Comments on VRT: MacDefender and its variants

Slog6969 -- There is only one ClamAV pipeline. If ...

2011-06-23T10:56:11.463-04:00

Slog6969 -- There is only one ClamAV pipeline. If your Untangle system is grabbing it's definitions using freshclam, from the Official ClamAV repository, yes, you should have had them -- before this post came out.

Great piece, Joel. Thanks for the screenshots, in...

2011-06-10T02:04:52.509-04:00

Great piece, Joel.

Thanks for the screenshots, in particular. I've quoted your blog unabashedly (with attribution, of course!) in my own recent blog on MacDefender

Joel, I run an Untangle UTM and it has ClamAV at t...

2011-05-30T09:57:20.495-04:00

Joel, I run an Untangle UTM and it has ClamAV at the gateway. Will these Mac sigs be in that feed and get updated?

Are you putting Mac sigs in EVERY possible Clamav sig pipline?

http://www.untangle.com/

.

Kate, Yes. It would simply require an extra step...

2011-05-23T11:01:58.392-04:00

Kate,

Yes. It would simply require an extra step to open the package file. It's not an exploit against a browser in anyway, any browser with javascript turned on should download the file in the background. Safari just opens the package for you by default.

From this article, it seems to be only exploiting ...

2011-05-23T09:53:24.829-04:00

From this article, it seems to be only exploiting Safari for Mac. Would it also affect a Mac if you were running Firefox or Chrome?