MacScan MacScan User Guide Detect, Isolate and Remove Spyware
Part 1 1.1 Introduction MacScan is a spyware detection utility for Macintosh OS X that finds and removes spyware and other Internet files that may compromise your privacy from your computer. MacScan uses advanced detection methods to detect, isolate, and remove Spyware, keystroke loggers, and Trojan horses from your system. It alerts you to remote administration programs that may have been maliciously installed on your Macintosh. When MacScan detects spyware, it generates a report which allows the user to isolate the components. MacScan will move all selected spyware programs, extensions, preferences, and log files to a single and secured location. Page 3 of 16
Part 2 2.1 Preferences This section highlights the options that are found on the Preferences screen in MacScan. To change the preferences, select Preferences under the MacScan menu, or click the Prefs icon in the MacScan toolbar. 2.1.1 Detect Remote Administration Programs This option enables additional auditing of files for remote administration programs during a spyware scan. Remote administration programs can be found in shareware, freeware, and commercial applications and allow complete remote control of a computer. In the hands of a malicious user, these programs could be used to access personal information, passwords, and private files. 2.1.2 Automatically check for updated Spyware Definition* This option will enable MacScan to automatically check for updated Spyware Definitions. If an update is available, MacScan will notify you of the update and allow you to download it. * This feature requires an active Internet connection. Page 4 of 16
Part 3 3.1 Getting Started To get started with MacScan, double-click on the MacScan icon. The MacScan Mode Selection screen will appear. No Click the No button if you do not want to run MacScan in authenticated mode. Yes Click the Yes button if you want to run MacScan in authenticated mode. 3.1.1 MacScan Mode Selection Running MacScan in normal mode does not require a username or password. In order to run MacScan in authenticated mode, you will need to provide your OS X username and password. You may be required to authenticate as administrator by entering your username and password before running the scan to complete a full level or custom scan. This will grant MacScan full scanning privileges to your computer. Page 5 of 16
Name Enter the username of the Administrator account in the Name field. By default, the account created after installing OS X is an administrator account. Password Enter the password for the account in the password field. OK Click the OK button to proceed after entering the username and password of an Administrator account. Cancel Click the Cancel button to close the Authenticate screen if you choose not to run MacScan in authenticated mode. After successfully authenticating, or if running MacScan in Normal Mode, MacScan will display the main window: Page 6 of 16
MacScan's intuitive interface makes it easy to start scanning your computer for spyware. When MacScan starts up, the status screen displays statistics about spyware scans performed by MacScan as well as information about the version of MacScan currently running. The spyware statistics are automatically updated after each spyware scan and include the date and time of the last spyware scan, the number of spyware components detected on the last scan, the total number spyware scans that have been run, and the number of spyware components detected overall. Below the scan statistics are internal details about the current version of MacScan, which includes the scan engine version, the Spyware Definitions version, and the creation date of the current definitions. The status screen also includes information on the Cookie Blacklist, a list of known cookies that can track your internet surfing habits. The Cookie Blacklist Version and creation date are also displayed. Page 7 of 16
Part 4 4.1 Scanning for Spyware To view the different types of scans, click on the scan icon located in the MacScan toolbar, or click on the scan button located on the status screen. The scan screen contains information on each type of scan. To choose a scan type, select the appropriate tab. MacScan offers three different types of spyware scans: quick scan, full scan, and custom scan. 4.1.1 Quick Scan The Quick Scan checks the files in your home folder for known spyware applications. MacScan will also scan your running processes for the presence of spyware. If spyware is detected in the current processes but does not appear for isolation after Quick Scan is finished, it may be running from a folder not accessible with your current permissions. If this is the case, try running a Full Scan. If a full scan fails to isolate the spyware file, restart MacScan in Authenticated Mode. Page 8 of 16
4.1.1.1 Running a Quick Scan To perform a Quick Scan, click the Quick Scan tab on the Scan Screen, and then click on the Scan button in the lower right corner. You can then view the scan status as MacScan scans your hard drive. Quick Scans should be performed frequently (daily or weekly). The scans are short but ensure protection of your computer and your privacy. However, running a Full Scan upon installation of MacScan is strongly recommended. Page 9 of 16
