August 2009

Apple reportedly using
malware detection in Snow Leopard. *Not wanting to be made the target of new
PC ads mocking its lack of antivirus support, Apple reportedly is packaging
its new OS X 10.6 “Snow Leopard”, set to air on August 28, with free
antivirus software. Security research firm Intego, which maintains a Mac
security blog that monitors various OS X-specific malware, first noticed and
reported the development. The firm was running the new version of OS X, when
they noticed it detected and removed malware. The process was carried out
via a popup window, which they took a screenshot of, but they were either
unable to determine or chose not announce who made the antivirus software.
Intego’s post indicated that they were not making the product. ClamAV —
currently the AV engine in Apple’s server operating system — also seems
unlikely as the virus detected had the signature “OSX.RSPlug.A”, a signature
that ClamAV currently doesn’t support (ClamAV does have a signature for
“OSX.RSPlug” [1]). Similar, McAfee and Sophos use the names OSX/Puper.a [2]
and OSX/RSPlug-A [3], respectively. That leaves Symantec as one possibility.
Another is that Apple has developed its own proprietary antivirus software,
which would not be surprising.