mac geekery

We may not like it, but OS X malware is on the rise. Even if you prefer the lalala-I'm-not-listening approach to security, you may want to do the decent thing and not forward such nasties from your Windows-using colleagues. Here's how to set things up.

1. Install clamav (the pre-eminent open source virus scanner).

   The easiest way to do this is download and install ClamXav. This includes a nice OS X front end for clamav and an on-access folder-watching utility.

 

2. Configure clamd.

   This step is optional but strongly recommended. clamd will eat ~40MB of your RAM whilst quiescent, but provides support for asynchronous scanning and hence improves system responsiveness immeasurably. I found Mail somewhat unresponsive whilst receiving mail without it. YMMV.

   • Edit clamd.conf

     - comment out any line that begins "Example" - this will enable clamd.

     - modify DatabaseDirectory to point to where your clamav virus database resides. On a standard ClamXav install this is /usr/local/clamXav/share/clamav .

     - I've tweaked some of the other settings, notably the location and quality of logging, but the above is the minimum needed to get things working.

   • Make clamd launch at boot time

     On Tiger, you'd use launchd for this, but since I use Panther I've had to compose a StartupItem:

     - drop into a Terminal, and create a clamd StartupItem folder: mkdir /Library/StartupItems/clamd and cd into it.

     - paste the following into a pico session and save as 'clamd':

     #!/bin/sh
     ##
     # clamd
     ##
     
     . /etc/rc.common
     
     StartService ()
     
     {
         ConsoleMessage "Starting clamd"
         /usr/local/clamXav/sbin/clamd -c /usr/local/clamXav/etc/clamd.conf
     }
     
     StopService ()
     
     {
        ConsoleMessage "Stopping clamd"
        /usr/local/clamXav/sbin/clamd SHUTDOWN
     }
     
     RestartService ()
     {
         StopService
         StartService
     }
     
     RunService "$1"

     - make this script executable:
     chmod a+x clamd

     - paste the following into a pico session and save as 'StartupParameters.plist':

     <?xml version="1.0" encoding="UTF-8"?>
     <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
     <plist version="1.0">
     <dict>
        <key>Description</key>
        <string>daemon to support clamdscan</string>
        <key>Messages</key>
        <dict>
           <key>start</key>
           <string>Starting clamd</string>
           <key>stop</key>
           <string>Stopping clamd</string>
        </dict>
        <key>OrderPreference</key>
        <string>None</string>
        <key>Provides</key>
        <array>
           <string>clamd</string>
        </array>
        <key>Requires</key>
        <array>
           <string>Disks</string>
        </array>
     </dict>
     </plist>

   • Finished clamd config - on your next reboot you should see 'Starting clamd' amongst all the other messages that display before the login window comes up.

 

3. Script to check email content.

   Paste the following into Script Editor, 'compile' to check it for errors, and save it wherever you keep your handy dandy Applescripts. Note that if you decided not to use clamd (step 2), you must substitute clamscan for clamdscan on the 'do shell script' line:

   using terms from application "Mail"
   --testing() -- uncomment to test-run from script editor
   on testing()
   set theList to the selection of application "Mail"
   do_viruscheck(theList)
   end testing
   on perform mail action with messages ruleMessages for rule theRule
   do_viruscheck(ruleMessages)
   end perform mail action with messages
   on do_viruscheck(theMessages)
   tell application "Mail"
   repeat with thisMessage in theMessages
     set msgSource to source of thisMessage
     tell application "System Events"
       -- get a free name for a temporary file
       set tmpdir to (path to "temp" from user domain as text)
       set tmpnam to "tmp-clamAVscan"
       set tmpfil to tmpdir & tmpnam as text
       -- should usually be ok, but now add counter if file still exists
       set tmp to tmpfil
       set c to 0
       set ok to false
       repeat while (exists file tmpfil)
         set c to c + 1
         set tmpfil to (tmp & c) as text
       end repeat
       -- copy message to temporary file
       set f to (open for access file tmpfil with write permission)
       set eof of f to 0 -- overwrite file
       write msgSource to f as string
       close access f
     end tell
   
     try
       do shell script "/usr/local/clamXav/bin/clamdscan --quiet --stdout " & POSIX path of file tmpfil
       on error errMsg number exitCode
       if (exitCode = 1) then
         set currentSubject to subject of thisMessage
         set subject of thisMessage to "[**VIRUS** - ClamAV] " & currentSubject
         -- set junk mail status of thisMessage to true
         -- set accountName to name of account of mailbox of thisMessage
         -- set mailbox of thisMessage to mailbox "Junk" of account accountName
       else
         -- ?? should we add something to the subject to say clamscan had trouble?
         display dialog "Something unexpected has happened to clamAV scan: Exit Code = " & exitCode
         -- make sure display dialog doesnt get too much..
         display dialog "Error Message (head):" & words 1 thru 20 of errMsg
         -- if user cancels script here, the temporary file will not be removed
       end if
     end try
   
     -- clean up temporary file
     tell application "System Events" to delete file tmpfil
   end repeat
   end tell
   end do_viruscheck
   end using terms from

 

4. Add a rule to Mail to run the scan script.
   • In Mail, go Preferences.. Rules.. and add a new rule that, for all mail, runs an Applescript. Navigate to your script using the Choose.. button.
   • Drag your new rule to the top of the list of rules (so that it is the first rule processed) and close Preferences.

 

5. Test it.

   - Send yourself an email with the eicar test file attached to it - if that mail has "[**VIRUS** - ClamAV]" prepended to its subject line then the script is working as designed.

There you go then - you can now feel all warm and fuzzy that you too are contributing to keeping the world's malware at bay.