4.1.2 Full Scan MacScan's Full Scan function will scan your startup disk for spyware and check for actively running spyware applications. It will search thoroughly for spyware by scanning all accessible files on your start up disk. If you would like to scan a specific folder on your computer such as an external hard drive or removable media such as CDs or DVDs, use Custom Scan instead. 4.1.2.1 Running a Full Scan Click on the Scan button to run a Full Scan on your hard drive. Note: Running MacScan in authenticated mode allows Full Scan to run at full capability. Page 10 of 16
4.1.3 Custom Scan Custom Scan allows you to scan a specific folder or drive for spyware. You can specify a folder, data CD, DVD, or other hard drives by selecting those locations for a Custom Scan. Custom Scan will scan for spyware in all accessible files in the specified location. Note: Spyware detected on a locked volume such as a data CD or DVD cannot be isolated. 4.1.3.1 Running a Custom Scan To configure and perform a Custom Scan, click on the Scan button and choose Custom Scan from the tabbed items. Select the folder or drive to be scanned from the window that appears, and click Select. MacScan will start scanning the specified folder or drive for spyware. Page 11 of 16
If no spyware is found, the following window will be displayed: Done Click the Done button when the scan is over. Cancel Click the Cancel button at any time during a scan to end the current scan. Any spyware detected by that point will be displayed. Threat Each piece of spyware detected by MacScan is assigned a threat level to indicate the impact on your operating system. Trojan horses and keystroke loggers are the biggest threats to your system security and are visually represented by a red triangle. Tracking cookies are medium level threats and are represented by a yellow triangle. Remote administration programs that are not necessarily spyware but can be used to compromise your system security are represented by a green triangle. Spyware Name The spyware applications that have been detected will be displayed in the column labeled Spyware Name. Page 12 of 16
Spyware Type The classification of spyware applications that have been detected (Trojan horse, Keylogger, or Remote Administration Program) will be displayed in the column labeled Spyware Type. As with all of the scan types, Custom Scan will only be able to scan folders and files that you can access with your user account. If you are unable to scan a specific location with Custom Scan, run MacScan in Authenticated Mode. If you do not have administrator access to run in Authenticated Mode, contact the administrator and ask for assistance. If spyware is found, the following screen will be displayed: Select which spyware to isolate, and click the "Isolate" button. Spyware such as Trojan horses and Keyloggers will be isolated to the folder MacScan Isolated Spyware on the Desktop. Tracking cookies will be removed immediately. Page 13 of 16
Part 5 5.1 Cleaning Internet/Web Files Cookies are messages given to a web browser by a web server. The browser stores messages in text files. The message is sent back to the server whenever the browser requests a page from that particular server. MacScan can remove these cookies from your system. After clicking on the Web Files icon, the following screen will appear: You can select specific web browsers and specific files you want to clean. To clean Internet/Web files, you must select at least one browser and at least one file type to clean. Web Browsers to clean: Indicate the web browsers to be cleaned by clicking on the Select box next to the name of the desired browser. Web browsers not installed on the computer will be grayed out and not selectable. You can select more than one web browser to clean at a time. Files to clean: Indicate the files to be cleaned by clicking on the Select box next to the name of the file you want to clean. Page 14 of 16
You can select more than one file to clean at a time. Cookies History Select this box to clear cookies from your computer. Select this box to clear History files. Downloaded Files List Temporary Cache Files Select this box to clear the Downloaded Files list. Select this box to clear Temporary Cache files. Page 15 of 16
Part 6 6.1 Spyware Information Database MacScan comes bundled with spyware information. This section provides you with information about spyware, Keyloggers, Trojan Horses and Remote Administration Programs. 6.1.1 Display Spyware Information Select a Spyware Information entry in the popup menu to display detailed information about that particular topic. 6.1.1.1 Keyloggers Select Keyloggers to get information about Keyloggers. 6.1.1.2 Trojan Horses Select Trojan Horses to get information about Trojan Horses. 6.1.1.3 Spyware Select Spyware to get information about Spyware. 6.1.1.4 Remote Administration Programs Select Remote Administration Programs to get information about Remote Administration programs. Page 16 of 16