TechRadar Verdict
Useful if you genuinely suspect that your Mac has been infected, but most people are unlikely to need MacScan
Pros
- +
Very easy to use
Simplifies malware removal
Cons
- -
Doesn't run in real time
Deals with spyware only
Not useful for cookie cleaning
Lousy spyware definitions
Why you can trust TechRadar We spend hours testing every product or service we review, so you can be sure you’re buying the best. Find out more about how we test.
One of the great things about the Mac is that virus writers don't seem to have a beef with Apple. Owners of Windows machines are forever having to update virus definitions in order to counter the malicious creations of Microsoft-hating programmers, but Mac users generally don't worry about such matters. And for good reason.
There are very few examples of OS X malware out there and a number of those that do exist, such as the infamous OSX.Leap.A worm, aren't much cop. That's not to say that OS X is less vulnerable than Windows.
Any system can be compromised, and Apple does see a need to release regular security updates, especially in the light of efforts by the Month of Apple Bugs (http://projects.info-pull.com/moab), an outfit dedicated to finding security flaws in the Mac OS.
However, while potential threats exist, they are by and large 'potential', and it appears that virus-writing sickos simply aren't targeting Macs. Nevertheless, the folk at SecureMac.com have devised a utility that will detect and remove spyware, keystroke loggers, Trojan horses, blacklisted cookies and admin applications on PPC and Intel Macs.
MacScan, a universal binary, will scan the entire system in pursuit of the dodgy and report back with its findings. It's reckoned to contain the latest spyware definitions and offers the option to download updates when available. At only 3.6MB, MacScan is a small download and it costs little more than a tenner, but is it necessary?
Using Quick Scan mode on a young MacBook Pro reveals nothing more than a few tracking cookies which could be removed manually. For a tougher test, the program was let loose on a three-year-old PowerPC that's been roundly abused with various shareware and freeware installations and has seen websites that would make your skin crawl.
Still nothing
A Full Scan reveals tracking cookies, but still no spyware on a machine that has never run an anti-virus program. Deliberate infection with stealth keylogger CarbonKeys 1.3 gives MacScan something to latch on to, both client and server components showing up as spyware in Quick Scan mode.
The utility offers the means to stop the keylogger running and plonks both the client and server applications into a folder of your choice. This is much quicker than the usual method of using Terminal to kill the server process and manually uninstalling the application. Provided, that is, you're aware that a keylogger is running.
In this respect, MacScan does have its uses. If you think that someone has deliberately installed a software keylogger on your Mac for some reason, the program should spot it.
There's a list on the developer's website showing which spyware menaces can be detected, although a number of them appear somewhat obscure - TextMeleon, for example, is listed as a keylogger, but when searched for returns a Googlewhack with a single link to, yes, the MacScan website.
Whether or not it's worth taking MacScan beyond the 30-day trial period is a matter for your own paranoia. In normal, domestic use, it's unlikely that your Mac will end up harbouring spyware, a few tracking cookies excepted.
If more than one person has access to the computer, or if you suspect that your work machine has been tampered with by a nosey colleague, then it may be worth the outlay for peace of mind.
MacScan doesn't offer the real-time protection of an anti-virus program, and cookie-cleaning is easy enough to perform without using the program. Also, the threat definitions given under the Info icon are woefully inadequate. However, this utility is effective in quickly terminating a recognised infection and makes it easy to uninstall the item.
