MacFixIt has a post today about another low-risk Mac malware appearance, written by Topher Kessler. I’m quoting it below:

Though not a grave security risk for
Mac users, a new Trojan horse called “OSX/HellRTS.D” has been identified by Intego (developers of VirusBarrier X). The new Trojan is a variant of a backdoor server called “HellRaiser,” which was developed to allow full control of an infected PC by a remote attacker.

As with many Trojan horses, this new one is a modification to previous code so hackers can hopefully get around current security measures and virus definitions.

Once installed it will duplicate itself and mask itself as legitimate applications that are already on the computer. It will then set up a server through which it can send e-mails, allow for remote connections, and communicate with remote servers.

The program is distributed as a file that must be installed by a user, and is being made available through user-provided download sources such as online forums and other less-than-legitimate Web sites, and the code is a universal binary file so it will work on both Intel and PowerPC Macs.

Since the installation of this Trojan requires you to manually install the first copy of it, the risk is relatively low, especially since the distribution is through forum postings and other unofficial download sites. As such, the easiest way to prevent infection is to only download programs from a legitimate source such as the developer’s direct site, or from a source like VersionTracker or CNET’s Download.com.

Unfortunately, in situations where there are many users for a machine, it is difficult to tell how the computer is being used and at times what is being installed (even standard users can install some applications to their own accounts). Apple provides parental controls, but users may still run across these programs and try to install them.

There are some steps you can take to ensure your system is safe:

1. Virus Scanning

   Active virus scanning is still not considered a requirement for OS X, but at least have a good scanner installed that you can run periodically. I use Sophos antivirus, but there are several others including MacScan, VirusBarrier, and ClamXav. Ensure your virus definitions are up to date, and if you do not want to manually scan your system periodically, have the program automatically run scans at times when you are not using your system.

2. Restrict administrative access

   It is unclear whether this Trojan requires administrative access to run (or at least run some of its features), but in general it is good practice to limit access to administrative rights, even for yourself. Set up an administrative account and then create a standard account for yourself for daily activities, and only use the administrative account to configure the system.

3. Set up incoming and outgoing firewalls

   Apple’s built-in application firewall is great for preventing access to your system; however, little prevents applications from sending information back out. In addition to regularly going over and removing application exceptions from the OS X firewall (done in the Security system preferences), install a program like Little Snitch, which will notify you of any program that is trying to send information out.

4. Avoid malware

   It is very easy to avoid malware. As previously mentioned, do not install items that you downloaded from forums, but also avoid special deals that are not directly from developers or reputable vendors. Avoid installing items obtained from “warez” and porn sites, and if your browser automatically downloads an installer file, delete it. If a Web site claims you need a plug-in for a specific function, research the plug-in and download it from the developer.

For more tips on increasing the security of your system, check out this article.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Apple posted a knowegebase document that most of will need sooner or later. The content is below:

If you’re troubleshooting a broadband Internet connection issue related to your modem or router, you should ask your ISP certain questions (or check their support website).  If you use a modem/router that your ISP did not provide, you should ask the manufacturer of the device instead (or check their support website).

Note: This article applies to third-party broadband modems and routers. If you use an AirPort product, check out the resources available on this page instead.

Products Affected
AirPort, Mac OS X 10.5, Mac OS X 10.6

Before contacting your ISP have the following information ready

• What version of Mac OS X is installed?  Mac OS X v10.____.
• Which computers or devices are unable to access the Internet?

 

• Are the devices connecting wirelessly or via an Ethernet cable, or does it vary by device?
• Which exact make and model of modem and/or router do you use?
• What versions of firmware are installed on your modem and/or router? (If you don’t know how to check the firmware version, refer to the documentation that came with the modem or router.) 
• Can you connect to the Internet if the modem is connected directly to your Mac via an Ethernet cable?

 

Questions to ask your ISP or modem/router manufacturer

• Is there a firmware update available for the modem or router? 

 

• If a firmware update is available, how do you install it from your Mac? 
• Is there any MAC address filtering active on the modem or router? If so, can that be adjusted or disabled?
• If there a battery backup in the modem, how can it be temporarily disabled when resetting the modem?

