Endpoint Security for Mac - Bitdefender

Endpoint Security forMac

USER'S GUIDE

Endpoint Security for MacUser's Guide

Publication date 2015.12.23

Copyright© 2015 Bitdefender

Legal NoticeAll rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronicormechanical, including photocopying, recording, or by any information storage and retrieval system, withoutwrittenpermission from an authorized representative of Bitdefender. The inclusion of brief quotations in reviews may bepossible only with the mention of the quoted source. The content can not be modified in any way.Warning and Disclaimer. This product and its documentation are protected by copyright. The information in thisdocument is provided on an “as is” basis, without warranty. Although every precaution has been taken in thepreparation of this document, the authors will not have any liability to any person or entity with respect to any lossor damage caused or alleged to be caused directly or indirectly by the information contained in this work.This book contains links to third-party Websites that are not under the control of Bitdefender, therefore Bitdefenderis not responsible for the content of any linked site. If you access a third-party website listed in this document, youwill do so at your own risk. Bitdefender provides these links only as a convenience, and the inclusion of the link doesnot imply that Bitdefender endorses or accepts any responsibility for the content of the third-party site.Trademarks. Trademark namesmay appear in this book. All registered and unregistered trademarks in this documentare the sole property of their respective owners, and are respectfully acknowledged.

89504E470D0A1A0A0000000D494844520000000D0000000D0804000000D8E22CF7000000017352474200AECE1CE9000000097048597300000B1300000B1301009A9C18000000B54944415418D33DD0517583501444D19DB762E05AA012A88417095402914024808420A1480816B0F02C5C09E94769E77FE69C3597FA0E61B6D8F53683D943A0F412ABD4D9A5704395CA66F7972AD0A3A1544F1C42B37A3AF4188412DA7F6BB26AEEF8406117D2E63847DF4295AE90068790AA74D334A3925ED8AC7ACD28BD0CAADD357CA299AC3A6177316AAAB2987566E9253C4EA111D7CE97E924A5A64A614569BE1DE2149E31F17BD4A8D7790A21DCB148BDC10FE0EA41B7A65E25860000000049454E44AE426082

Table of ContentsUsing This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv

1. Purpose and Intended Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv2. How to Use This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv3. Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

3.1. Typographical Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v3.2. Admonitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

4. Request for Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi

1. Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.1. About Endpoint Security for Mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2. Opening Endpoint Security for Mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3. Application Main Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.4. Application Dock Icon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2. Protecting Against Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42.1. Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42.2. Scanning Your Mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42.3. Scan Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52.4. Fixing Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.5. Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82.6. Web protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.7. Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

2.7.1. Requesting an Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102.7.2. Getting Updates through a Proxy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112.7.3. Update to a new version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3. Configuring Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123.1. Accessing Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123.2. Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123.3. History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123.4. Scanner Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4. Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

5. Getting Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Types of Malicious Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

iii

Using This Guide

1. Purpose and Intended AudienceThis documentation is intended for the end users of Endpoint Security forMac, theSecurity for Endpoints client software installed on computers to protect themagainst malware and other Internet threats. The information presented hereinshould be easy to understand by anyone who is able to work under Macintosh.You will find out how to configure and use Endpoint Security for Mac to protectyour computer against viruses and other malicious software. You will learn howto get best from Bitdefender.We wish you a pleasant and useful lecture.

2. How to Use This GuideThis guide is organized around several major topics:Getting Started (p. 1)Get started with Endpoint Security for Mac and its user interface.Protecting Against Malware (p. 4)Learn how to use Endpoint Security for Mac to protect your computer againstmalicious software.Configuring Preferences (p. 12)Learn more about the Endpoint Security for Mac preferences.Getting Help (p. 16)Where to look and where to ask for help if something unexpected appears.

Using This Guide iv

3. Conventions Used in This Guide

3.1. Typographical ConventionsSeveral text styles are used in this guide for an improved readability. Their aspectand meaning are presented in the table below.

