MacScan 2.2

MacScan Corporation
Rating: (sixteen burnt toasts) [true]

Lawrence Lee
Chinese Overseas Marketing Service
3940 Rosemead Blvd
Rosemead, CA 91770
US

Collateral damage:
No pizza money for an entire weekend
More trojans on disk after install than before
Recurring nightmares with PSI Factor's Dan Aykroyd

MacScan is designed to detect, isolate and remove spyware, keystroke loggers, Trojans, and bring awareness to remote administration type applications which could have been maliciously or inadvertently installed on your Macintosh. MacScan is available for Mac OS and Mac OS X containing the latest definitions for spyware.
 - MacScan blurb

MacNN announced this today (4 August 2006) so you know it's good. It's unlikely anyone at MacNN bothered to test it, but they don't have to - they have uncannily good instincts.

Basically what you're looking at is Ad-Aware for Windows.

Ad-Aware is an acclaimed product in a market where spyware really proliferates. The organisation has developed into a first class security resource on the net.

MacScan 2.2 uses the same approach - and the same basic visual layout.

Both utilities work much the same as antivirus software. They run from 'signature lists' - lists of known exploits. They have different ways to recognise them.

On Windows Ad-Aware is an absolute necessity; even though the MacScan people list quite a few trojans for OS X, the prevalence is much less - some would say infinitesimal or non-existent.

The MacScan people have their list of current trojans for OS X here.

http://macscan.securemac.com/list.php

A curious thing about the list when last checked is that there are more 'recently added' trojans than there are in the entire list.

Whatever: whether for Windows or not, Ad-Aware is a classy product. It's engineered by professionals and it looks it. It's become the mainstay of the fight against malware on that hopeless platform known as Windows.

Malware authors have gone beyond Phase One in the battle by now of course: nowadays they test their payloads against products like Ad-Aware before releasing them so they know they won't get caught. And on Windows this reminds people once again what a hopeless case the fight against malware is.

But that's not the point - it's certainly not the point of this review. MacScan represents one of the first - if not the first - attempt at a counterpart to Ad-Aware for OS X. Whether or not the idea is useful, whether or not the product is needed, and whether or not anti-spyware programs can really help.

This review is not about the efficacy of ridding an OS X box of spyware because OS X generally doesn't have spyware anyway - this review is a comparison of Ad-Aware and a look at the 'quality' of the software product known as MacScan 2.2.

So get ready. It's going to be a bumpy and really unusual ride.

The Download

MacScan 2.2 is 2,607,798 bytes to download. It's a DMG. It expands to gobs more of course. And everything is run through Tracker for safety's sake.

Nothing eventful happens on the first operation, so it's time to go over to /Volumes and see what's there.

.InstallerBackground.tif

A TIFF file that's really ugly stands out immediately. The size is directly obnoxious - 595,341 bytes. Now some really advanced graphics need bigger files. But not this one. A quick export in Preview brings it down to 71,826 bytes. You the downloader just wasted half a meg of your time. You're not on dial-up, are you?

MacScan Installer.pkg

This is where the fun really begins. This is why Dan Aykroyd believes there are aliens already on this planet zapping people's brains.

And what follows at this point are a series of screenshots - and little more. You don't need more, believe it: you do not need any more. Kick back and fasten your seat belt.

Aftermath

This is some of what Tracker found. Note the cheeky '.dateFile.plist' snuck into your 'Shared' directory.

/Users/Shared/.dateFile.plist

The art of limiting use of a trial version.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>1</key>
    <data>
    U2F0LCBKYW4gMSwgMjAwMCAxMjowMDowMCBBTQ==
    </data>
</dict>
</plist>

That will be a date (such as NSDate) and it'll be checked every time the program starts up. One wonders if it'll be removed if you decide to uninstall.

Did anyone see an uninstall?

See Also
MacScan 2.2: The Banner Ads
MacScan 2.2: The Tracker Report
MacScan 2.2: The MacScan Forums