macCompanion – Mac Malware Status? By Robert Pritchett
From: macCompanion – Your Guide To All Things Macintosh
(...)
We have to be careful about tossing figures around. The figure of 68,736 appears to be from http://securityresponse.symantec.com/avcenter/download.html and, by the way, it’s up to 69,225 as of today (vs. 69,224 yesterday, if you care). But this is from a company, Symantec, which we’re correctly slamming for FUD. In other words, we should be very skeptical of this figure, since it came from a highly disreputable source (just like we should be skeptical of everything that comes from the Microsoft Felon). It also isn’t clear if this figure includes “Mac viruses”.
The flip side of point 1 is what does Symantec say about the Mac? We know there are no exploits in the wild, but lets hear it from the mouth of the lying horse: http://www.macworld.com/news/2002/05/28/virus/index.php A Symantec spokesperson claims there are over 7,000 macro viruses that can hit both Macs and PCs. He doesn’t mention it, but none of them are in the wild on OS X (more FUD, this time through omission). On the other hand, based on the track record, it is also a safe bet that a good bunch of the 69,225 aren’t in the wild either. From another source:http://www.macobserver.com/editorial/2003/08/29.1.shtml Nai (McAfee’s holding company) reports that there are over 71,000 viruses as of August 2003 (now its “over 100,000”). Presumably this is for all platforms, not just Mac and Intdows. At the time, the author was able to do filtered searches (it appears this feature has been removed), and filtered out Macintosh, producing 612 viruses. Sounds awful, right? They include hoaxes, unbelievably, in my opinion. In other words if some fool/anti-Mac bigot starts an urban myth about Macs, and enough mindless minions pass it along, it gets logged as a virus. Now I agree this stuff should be tracked, but putting it in the virus database seems to be rather aggressive. On the other hand, having worked in an office of a high tech firm containing people who should know better, and having said people forward this drivel, perhaps I’m being harsh. I’m beginning to see how the figures get so high though. Stripping out the hoaxes leaves 580 all of which are old office macro viruses or Mac OS classic viruses, leaving, 0.  I decided I would try and reproduce the search. A search at McAfee for OS X resulted in 77 hits. I have no idea what criteria they use for searching, but I suggest they go back to the drawing board. After filtering out Intdows (most of them), hoaxes and bunch of Sybian phone viruses, running a Google search for some of the viruses that didn’t have any description for some odd reason we’re left with. (Notice that none of the Microsoft macro viruses are listed for anything > Word 6, i.e. OS 9) a) http://vil.nai.com/vil/content/v_125299.htm The fake MS-word script that deletes a single user’s files (but doesn’t spread). So, the message here is that these counts include absolutely anything bad, and, using this criterion, the Mac has a piece of malware, already. Notice that it doesn’t corrupt the OS, also. Obviously, be careful about running stuff you pull down off p2p networks, get through email…. Apple can NEVER protect against this. It seems the criteria for getting on the list is popularity/widespread distribution, which is fair, as long as they use a reasonable definition of popular/widespread. b) http://vil.nai.com/vil/content/v_129163.htm discussed at 
http://www.macworld.com/news/2004/10/25/opener/index.php

tons of detail at

http://www.macintouch.com/opener.html this is opener, which requires the admin password. A nasty pile of scripting, but, as long as you are sure to not give the admin password to install a program you’re not absolutely sure about you’re safe (unlike Intdows, which lets this stuff run free – another thing we have to POUND the PC users on). c) http://vil.nai.com/vil/content/v_101173.htm the file with the mp3 icon that is actually a program, but, beyond displaying a message it does nothing. Details at http://www.houstonrecord.com/nation/nation_003.html A nasty person could have combined a) and c). So where does this leave us? a) Yes, we don’t have replicating viruses on OS X, still, after 4 years.(...)