Mac security program tries to scare users into buying

Some Macintosh users have encountered a security program whose function and Web site have the tell-tale signs of a scam.

Visitors to the Web site selling the program, called MacSweeper, are offered a free security scan of their computers. The scan, which only works on Macs, highlights supposed security problems with the computers. It offers to remove the problems with the purchase of a $39.99 lifetime subscription.

But the awkward English on the program's Web site, and the way the program operates, have raised doubts over its legitimacy, users and security researchers say.

"The imbibed set of features locates all the junk and useless data on your computer and deletes them to reclaim the wasted space," according to the pitch on MacSweeper's home page.

Security company F-Secure wrote on Tuesday that the program, called MacSweeper, may be the first rogue application for Macs.

Windows machines have been more frequently targeted by similar software, sometimes labeled "scareware" since users are warned their computers will be in danger unless they purchase the software. Among the more notorious scareware for PCs is Winfixer, also known by the aliases ErrorSafe, WinAntiVirus, and DriveCleaner.

The MacSweeper Web page is hosted on a server in Kiev, Ukraine, said Patrik Runald, security response manager for F-Secure, who is based in Malaysia. Information on the site about MacSweeper's company, Kiwi Software, has been plagiarized from Symantec's Web page, Runald said.

"They just ripped that information straight off there," Runald said.

The same text is also used on Cleanator.com, which sells a Windows-compatible version of the same kind of program, Runald said. Another security vendor, Sophos, classifies Cleanator as a "potentially unwanted program."

Once MacSweeper is running on a Mac it will often pick odd items, such as language files, and label them as being a privacy risk, Runald said.

In at least one instance an F-Secure researcher visited the MacSweeper site and clicked a button labeled "Free scan." The scan highlighted Mac-related problems, even though the researcher was using a PC.

MacSweeper doesn't use any tricks to get onto a machine other than trying to persuade users to download it, Runald said. Nonetheless, F-Secure typically contacts Finland's Computer Emergency Response Team when it finds scams such as MacSweeper, Runald said.

A user on one of Apple's discussion boards wrote that their Safari browser kept redirecting to the MacSweeper site, a sign that malicious scripts may be involved.

"If I click on anything it'll try downloading the software," the person wrote. "How do i get rid of this? It's really annoying. I don't want it, and I'd wish it would leave me alone."