I’ve always been fascinated by computer viruses. I’ve read lots of books, and in my job, used to take great delight in the challenge of removing them from friends/coworkers computers. This goes back to when I was living in NYC. I used to post to the antivirus newsgroups, I’ve communicated via email back and forth a few times with Dr. Solomon, emailed Robert Morris at MIT like some sad groupie (under the pretense of asking him if it was ok to use the MIT NTP servers which he was in charge of at the time) saved a woman’s doctoral thesis from an attached virus and certain doom, stuff like that. I have even kept a small collection of viruses (both Mac and Windows based). And so coming across an old stash of Mac virii tonight, I decided to scan one with the latest Mac OS X AV scanner, Clamxav.
Scanning /Users/dschultz/Desktop/worm in here/Desktop Print Spooler
———– SCAN SUMMARY ———–
Known viruses: 293043
Engine version: 0.91.2
Scanned directories: 0
Scanned files: 1
Infected files: 0 <—————————!!!
Data scanned: 0.05 MB
Time: 3.132 sec (0 m 3 s)
Now for a second test, I google an online file AV scanner, and upload the exact same file:
Kaspersky Anti-Virus has detected a virus in the file you have submitted.
Scanned file: Desktop Print Spooler – Infected
Desktop Print Spooler – infected by Worm.Mac.Autostart.a
How sad is that? A PC product finds the Macintosh virus without any problems. The macintosh AV breezes right by, and I suspect has absolutely no database of Macintosh virii. (yes I am talking about viruses for Mac OS 9 and earlier, not X specifically)