MAC

      For those who want protection for free, Avast offers a free version of their antivirus software that I have tested, and it also protects against both Mac and Windows malware, as well as “shields” for the web and email. However, their web shield routes all of one’s web traffic through a proxy, which didn’t fare too well with my firewall extension (Little Snitch, more on that in another article). Plus, with Avast being free, I wasn’t sure how much of my personal data was being handed over for marketing purposes, and should I need support for Avast free, it would set me back far more than a typical antivirus subscription. The iterface was simple enough to use, although not the most Mac-friendly. For those interested, here are the details.

      https://www.avast.com/en-us/free-mac-security

      Currently I’m running Webroot as my additional form of antivirus and antimalware protection (I’m using the edition from Best Buy). The interface is overall simple to use (although not the most Mac-friendly, but it is similar to the Windows version), and it offers some (but not all) the features of the Windows version. It offers protection against both Windows and Mac malware. It uses few system resources since like the Windows version, it is “cloud-based”), so performance on my Mac is solid. Additionally, the schools I’ve been working with and one of the Microsoft Partners I’ve received consulting from recommend it, so I’ve been using it and so far, so good.

      https://www.webroot.com/us/en/home

      Another solution as a supplement to what I’ve covered above are the solutions from ObjectiveSee, which can help protect against ransomware, etc. These solutions are free, and I haven’t personally used any yet since I’m not sure which ones I should run, but if anyone else has used any of them, I’d love to hear about your experiences and which ones you use.

      https://objective-see.com/

      That’s my rundown of Mac antivirus and anti-malware. Feel free to chime in with your own recommendations and questions!

       

       

      Nathan Parker

      7 users thanked author for this post.
    • #344788 Reply

      willygirl
      AskWoody Plus

      Thank you Nathan for this great info. As far as antivirus and malware protection, after looking  around reading reviews and comparative studies, Avast Free AV seems like it will work for me. I like working with the basics but want to stay secure. I’ll let you know how it is here on this end once I get settled in with my transition of machines and OS’s. When Avast is up and running I’ll give it awhile before reporting in. Thanks for sharing your expertise of the Mac world!

      Win7 SP1 Home 64-bit

    • #344793 Reply

      OscarCP
      AskWoody Plus

      I use Webroot SecureAnywhere in both my  MacBook Pro and in my Windows 7 laptop. In my Windows laptop for some 3 years and in the Mac for 1.5 years. It is a paid service that has to be renewed annually. Not very expensive.

      So far, so good.

      Windows 7 Professional, SP1, x64 Group B & macOS + Linux (Mint) => Win7 Group W + Mac&Lx

      1 user thanked author for this post.
    • #344797 Reply

      DrBonzo
      AskWoody Plus

      @Nathan Parker – Thanks for this informative article. I’m looking forward to more.

      I’ve got an iMac running High Sierra. I’m not the primary user but I do maintain it. After MS OSs since DOS 3.0, I must say I find the iMac to be quite different, although much simpler to keep updated.

      I’m using Avira Free, which I like quite a bit. It’s quite similar, functionally, to MS Security Essentials, although it seems to scan faster.

      However, there is one thing I really don’t like about it. Every 2 to 4 months something about it just stops working. Once, it refused to update, once it lost real-time protection and would not let me turn it back on. A few days ago it just stopped working altogether. It does nothing when I try to open it from the taskbar, and when I try opening it from the Launchpad, I get a message saying I can’t open it because it’s ‘unresponsive’. The only way I’ve been able to get it working in the past is to uninstall it and then reinstall.

      I haven’t reinstalled it since it became unresponsive a few days ago, partly because I’m uneasy about it’s being unresponsive and also because I’ve been looking into other antivirus programs, so your article is very timely for me.

      I have a friend who has used Sophos (free version) for many years and swears by it (not at it).

      I’d be curious if you or anyone else has any experience with either Avira Free or Sophos.

    • #344898 Reply

      Nathan Parker
      AskWoody_MVP

      Thank you Nathan for this great info. As far as antivirus and malware protection, after looking around reading reviews and comparative studies, Avast Free AV seems like it will work for me. I like working with the basics but want to stay secure. I’ll let you know how it is here on this end once I get settled in with my transition of machines and OS’s. When Avast is up and running I’ll give it awhile before reporting in. Thanks for sharing your expertise of the Mac world!

      Glad to assist. Avast isn’t bad if you need free anti-virus for Mac, and coupled with Malwarebytes free edition, you should have solid protection for free. The only thing I had an issue with was web shield getting in the way with my firewall extension, but other than that, it works well.

      Nathan Parker

      1 user thanked author for this post.
    • #344899 Reply

      Nathan Parker
      AskWoody_MVP

      I use Webroot SecureAnywhere in both my MacBook Pro and in my Windows 7 laptop. In my Windows laptop for some 3 years and in the Mac for 1.5 years. It is a paid service that has to be renewed annually. Not very expensive. So far, so good.

      That’s also what I’m using now, and it does work well on either Windows or Mac. Performance is really good with it since it’s “cloud based”, and scans are fast. The schools I work with all use it.

      Nathan Parker

    • #344900 Reply

      Nathan Parker
      AskWoody_MVP

      @Nathan Parker – Thanks for this informative article. I’m looking forward to more. I’ve got an iMac running High Sierra. I’m not the primary user but I do maintain it. After MS OSs since DOS 3.0, I must say I find the iMac to be quite different, although much simpler to keep updated. I’m using Avira Free, which I like quite a bit. It’s quite similar, functionally, to MS Security Essentials, although it seems to scan faster. However, there is one thing I really don’t like about it. Every 2 to 4 months something about it just stops working. Once, it refused to update, once it lost real-time protection and would not let me turn it back on. A few days ago it just stopped working altogether. It does nothing when I try to open it from the taskbar, and when I try opening it from the Launchpad, I get a message saying I can’t open it because it’s ‘unresponsive’. The only way I’ve been able to get it working in the past is to uninstall it and then reinstall. I haven’t reinstalled it since it became unresponsive a few days ago, partly because I’m uneasy about it’s being unresponsive and also because I’ve been looking into other antivirus programs, so your article is very timely for me. I have a friend who has used Sophos (free version) for many years and swears by it (not at it). I’d be curious if you or anyone else has any experience with either Avira Free or Sophos.

