Limitations/power of Malwarebytes?

[Runch]

Good morning!

I'd like to ask and sum up what can this app do or what can it detect.

Mac lacks viruses, but among things there exist, can Malwarebytes detect:

Adware, Malware, trojans, keyloggers (loosing my passwords is my greatest fear)? I am almost sure answer is yes, but I'm the type of person who likes black and white charts.

And very specific question - let's say that my Mac was accessed by another person from my home and if said person installed rootkit/trojan or something like that (as in something slipped in not through hacking, but directly while sitting behind Mac - how big are chances Malwarebytes can detect this as well? This is curiosity question, but I'd like to understand everything.

I'd also like to give my thanks for such simple and effective program!

[treed]

Malwarebytes Anti-Malware for Mac detects all manner of Mac malware and adware, including malicious keyloggers and remote access tools. It will also detect "legitimate" keyloggers as PUPs (potentially unwanted programs).

It does not detect things like TeamViewer or LogMeIn, which could potentially be used by someone with physical access to your Mac to establish a remote connection later. Unlike commercial keyloggers, those apps are predominantly used for legitimate purposes, so detecting them as PUPs would not be justified.

However, protecting yourself against this kind of thing is simple. First, make sure that your Mac requires a password when waking from sleep or dismissing the screen saver (System Preferences -> Security & Privacy -> General). It's best to have that happen immediately, rather than after some delay. Then make sure never to leave your computer unattended without putting it to sleep or enabling the screen saver.

Next, enable FileVault (System Preferences -> Security & Privacy -> FileVault), which encrypts your entire hard drive. This will prevent someone from booting from another system and then accessing your hard drive and manually installing software on it that way.

Finally, enable a firmware password, to prevent anyone from booting your computer from another drive at all. https://support.apple.com/en-us/HT204455

If you do all this, on a current Mac with up-to-date system and firmware, your Mac should be secure against all currently known attacks by a hacker with physical access. Of course, don't get lazy because of that... try to limit physical access to only those you trust as much as possible.

[Runch]

That was excellent answer!

[RalphVI]

5 hours ago, treed said:

 It does not detect things like TeamViewer or LogMeIn, which could potentially be used by someone with physical access to your Mac to establish a remote connection later.

I'll like to butt in and ask regarding my stupid paranoia of having received my Mac from technician few days ago. While I do trust those guys almost 100%, there is still tiny nagging feeling. And I somehow ruined complete installation last time so I'm wary of trying it again.

According to this post, physical access can install the named apps and they are not detected as they are not malware? But is there a way to find those manually? Sorry, this doesn't fall under Malwarebytes specialty, but I'd like expert opinion instead of trusting google.

[treed]

Yup, since those apps are fully legit, they don't make any attempt to hide. So look for apps by those names... or any other similar app. I believe GotoMeeting can also do remote access, for example. If you see any of those in the Applications folder, you've got to uninstall them. Make sure to find the proper uninstaller from the developer of the app in question... don't use generic app "zappers" or "cleaning" software.

[RalphVI]

6 hours ago, treed said:

Yup, since those apps are fully legit, they don't make any attempt to hide. So look for apps by those names... or any other similar app. I believe GotoMeeting can also do remote access, for example. If you see any of those in the Applications folder, you've got to uninstall them. Make sure to find the proper uninstaller from the developer of the app in question... don't use generic app "zappers" or "cleaning" software.

No need to check directories or search around - just check Application folder?

Thank you for the advice! After expecting everything to be hidden, it eventually causes blindness to things right under my nose. Guess it would be good idea to make it a habit of checking what exactly is sitting in my main folders.

Edited October 27, 2016 by RalphVI

[treed]

Correct. Remember, these apps are not making any attempt to hide, unlike many "legit" keyloggers that do. Most people using apps like LogMeIn, TeamViewer and GotoMeeting are doing so for legitimate purposes, not for spying.