DescriptionAppearance

Syntax samples are printed with monospacedcharacters.

sample syntax

TheURL link is pointing to some external location,on http or ftp servers.

http://www.bitdefender.com

E-mail addresses are inserted in the text forcontact information.

[email protected]

This is an internal link, towards some locationinside the document.

Using This Guide (p. iv)

File anddirectories are printed usingmonospacedfont.

filename

All the product options are printed using boldcharacters.

option

Important keywords or phrases are highlightedusing bold characters.

keyword

3.2. AdmonitionsThe admonitions are in-text notes, graphically marked, bringing to your attentionadditional information related to the current paragraph.

NoteThe note is just a short observation. Although you can omit it, the notes can providevaluable information, such as specific feature or a link to some related topic.

ImportantThis requires your attention and is not recommended to skip over it. Usually, it providesnon-critical but significant information.

Using This Guide v

http://www.bitdefender.com

mailto:[email protected]

WarningThis is critical information you should treat with increased caution. Nothing bad willhappen if you follow the indications. You should read and understand it, because itdescribes something extremely risky.

4. Request for CommentsWe invite you to help us improve the book. We have tested and verified all of theinformation to the best of our ability. Please write to tell us about any flaws youfind in this book or how you think it could be improved, to help us provide you withthe best documentation possible.Let us know by sending an e-mail to [email protected]. Pleasewrite all of your documentation-related e-mails in English so that we can processthem efficiently.

Using This Guide vi

mailto:[email protected]

1. GETTING STARTEDThis chapter includes the following topics:

● About Endpoint Security for Mac

● Opening Endpoint Security for Mac

● Application Main Window

● Application Dock Icon

1.1. About Endpoint Security for MacEndpoint Security forMac is a fully-automatedcomputer security program,managedremotely by your network administrator. Once installed, it protects you against allkinds of malware, inlcuding viruses, spyware, trojans, keyloggers, worms andadware. It can also be used to enforce your organization's computer and Internetuse policies.This app detects and removes not only Mac malware, but also Windows malware,thus preventing you from accidentally sending infected files to your family, friendsand colleagues using PCs.

1.2. Opening Endpoint Security for MacYou have several ways to open Endpoint Security for Mac.

● Click the Endpoint Security for Mac icon in the Launchpad.

● Open a Finderwindow, go toApplications and double-click the Endpoint Securityfor Mac icon.

● You can also use Spotlight to find and open the application.

When the application opens, it automatically detects the language of your systemand it will display the user interface in your language.

NoteIf the system language is not among the Endpoint Security for Mac supportedlanguages, the application loads the English language interface by default.

Getting Started 1

1.3. Application Main WindowIn the application's main window you can take important actions to improve yoursystemprotection. You can check your computer's security status and secure yourweb browsing experience.

Application Main Window

The status area at the top of the window informs you about the system's securitystatus using explicit messages and suggestive colors:

● Green - If Endpoint Security for Mac has no warnings.

● Yellow - If a security issue has been detected.

● Red - If the license has expired.

Under the status area, three scan buttons are available to help you scan your Mac:

● Quick Scan - checks for malware themost vulnerable locations on your system(for example, the folders that contain thedocuments, downloads,mail downloadsand temporary files of each user).

Getting Started 2

● Full Scan - performs a comprehensive check for malware of the entire system.All connected mounts will be scanned too.

● Custom Scan - helps you check specific files, folders or volumes for malware.

For more information, refer to Scanning Your Mac (p. 4).Besides the scan buttons, additional options are available:

● Webprotection - filters all web traffic and blocks anymalicious content to secureyour web browsing experience. For more information, refer to Web protection(p. 9).

1.4. Application Dock IconThe Endpoint Security forMac icon can be noticed in the Dock as soon as you openthe application. The icon in the Dock provides you with an easy way to scan filesand folders for malware. Just drag and drop the file or folder over the Dock iconand the scan will start immediately.

