Macs had malware long before Mac OS X

For the first three years after the release of the Mac, it’s believed to have remained blissfully free of viruses and other unwanted and malicious software, which was only just starting to plague other personal computers.

Then came the first variant of the nVIR virus in 1987, and the following year a spate of malware in HyperCard stacks. Those were encouraged by the app’s rapid popularity, and exploited its built-in scripting language HyperTalk. John Norstad of Northwestern University responded by releasing his popular anti-virus app Disinfectant in 1989, and others followed in his wake.

Symantec Antivirus for Macintosh (SAM), renamed Norton AntiVirus (NAV) in 1998, was launched in 1989, two months after Disinfectant. McAfee later based its commercial VirusScan on Disinfectant.

During the 1990s viruses became more widespread and malicious, and some exploited features such as CD AutoPlay, widely used to run QuickTime rich media from optical disk. Apple’s new accessible scripting language AppleScript soon fell victim to a whole range of nasties, which continues to this day. In 1997, it was estimated that there were at least 35 Mac-specific viruses, together with numerous malicious macros for Microsoft Word and Excel that caused mayhem across platforms.

Here’s my small collection of samples that I used when evaluating and reviewing anti-virus products at the time. Many of these were INITs that loaded at startup, and several could prove very damaging. There were several unfortunate accidents where Mac malware was distributed by commercial sources, including one provided in the cover floppy disk of a reputable Mac design and publishing magazine.

John Norstad’s Disinfectant finally bowed out on 6 May 1998 after nearly a decade of service to the community, but there were still free tools including Agax, with its modular design, shown above.

By the end of that decade there were six commercial anti-virus products for Macs, of which the most popular were Norton/Symantec Antivirus for Macintosh, and Virex for Macintosh from Datawatch Corporation. In addition to those, two British developers offered products, Dr. Solomon’s AntiVirus ToolKit for Macintosh and Sophos, and there was one from France.

Intego, then based in Paris, first released its anti-virus Rival in 1997, initially only in French. Then in October 2000, it released the first version of VirusBarrier for Mac OS 8 and 9.

Throughout this period, Classic Mac OS retained its reputation as being largely untroubled by malicious software, despite reality. Protection provided by Mac OS seemed rudimentary if not lacking altogether. This didn’t change with the introduction of Mac OS X, at least not until Renepo/Opener, a widely publicised Trojan, appeared in 2004 and Apple was forced to add protection in Mac OS X 10.4 Tiger.

Fortunately, by that time commercial developers were supporting Mac OS X, and Tomasz Kojm’s freeware ClamAV, first released in 2002, had been ported from Unix as ClamXav.

Further reading

Key Moments in the History of Mac Malware – 1982 to the Present, Kirk McElhearn
The Evolution of macOS Security and Privacy Features, Joshua Long