4 ms·

Does anyone know a good command line malware/antivirus checker for Mac? (Paid is fine.) I do not want the antivirus to run in the background continuously (which

Does anyone know a good command line malware/antivirus checker for Mac? (Paid is fine.) I do not want the antivirus to run in the background continuously (which affects performance) yet want to have ability to run nightly scans to ensure that the machine is not infected. Almost all traditional antivirus products want to deeply integrate with the system and affect the performance a lot. Also some of these companies are know to make questionable decisions like trying to intercept HTTPS communication, etc.

na85 6y ago
The only command-line malware scanner I'm aware of is rkhunter, which according to a 30 second Google search installs on mac. I make no representations as to whether or not rkhunter actually does anything of benefit.
ac29 6y ago
ClamAV?
- mariopt 6y ago
  Used to be free, now it's a paid product.
  - hoistbypetard 6y ago
    It still looks free: https://github.com/Cisco-Talos/clamav-devel https://github.com/Cisco-Talos/clamav-devel That's licensed under GPLv2, available for download without any kind of key/password, and includes build instructions. The poster on mac could even use homebrew to install it with one command. And they even include instructions for mirroring the signatures here: https://github.com/Cisco-Talos/clamav-faq/blob/master/additional/CvdPrivateMirror.md https://github.com/Cisco-Talos/clamav-faq/blob/master/additi... What part of it requires payment?
    - gmac 6y ago
      https://www.clamxav.com/ https://www.clamxav.com/ was free and is now paid — perhaps the poster was thinking of that.
      - hoistbypetard 6y ago
        That seems likely. I forgot about ClamXAV.
jmnicolas 6y ago
I don't know if it would work for a Mac, but on my personal Windows machine every month I boot on a "Kaspersky Rescue Disk" and do an offline scan of all my drives. KRD is just a live Linux distro with Kaspersky's tools on it.
mindfulhack 6y ago
I use Objective-See's free and open-source BlockBlock: https://objective-see.com/products/blockblock.html https://objective-see.com/products/blockblock.html It picks up background daemon tasks that suddenly are created and allows you to block them immediately. That's certainly one major way to pick up and block hidden malware on your computer. All of the tools by this guy are incredible, they are also recommended, e.g. tools to pick up and allow you to block access to microphone or camera.
- cgufus 6y ago
  ... and definitely read objective-see's blog post from time to time if you are into security topics. The malware take-apart documentation is extremely enlightening. (Intereseting fact: A lot of malware quits immediately if Little Snitch is installed. So running Little Snitch alone prevents some malware from infecting your system)
derefr 6y ago
I would bet that whatever the answer is, you'd find it best by looking into what kind of antivirus software is used by ISP/business mail servers to malware-scan attachments during send/receive.
- yjftsjthsd-h 6y ago
  I would expect most of those to run on GNU/Linux, not Darwin?
deleted 6y ago
[deleted]
randomanon 6y ago
If you don't mind online scanners (drag & drop), then perhaps: virustotal.com virusscan.jotti.org
hjuutilainen 6y ago
Already replied to another comment with this but you could try https://sqwarq.com/detectx/ https://sqwarq.com/detectx/ which has command line usage included. (Not affiliated with them)

na85 6y ago

The only command-line malware scanner I'm aware of is rkhunter, which according to a 30 second Google search installs on mac. I make no representations as to whether or not rkhunter actually does anything of benefit.

ac29 6y ago

ClamAV?

mariopt 6y ago
Used to be free, now it's a paid product.
- hoistbypetard 6y ago
  It still looks free: https://github.com/Cisco-Talos/clamav-devel https://github.com/Cisco-Talos/clamav-devel That's licensed under GPLv2, available for download without any kind of key/password, and includes build instructions. The poster on mac could even use homebrew to install it with one command. And they even include instructions for mirroring the signatures here: https://github.com/Cisco-Talos/clamav-faq/blob/master/additional/CvdPrivateMirror.md https://github.com/Cisco-Talos/clamav-faq/blob/master/additi... What part of it requires payment?
  - gmac 6y ago
    https://www.clamxav.com/ https://www.clamxav.com/ was free and is now paid — perhaps the poster was thinking of that.
    - hoistbypetard 6y ago
      That seems likely. I forgot about ClamXAV.

jmnicolas 6y ago

I don't know if it would work for a Mac, but on my personal Windows machine every month I boot on a "Kaspersky Rescue Disk" and do an offline scan of all my drives. KRD is just a live Linux distro with Kaspersky's tools on it.

mindfulhack 6y ago

I use Objective-See's free and open-source BlockBlock: https://objective-see.com/products/blockblock.html https://objective-see.com/products/blockblock.html It picks up background daemon tasks that suddenly are created and allows you to block them immediately. That's certainly one major way to pick up and block hidden malware on your computer. All of the tools by this guy are incredible, they are also recommended, e.g. tools to pick up and allow you to block access to microphone or camera.

cgufus 6y ago
... and definitely read objective-see's blog post from time to time if you are into security topics. The malware take-apart documentation is extremely enlightening. (Intereseting fact: A lot of malware quits immediately if Little Snitch is installed. So running Little Snitch alone prevents some malware from infecting your system)

derefr 6y ago

I would bet that whatever the answer is, you'd find it best by looking into what kind of antivirus software is used by ISP/business mail servers to malware-scan attachments during send/receive.

yjftsjthsd-h 6y ago
I would expect most of those to run on GNU/Linux, not Darwin?

deleted 6y ago

[deleted]

randomanon 6y ago

If you don't mind online scanners (drag & drop), then perhaps: virustotal.com virusscan.jotti.org

hjuutilainen 6y ago

Already replied to another comment with this but you could try https://sqwarq.com/detectx/ https://sqwarq.com/detectx/ which has command line usage included. (Not affiliated with them)