      Good questions! I haven’t used Avira, but it sounds like the developers are doing something where it isn’t optimized well for your version of macOS. By the way, if you ever have an app that becomes unresponsive, you can use Command+Option+Escape to bring up the dialog to force quit it (it’s similar to Control+Alt+Delete on Windows). Activity Monitor on a Mac can also show you what apps are not responding and allow you to force quit them.

      I haven’t personally tried Sophos, but a computer repair shop down the road uses Sophos free, and they said it’s excellent. In the reviews I’ve read on it, I’ve heard it’s generally good (some lab tests came back excellent, others just good). It’s worth a try, and it should give you better performance over Avira. Avast free wasn’t too bad either, except the issue I had with web shields.

      Nathan Parker

      1 user thanked author for this post.
      • #345666 Reply

        DrBonzo
        AskWoody Plus

        @Nathan Parker – Thanks for the force quit tips. I tried the keyboard shortcut, but only a handful or so of programs showed in the pop-up window, none of which were Avira. So, I got into Activity Monitor and saw that ‘Avira Scheduler’ was listed as unresponsive. I was able to quit by clicking the upper left ‘X’ (force quit was not required), and within a few seconds Avira was back up and running. Easy.

        Thanks for the tips as I learn my around Mac operating systems.

        I see where there are a bunch of security releases issued by Apple on 3/25. I installed the Safari update last night with no problem. I figured I’d wait a few days before installing the High Sierra update. I’m not familiar with Apple/Mac message boards. Is there one (or a couple) you would recommend for getting info about updates (possible things that might go wrong with a given update, etc.; kind of like an AskWoody site for Macs)?

    • #345800 Reply

      Nathan Parker
      AskWoody_MVP

      @Nathan Parker – Thanks for the force quit tips. I tried the keyboard shortcut, but only a handful or so of programs showed in the pop-up window, none of which were Avira. So, I got into Activity Monitor and saw that ‘Avira Scheduler’ was listed as unresponsive. I was able to quit by clicking the upper left ‘X’ (force quit was not required), and within a few seconds Avira was back up and running. Easy. Thanks for the tips as I learn my around Mac operating systems. I see where there are a bunch of security releases issued by Apple on 3/25. I installed the Safari update last night with no problem. I figured I’d wait a few days before installing the High Sierra update. I’m not familiar with Apple/Mac message boards. Is there one (or a couple) you would recommend for getting info about updates (possible things that might go wrong with a given update, etc.; kind of like an AskWoody site for Macs)?

      Glad to assist with the force quit tips. It seems there is an issue with the Avira Scheduler not responding. I have seen that happen with Thirtyseven4/QuickHeal once, so it seems sometimes AV vendors do have issues with their schedulers.

      I don’t participate in any Apple/Mac message boards (I just participate in AskWoody), but I do read the following Mac news sites (you can read these in the Apple News app for Mojave and iOS): AppleInsider, MacRumors, Macworld, and MacSources. Overall the content is good on all sites, although I’m a little more objective than AppleInsider and MacRumors at times. MacSources is good for die-hard reviews. I’ll also post info about macOS and iOS updates if I hear of issues, and I have heard of one with Mojave I’m about to post about.

      Nathan Parker

      1 user thanked author for this post.
    • #349241 Reply

      Nathan Parker
      AskWoody_MVP

      I dragged out my 2006 PowerBook G4, and it seems it was running Clam AV on it when I last used it (since all paid antivirus solutions were no longer PowerPC Mac compatible by the time I discontinued it). I fired up Clam AV, did a check for updates, and what do you know? It successfully updated to the latest definitions!

      Nathan Parker

    • #1350509 Reply

      hyppolyte
      AskWoody Plus

      I have a Sophos Home Premium subscription on 2 Macs and 2 PCs with Windows 10 and Windows 7. Up to 10 devices allowed.

      I settled on Sophos based on reputation, reviews and a trial of the free version in January this year after my long-running ClamXAV subscription let me down.

      It took me a little time to get used to the cloud based administration. Manual local and right click scans are available. Functionality has been improved with regular updates.  The settings have become more flexible with exclusions, scheduled cloud-based scans and a choice to quarantine or automatically clean up malware.

      I particularly like Protected Applications with coloured borders and keystroke indicators in browsers (Windows only).

      Support by Chat or email has been thorough. Sophos also has a useful forum.

      I have a virtual Windows 10 running with Windows AV for comparison/control.

      CleanMyMac X from Macpaw also includes basic antimalware scans.

      hyppolyte

      1 user thanked author for this post.
    • #1367799 Reply

      Nathan Parker
      AskWoody_MVP

      A local IT shop near me runs Sophos and loves it, so it is a solid solution. The only machine I still have ClamAV free on is my 12″ PowerBook since it’s a vintage Mac. It still manages to update definitions and it still scans.

      I’ve heard issues with CleanMyMac in terms of not being solid antimalware protection upon last check. I’m not sure if that has improved, but my recommendation would be to not use it solely for antimalware, and even if you use it for cleaning your Mac (I like OnyX better), use another antimalware solution for solid protection.

      Nathan Parker

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: Mac Security: Antivirus and Anti-malware

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.