Dock Icon

Getting Started 3

2. PROTECTING AGAINST MALWAREThis chapter includes the following topics:

● Best Practices

● Scanning Your Mac

● Scan Wizard

● Fixing Issues

● Quarantine

● Web protection

● Updates

2.1. Best PracticesTo keep your system malware-free and to prevent accidental infection of othersystems, follow these best practices:

● Check and fix the issues reported by Endpoint Security for Mac regularly. Fordetailed information, refer to Fixing Issues (p. 6).

● You should also adhere to these best practices:

– Make a habit of scanning files that you download from an external storagememory (such as an USB stick or a CD), especially when you do not knowthe source.

– If you have a DMG file, mount it and then scan its contents (the files withinthe mounted volume/image).

2.2. Scanning Your MacOn-Access Scanning module continuously monitors your computer, looking formalware-like actions and prevents newmalware threats fromentering your system.On-Access Scanning is controlled by your network administrator via securitypolicies.You can also scan your Mac or specific files anytime you want.The easiest way to scan a file, a folder or a volume is to drag & drop it over theDock icon. The scanwizardwill appear and guide you through the scanning process.

Protecting Against Malware 4

You can start a scan as follows:

1. Open Endpoint Security for Mac.

2. Click one of the three scan buttons to start the desired scan.

● Quick Scan - checks for malware the most vulnerable locations on yoursystem (for example, the folders that contain the documents, downloads,mail downloads and temporary files of each user).

● Full Scan - performsa comprehensive check formalware of the entire system.All connected mounts will be scanned too.

NoteDepending on the size of your hard disk, scanning the entire systemmay takea while (up to an hour or even more). For improved performance, it isrecommended not to run this task while performing other resource-intensivetasks (such as video editing).

● CustomScan - helps you check specific files, folders or volumes formalware.

2.3. Scan WizardWhenever you initiate a scan, the Endpoint Security forMac scanwizardwill appear.

Scanning in Progress


You can see real-time information about the scan, such as the number of detectedthreats and the number of resolved issues.Wait for Endpoint Security for Mac to finish scanning.

NoteThe scanning process may take a while, depending on the complexity of the scan.

2.4. Fixing IssuesEndpoint Security for Mac automatically detects and informs you about a seriesof issues that can affect the security of your system and data.The detected issues may refer to:

● Newmalware signatures and product updates have not been downloaded fromBitdefender servers.

● Security threats have been detected on your system.

● On-Access scanning module is disabled.

● License has expired.

Fixing the issues indicatedby Endpoint Security forMac is a quick and easy process.This way you can to fix security risks in a timely manner.To check and fix detected issues:


2. Check the color of the status area:

● Green - your Mac is safe.

● Yellow or red - Your Mac has issues. For further investigations, follow thenext steps.

3. Check the description for more information.

4. Depending on the number and type of the detected issues, a button may beavailable in the status area:

● Fix issue, if only one issue was found. Click the button to quickly fix thesecurity risk.

● View issues, if more issues were found. Click the button to view the issues.A new window opens and then you can fix the issues.


If malware has been detected, the application automatically attempts to removeit and to reconstruct the original file. This operation is referred to as disinfection.Files that cannot be disinfected are moved to quarantine to contain the infection.If the file can neither be disinfected, nor quarantined, Endpoint Security for Macinforms you about the issue and you can manually delete it.To manually remove infections:

● Click the Reveal in Finder button.

● Select the file and delete it from your system.If the filewas froman installed application,make sure you repair that installationfor the program to function properly.

Unresolved Threats Window

Some issues may require your network administrator to solve them from themanagement console, such as:

● Enabling the On-Access module via security policy.

● Renewing the expired license.