 

• Can the ISP remotely reset the modem? If not, how can you (accounting for any battery backup). 
• Is there a firewall or proxy server active on the modem/router? 
• Does the modem provide additional services, such as wireless access or VoIP telephone services?




• If so, do you have another way of making or receiving phone calls? 
• Does the modem act as a router, or provide wireless services? 
• How should the Network pane in System Preferences be configured? 
• What IP address range should the modem or router provide? 
• Is it possible to replace the modem with a different or newer model?

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Problems after the Mac OS X 10.5.8 Update

There are always some problems reported after every software update. More often than not they are in a distinct minority of users, but I like to report the more common ones, with solutions if I can. I’ll update this as more problems come up in the next week or so.

Wireless Network Connections

Several reports are out about connectivity problems with wireless networks after the 10.5.8 update. Some complain about slow connections, others can’t connect to particular devices or services.

First thing, try a restart. This solves a large number of problems, and is the easiest fix.

Most commonly these problems can be caused by PRAM problems, so a PRAM reset is the first solution I’d try. Reboot your Mac and hold down the following keys before you hear the chime: Command-Option-P-R

Keep the keys held down as it resets at least two more times (I hold it for 3 or 4 but it’s overkill, usually), then release the keys and your Mac will boot normally. You’ll have to re-set any custom changes you’ve made with mouse tracking speed, system sound volume, and such, but with a little luck, Wi-Fi connections will be OK again.

Another possibility if your network is hidden, is to log into the router, and turn SSID broadcast on. I’ve seen a report that 10.5.8 may have an issue discovering hidden networks.

You can also remove and re-add the airport interface in System Preferences -> Network. Note the settings BEFORE you delete it by highlighting and clicking the “-” button. Make sure you click Apply to save, then add the Airport interface back by clicking the “+” button, using the settings you noted in the first step. This will release the DHCP lease and get a new one.

If the previous fixes don’t work, try re-applying the Combo Updater. It may work for you, particularly if you boot into Safe Mode, then apply the update.

Permission Problems

It seems that some 10.5.8 updates have had issues with not linking to the permissions database, which results in strange permissions warnings. An Apple Discussions thread on the subject is here. Suggested solutions are:

1. Do nothing.
   As long as the computer is working, a permissions fix is not needed. Granted it would be nice to know that everything is functioning and not run into a problem in the future, but since for the most part these permissions problems are showing otherwise healthy permissions it is more than likely safe to let things be. Still, run a permissions verification and check the files to ensure the current permissions at least give some user/group read access. For the most part you can safely disregard default group changes.

2. Reapply the update (delta/combo)
   Try reapplying the update, which seems to have at least helped the problem for some people, if not fixed it completely. To do this, download and reapply the updater, optionally rolling back to a previous installation from a backup (Time Machine or boot drive clone) beforehand. We recommend if you do this to get the combo updater and then apply it when booted into Safe Mode.

3. Change permissions manually
   If the problem is with only a few files, you can use the Terminal to change the permissions manually, or at least ensure the files are accessible and reporting the proper permissions. We will not go into details on how to change the permissions for files using the Terminal, since each file type may have different permissions and we would need to address each specifically; however, if you are familiar with the terminal you can manually ensure the files are properly accessible.

4. Teach the database new file permissions.
   After you have checked permissions manually, and ensured the files are properly accessible (for the most part, allowing the owner to read and write, and having the group and other users be read only), you can teach teach the updater receipt file the new permissions by running the following command in the Terminal:

   sudo pkgutil –edit-pkg com.apple.pkg.update.os.10.5.8 –volume / –learn FILEPATH

   In this command, the FILEPATH is the full path to either the parent folder of files that share these permissions problems, or to the individual files themselves. This should only be done if you are certain the current permissions are correct for the files in the “FILEPATH”.

   After this command is run, the permissions check should not observe permissions changes the files targeted by FILEPATH anymore.

Thanks to MacFixIt for the solutions.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Apple released a firmware update, version 7.4.2, for Time Capsule and the AirPort Extreme and Express base stations. It’s a recommended update, and can be done easily.

AirPort Utility is the tool necessary to install the update, and AirPort Utility 5.4.2 or later is recommended to be installed before updating to Firmware version 7.4.2.

Once the latest version of AirPort Utility is installed, go to the Utilities folder (from the menubar choose Go > Utilities and find AirPort Utility, and double-click it) and look for the Update button in the lower right corner. Click “Update” and the firmware will be downloaded and installed for you. Your AirPort base station will go off-line for a few minutes, and after it restarts, you will have your network back good as new. Better, in fact!

According to Apple, the update provides several fixes, including the following:

Fixes some problems with extending and maintaining connectivity with extended networks
Fixes an issue with clients that enable 802.11 “Power Save”
Fixes connectivity issues with some third-party devices
Fixes an issue when the base station is configured for PPPoE
Fixes some Back To My Mac issues with connectivity and support for third-party routers

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Macworld.com has an important article (by Glenn Fleishman) for all home network users, especially wireless network users.

Password Protect with WPA

The first thing to do is password protect a wireless network, using WPA (Wi-Fi Protected Access) security. This is standard on 802.1g and n devices, but older 802.1b devices are more difficult to upgrade to WPA. They are slow to begin with, and will be even slower using WPA. It’s a great time to upgrade to 802.11n, for better security and fast wireless connection.

WPA2 is the latest standard, and most newer hardware can use it. It uses stronger encryption than WPA Personal.

If you have an Airport Extreme from 2003 or newer you can use WPA2Personal. Even so, WPA Personal is sufficient for most home networks.

Network Address Translation

Implementing NAT is a great way to keep outsiders out of your network. NAS provides private IP addresses for devices on your network. These are protected from connection outside the local network… the router opens a relay when you access the Internet, but your machine(s) cannot be connected from outside the LAN.

For more info, read the article… Glen does a great job of describing a fairly complex subject.

Remote Access

OK, you’ve locked your network down, but then you need to have your tech (someone like me) to be able to remote in to your machine, or you need to access files from your hotel on Maui… How do you do that?

Glenn explains several methods for accessing files, by turning on File Sharing in System Preferences (Sharing pane) and choosing folders and volumes you want to be accessible, and setting up users and privileges in the Shared Folders and Users list.

An alternative is to put the files on a NAS drive (network attached storage) and using SFTP (secure FTP) to connect. This involves setting up a router port to access the drive, and giving it a fixed IP address.

Time Capsules or Airport Extreme Base Stations (from 2007 on) can do this without having to do the port mapping. Read the article or the instructions for step-by-step instructions.

You can use an iDisk to access files as well, and DropBox. iDisk provides up to 20GB of storage and requires a MobileMe account ($99/year), DropBox allows 2GB storage free, 50GB for $99/year.

Glenn does NOT address the issue of a tech being able to remote in to your machine for troubleshooting or maintenance. The easiest way to do this is to use LogMeIn. Get a free account, inputting a username and password, and provide that info to your tech. It’s easy as that.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Apple just posted a new version of MobileMe Control Panel for Windows. Check it out here.

For those Windows users who find MobileMe to be of use, this will make Outlook contact and calendar items automatically sync, and changes made on an iPhone or on the web will also sync immediately.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

The venerable and much-abused .Mac service, considered overpriced by some and an utter necessity by others, is growing up. Oh, and it works with PCs too, so if you have Macs and PCs to sync, it works.

Next month, it will become MobileMe, with features that may make it more palatable to the people who feel .Mac is too little for too much. Or not.

Current .Mac users will have a seamless conversion, and their old @.mac email and iWeb urls will work, but they will also have new @.me addresses and me.com urls. Complete information about the conversion is available on the Apple .Mac to MobileMe transition FAQ, article HT1932

Storage is doubled, in any event, and if you have purchased additional storage it will be doubled as well.

From the Transition page:

How much will my online storage increase with the upgrade?
With MobileMe, you will get twice as much storage as you did with .Mac:

Individual subscription storage doubles from 10GB to 20GB.
Family Packs now get 40GB of storage: 20GB for the main account and 5GB for each of the four sub-accounts.
If you purchased a storage upgrade, it will also be upgraded at no additional charge:

A 10GB storage upgrade is now 20GB. Your new total storage will be 40GB.
A 20GB storage upgrade is now 40GB. Your new total storage will be 60GB.
Note: The storage increase is effective after MobileMe launches, and may take up to 10 days to appear on all accounts.