2.5. QuarantineEndpoint Security for Mac allows isolating the infected or suspicious files in asecure area, named quarantine. When a malicious app is in quarantine it cannotdo any harm because it cannot be executed or read.To view and manage the quarantined files, open the Quarantine window:

1. Right-click the Bitdefender icon in the menu bar.

2. Choose Preferences from the options list. A window will be displayed.

3. Choose the View Quarantine tab.

Quarantined Files

The Quarantine section displays all the files currently isolated in the Quarantinefolder.To delete a file from quarantine, select it and click Delete. If you want to restore aquarantined file to its original location, select it and click Restore.


2.6. Web protectionEndpoint Security for Mac uses the TrafficLight extensions to completely secureyour web browsing experience. The TrafficLight extensions intercept, process andfilter all web traffic, blocking any malicious content.The extensionswork and integratewith the followingweb browsers:Mozilla Firefox,Google Chrome and Safari.A series of features is available to protect you from all kinds of threats you mayencounter while web browsing:

● Advanced Phishing Filter - prevents you from accessing websites used forphishing attacks.

● Malware Filter - blocks any malware you come in contact with while browsingthe Internet.

● Search Results Analyzer - provides advance warning of risky websites withinyour search results.

● Antifraud Filter - provides protection against fraudulentwebsiteswhile browsingthe Internet.

● Tracker Notification - detects trackers on the visitedweb pages protecting youronline privacy.

Enabling TrafficLight extensionsTo enable the TrafficLight extensions, follow these steps:


2. Click Fix now to open Web Protection window.

3. Endpoint Security for Mac will detect what web browser you have installed onyour system. To install the TrafficLight extension on the browser youwant, clickGet extension from the corresponding pane.

4. You will be redirected to this online location:http://bitdefender.com/solutions/trafficlight.html

5. Select Free Download.

6. Follow the steps to install the TrafficLight extension for the selected webbrowser.


http://bitdefender.com/solutions/trafficlight.html

Page rating and alertsDepending on how TrafficLight classifies the web page you are currently viewing,one of the following icons is displayed in its area:

This is a safe page to visit. You can continue your work.

This web page may contain dangerous content. Exercise caution if you decideto visit it.

You should leave the web page immediately. Alternatively, you can choose oneof the available options:

● Navigate away from the website by clicking Take me back to safety.

● Proceed to the website, despite the warning, by clicking I understand the risks,take me there anyway.

2.7. UpdatesNew malware is found and identified every day. This is why it is very important tokeep Endpoint Security for Mac up to date with the latest malware signatures.While the On-Access Scanning is enabled, the malware signatures and productupdates are automatically downloaded on your system. If your networkadministrator disables the On-Accessmodule via policy, you will have to manuallyrequest an update for your Endpoint Security for Mac app.The malware signatures update is performed on the fly, meaning that the files tobe updated are replaced progressively. This way, the update will not affect theproduct operation and, at the same time, any vulnerability will be excluded.

2.7.1. Requesting an UpdateYou can request an update manually anytime you want. Update by user request isrecommended before you start a comprehensive scan.An active Internet connection is required in order to check for available updatesand download them.To request an update manually:


2. Click the Actions in the menu bar.

3. Choose Update Virus Database.


You can see the update progress and downloaded files.

2.7.2. Getting Updates through a Proxy ServerEndpoint Security forMac can update only through proxy servers that do not requireauthentication. You do not have to configure any program settings.If you connect to the Internet through a proxy server that requires authentication,youmust switch to a direct Internet connection regularly in order to obtainmalwaresignature updates.

2.7.3. Update to a new versionOccasionally, we launch product updates to improve the product functionalities.These updatesmay require a system restart to initiate the installation of new files.By default, if an update requires a computer restart, Endpoint Security for Mac willkeep working with the previous files until you reboot the system. In this case, theupdate process will not interfere with your work.When a product update is completed, a pop-up window will inform you to restartthe system. If you miss this notification, you can either click Restart to upgradefrom the menu bar or manually restart the system.