Apple’s MobileMe site has a lot of information with demos to fully explain the features. I’ll sum them up:

Available from any Internet-connected device, MobileMe will store your email, contacts and calendars on a secure online server, called a “cloud”. It pushes them down to your Mac, PC, iPhone and iPod Touch, without any intervention from the user. It happens instantly and continuously, automatically. No need for a dock, or to push a button.

This means that I can have the same email (if I choose), contacts and calendar info on my desktop Mac, my MacBook Pro (laptop) and my iPhone, all exactly the same or updated as soon as they connect to the Internet, without thinking about it.

Unanswered question? How long does this process take, and does it slow my machine down? Don’t know yet.

The Gallery and iDisk features are not too different… except that you can upload photos from your iPhone directly to your Gallery, as well as from your computer. The interface seems to be a bit improved, but as I don’t use it much, I don’t want to be quoted on that. You can make a new album or change existing ones from pretty much anywhere that is Internet-connected and changes are “instantly reflected in your gallery”.

You can allow print-quality downloads of photos or entire albums, either as full-size JPEGS or images optimized for 16″ x 20″ prints which have a smaller file size, according to the site.

You can also allow other individuals to upload photos from a browser or email.

MobileMe Gallery works with Apple TV on a widescreen television, so a computer is not required.

iDisk is not changed in terms of its function. The under-the-hood workings may be updated, but I just don’t know.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

MacFixIt posted an article with an old solution, but still a good one, for solving network connectivity problems, particularly after a System update.

Entering the correct DNS Server info in the TCP/IP tab of the Internet connection port in Network prefs is the key to solving a lot of connectivity issues, in my experience. Read the article, save the info. It may help you out of a fix one day.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

I’d love to hear from anyone using Time Capsule… I’ve seen a few reports of problems, and would like to follow up. These are mixed indeed.

Reports as follows, from MacFixIt:

Brian Charles
I received my 500GB TimeCapsule just over a week ago. After a painless setup, it replaced my aging Snow Base station and all seemed fine.
Within a few hours though it dropped connections to my laptop and mini, my desktop is wired so no problem there, or so I thought. It seems to interfere with DHCP over the network, sporadically reassigning IP’s. My first back up from a MacPro connected directly to the TimeCapsule via ethernet took more than 96 hours for 250GB. Connection signal to my Mac mini in the living room from my upstairs office was worse than the Snow Basestation which is just 802.1a.
I spent 2 days troubleshooting, resetting the hardware, reformatting the drive to no avail.
This morning the TimeCapsule was completely locked up with the disk spinning loudly. It was too hot to touch.
This morning I called Apple for an RMA. I’ll pay their restocking charge. TimeCapsule is a dud. This is by far the worst product I’ve ever purchased from Apple.

Peter Morris
I received a TC on Wednesday (two days before Apple said I would receive it) for a customer. As they are moving soon, I added it to the pre-existing G network. It’s taking a long time to back everything up, one Intel iMac, two G5s and two MacBooks. It’s hogging the wireless bandwidth so much, that they are now only turning Time Machine on when they leave. Hopefully, that will have resolved itself over the weekend. Other than that, it has so far worked as advertised.

Mark Booth
I’ve had my 500GB Time Capsule for a week now. After the initial backups, subsequent Time Machine backups from my wife’s iMac or my MacBook Pro take mere minutes. Accessing the device wirelessly via Time Machine (to restore a file) adds a few seconds to the process (versus a Firewire or USB drive), but really no big deal!
So far, Time Capsule has performed flawlessly for me!

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

If you are getting this error message “Unable to get printer status (forbidden)” you may be able to fix this easily.

1. Open Printer Setup Utility, located in Applications/Utilities.Unable to get printer status (forbidden)
2. Go to the “Printer Setup Utility” menu at the top of the screen and select “Reset Printing System”
3. Go to the “Printer Setup Utility” menu at the top of the screen and select “Reset Printing System”

This solution comes from a MacFixIt tutorial “Resolving common printer problems” which deserves a bookmark, in my opinion.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.