3. CONFIGURING PREFERENCESThe Endpoint Security for Mac offers a minimum set of options for the user toconfigure, as it is managed by the network administrator through the assignedpolicy.This chapter includes the following topics:

● Accessing Preferences

● Quarantine

● History

● Scanner Preferences

3.1. Accessing PreferencesTo open the Preferences window:


2. Do any of the following:● Click Endpoint Security for Mac in the Application menu and choose

Preferences.● Right-click the Bitdefender icon in the Statusmenu and choosePreferences.● Press Command-Comma(,).

3. Click the tab of the feature you want to configure. Please find them describedherein.

3.2. QuarantineThe Quarantine section displays all the files currently isolated in the Quarantinefolder on your local computer.To delete a file from quarantine, select it and click Delete. If you want to restore aquarantined file to its original location, select it and click Restore.

3.3. HistoryEndpoint Security for Mac keeps a detailed log of events concerning its activity onyour computer. Whenever something relevant to the security of your system ordata happens, a new message is added to the Endpoint Security for Mac History.Events are a very important tool in monitoring and managing your computer

Configuring Preferences 12

protection. For instance, you can easily check if the update was successfullyperformed, if malware was found on your computer, etc.Whenever you want to delete the history log, click the Clear History button. TheCopy button gives you the possibility to copy this information on clipboard.

3.4. Scanner PreferencesThis window allows you to choose whether or not the Endpoint Security for Macscans also the backup files. The application will only inform you of an existentthreat, as OS X protects your Time Machine disk and prevents Endpoint Securityfor Mac from removing files. If it happens to restore infected files at a later time,Endpoint Security forMacwill automatically detect themand take the proper action.By default the backup files are excluded from scanning. Deselect the Don't scanTime Machine disk check box to scan this location as well.

Configuring Preferences 13

4. FREQUENTLY ASKED QUESTIONSThe scan log indicates there are still unresolved items. How do I remove them?

The unresolved items in the scan log may be:

● restricted access archives (xar, rar, etc.)Solution: Use the Reveal in Finder option to find the file and delete itmanually. Make sure to empty the Trash.

● restricted access mailboxes (Thunderbird, etc.)Solution: Use the application to remove the entry containing the infectedfile.

● files owned by another userSolution: Use the Reveal in Finder option to find the file and contact theowner to find out if it is safe to remove that file. If it is safe to remove thefile, delete it manually. Make sure to empty the Trash.

NoteRestricted access filesmeans files Endpoint Security forMac can only open,but it cannot modify them.

Can I update Endpoint Security for Mac through a Proxy Server?Endpoint Security for Mac can update only through proxy servers that do notrequire authentication. You do not have to configure any program settings.If you connect to the Internet through a proxy server that requiresauthentication, you must switch to a direct Internet connection regularly inorder to obtain malware signature updates.

How do I remove the TrafficLight extensions from my web browser?

● To remove the TrafficLight extensions from Mozilla Firefox, follow thesesteps:

1. Open your Mozilla Firefox browser.

2. Go to Tools and select Add-ons.

3. Select Extensions on the left column.

4. Select the extension and click Remove.

5. Restart the browser for the removal process to complete.

Frequently Asked Questions 14

● To remove the TrafficLight extensions from Google Chrome, follow thesesteps:

1. Open your Google Chrome browser.

2. Click on the browser toolbar.

3. Go to Tools and select Extensions.

4. Select the extension and click Remove.

5. Click Uninstall to confirm the removal process.

● To remove Bitdefender TrafficLight from Safari, follow these steps:

1. Open your Safari browser.

2. Click on the browser toolbar and click Preferences.

3. Select the Extensions tab and find theBitdefender TrafficLight on Safariextension in the list.

4. Select the extension and click Uninstall.

5. Click Uninstall to confirm the removal process.

Frequently Asked Questions 15

5. GETTING HELPFor any problemsor questions concerningEndpoint Security forMac, please contactyour network administrator.Open About Endpoint Security for Mac window to find product and contactinformation:


2. Click Endpoint Security for Mac in the menu bar.

3. Choose About Endpoint Security for Mac.

Getting Help 16

Types of Malicious Software

AdwareAdware is often combinedwith a host application that is provided at no chargeas long as the user agrees to accept the adware. Because adware applicationsare usually installed after the user has agreed to a licensing agreement thatstates the purpose of the application, no offense is committed.However, pop-up advertisements can become an annoyance, and in somecases degrade system performance. Also, the information that some of theseapplications collect may cause privacy concerns for users who were not fullyaware of the terms in the license agreement.

KeyloggerA keylogger is an application that logs anything you type.Keyloggers are not malicious in nature. They can be used for legitimatepurposes, such as monitoring employees or children activity. However, theyare increasingly being used by cyber-criminals for malicious purposes (forexample, to collect private data, such as login credentials and social securitynumbers).

Polymorphic virusA virus that changes its form with each file it infects. Since they have noconsistent binary pattern, such viruses are hard to identify.

RootkitA rootkit is a set of software tools which offer administrator-level access to asystem. The termwas first used for the UNIX operating systems and it referredto recompiled tools which provided intruders administrative rights, allowingthem to conceal their presence so as not to be seen by the systemadministrators.The main role of rootkits is to hide processes, files, logins and logs. They mayalso intercept data from terminals, network connections or peripherals, if theyincorporate the appropriate software.Rootkits are not malicious in nature. For example, systems and even someapplications hide critical files using rootkits. However, they are mostly usedto hide malware or to conceal the presence of an intruder into the system.When combined with malware, rootkits pose a great threat to the integrity and

Types of Malicious Software 17

the security of a system. They can monitor traffic, create backdoors into thesystem, alter files and logs and avoid detection.

SpywareAny software that covertly gathers user information through the user's Internetconnection without his or her knowledge, usually for advertising purposes.Spyware applications are typically bundled as a hidden component of freewareor shareware programs that can be downloaded from the Internet; however, itshould be noted that the majority of shareware and freeware applications donot come with spyware. Once installed, the spyware monitors user activity onthe Internet and transmits that information in the background to someone else.Spyware can also gather information about e-mail addresses and evenpasswords and credit card numbers.Spyware's similarity to a Trojan horse is the fact that users unwittingly installthe product when they install something else. A common way to become avictim of spyware is to download certain peer-to-peer file swapping productsthat are available today.Aside from the questions of ethics and privacy, spyware steals from the userby using the computer's memory resources and also by eating bandwidth asit sends information back to the spyware's home base via the user's Internetconnection. Because spyware is using memory and system resources, theapplications running in the background can lead to system crashes or generalsystem instability.

TrojanAdestructive program thatmasqueradesas abenign application.Unlike viruses,Trojan horses do not replicate themselves but they can be just as destructive.One of the most insidious types of Trojan horse is a program that claims to ridyour computer of viruses but instead introduces viruses onto your computer.The term comes from a story in Homer's Iliad, in which the Greeks give a giantwooden horse to their foes, the Trojans, ostensibly as a peace offering. Butafter the Trojans drag the horse inside their city walls, Greek soldiers sneakout of the horse's hollow belly and open the city gates, allowing theircompatriots to pour in and capture Troy.

VirusA program or piece of code that is loaded onto your computer without yourknowledge and runs against your will. Most viruses can also replicate


themselves. All computer viruses are manmade. A simple virus that can copyitself over and over again is relatively easy to produce. Even such a simplevirus is dangerous because it will quickly use all available memory and bringthe system to a halt. An even more dangerous type of virus is one capable oftransmitting itself across networks and bypassing security systems.

WormA program that propagates itself over a network, reproducing itself as it goes.It cannot attach itself to other programs.


Endpoint Security for Mac - Bitdefender

Documents