Mac Malware Glossary


A program that protects your computer from viruses and malware by scanning, disinfecting, and repairing infected files. It can identify known malware based on its "signature" (i.e. unique code or characteristics), and it can also detect new variants.


A single file containing other files and folders, usually compressed to save space. (Used in Intego VirusBarrier.)


A type of malware that gives an attacker remote access to an infected computer. Also known as a remote access tool, or remote access Trojan (RAT). A backdoor may open a "port" on an infected computer, or enable other methods for malicious users to access that computer remotely, either to steal data, or to control it, and use it as a part of a botnet.


A copy of files and folders made from one location, usually your active Mac's internal drive, to another storage location for safekeeping. Backups can be made to other computers, internal or external disks or partitions, network-attached storage (NAS) devices, or even to removable media such as writable CDs, DVDs, or flash memory cards. (Used in Intego Personal Backup.)

Bayesian Analysis

A statistical method using an algorithm to determine whether incoming e-mail messages are spam.


A botnet is a network of compromised computers (which are, in turn, called bots or zombies). While not a form of malware, botnets can be created as a consequence of widespread distribution of a Trojan horse or a worm. Botnets can be used to send spam or to attack Web servers or other Internet-connected systems. As one specific example, in January 2009, Intego found a Trojan horse called iServices hidden inside pirated copies of popular Mac software, that was responsible for the creation of a Mac botnet.


See “bootable backup.” (Used in Intego Personal Backup.)


A file on your drive that contains information sent by a Web server to a Web browser, and then sent back by the browser each time it accesses that server. Typically, this is used to authenticate or identify a registered user of a Web site without requiring them to sign in again every time they access that site. Other uses are, for example, maintaining a shopping basket of goods you have selected to purchase during a session at a site, site personalization, or tracking a particular user's access to a site. (Used in Intego VirusBarrier and Washing Machine.)

Disk Image

A virtual volume that is created and stored as a file. When you double-click on a disk image file, its volume mounts as if it were a separate physical disk. On macOS, disk images most often have the .dmg filename extension, although other formats such as .sparseimage and .sparsebundle exist. Older Macs typically used the .img extension. Both .dmg and .img files have historically been used for distributing Mac software. When disk images are created from CDs or DVDs, either .iso or .cdr is usually the filename extension. (Used in Intego Personal Backup.)


Domain Name System. Used by routers on the Internet to translate addresses from a named form, such as, into an IP address, such as (Used in Intego VirusBarrier.)


When used as a noun, an "exploit" is a technique or code that can enable a hacker to take advantage of a software vulnerability, a weak spot in the armor of a computer's security. Serious vulnerabilities are regularly found that affect macOS, iOS, Safari, and other operating systems, browsers, and apps. Exploits may be found in maliciously crafted Web pages or harmful files or apps. To "exploit," as a verb, means to take advantage of a software or hardware vulnerability.


File Transfer Protocol. An antiquated, insecure protocol once used for transferring files from one server to another, or as a host server from which users can download fils. FTP has largely been replaced by secure versions of the protocol such as SFTP or FTPS, or by Web- or cloud-based storage and file sharing services.


Hypertext Transfer Protocol, a protocol used to send and receive information across the World Wide Web. HTTP has largely been replaced or supplemented by HTTPS, a secure version of the protocol.

Incremental Backup

A strategy whereby a complete backup is performed once, and then on each subsequent backup, only files that have changed are copied. (Used in Intego Personal Backup.)


An address for a computer using the Internet Protocol. (Used in Intego VirusBarrier.) Also used as shorthand to refer to an IP address (see IP Address).

IP Address

An address for a computer using the Internet Protocol. (Used in Intego VirusBarrier.)

Linux and Unix Viruses

Linux and Unix are categories of alternative operating systems with similar underpinnings to macOS. Naturally, they are not immune to malware, and are no safer than any other operating system. Intego VirusBarrier detects malware designed to infect Linux and Unix-like operating systems, ensuring that Mac users are safe from cross-platform threats and avoid spreading infected files to other computers.

Local Area Network (LAN)

A group of interconnected computers in a small geographic area. A LAN may be limited to a single building or may encompass a whole campus.

Mac Virus

A computer virus specifically designed to infect, or capable of infecting, a macOS-based system. Sometimes used generically to refer to any variety of Mac malware. (See also Virus, Malware.)

Macro Virus

A macro is a script, or series of commands, embedded within a file. Benign macros are used to create routines to save time and perform complex tasks. Some apps included with the Microsoft Office product suite, most notably Word and Excel, are known for their ability to run user-created macros. The extensive capabilities of macros have led to macro viruses, a subset of computer viruses (see Virus). Macro viruses can infect and damage Word or Excel files, and may cause other harm to infected systems. Macros are cross-platform by design, so many macro viruses affect Windows and macOS alike. Over the years, Microsoft has removed and re-added macro capabilities, and disabled or enabled macros by default. None of the safety features built into macOS have ever blocked macro viruses; third-party antivirus software like Intego VirusBarrier is required to eliminate this type of malware infection.


A generic term encompassing all potentially harmful, dangerous, or unwanted software or files, including but not limited to viruses, Trojan horses, backdoors (aka RATs), ransomware, wipers, worms, spyware, cryptojackers, and potentially unwanted apps (PUAs/PUPs).


A type of discussion group that uses a unique protocol (NNTP). There are several tens of thousands of newsgroups, each dealing with very specific subjects. To access this kind of content, you either need special software, or you can use a site such as Google Groups. Forums and social media platforms are popular alternatives to newsgroups.


The basic unit of data sent by one computer to another across most networks. A packet contains the sender’s address, the receiver’s address, the data being sent, and other information. (Used in Intego VirusBarrier.)


Viruses, Trojan horses, spyware and other dangerous types of computer code or programs are all grouped under the term "malware."


A program used to test reachability of computers on a network by sending them an echo request and waiting for a reply. The term ping is also used as shorthand for the echo request itself, and may also be used as a verb for the action of sending a ping message. (Used in Intego VirusBarrier.)

Ping Flood

A ping attack on a computer, where the sending system sends a massive flood of pings at a receiving system, more than it can handle, disabling the receiving computer. (Used in Intego NetBarrier.)

Port Scan

A procedure where an intruder scans the ports of a remote computer to find which services are available for access. (Used in Intego VirusBarrier.)


The set of rules that govern exchanges between computers over a network. There are many protocols, such as IP, HTTP, FTP, NNTP, etc. (Used in Intego VirusBarrier.)

Removable Media

Any data storage media that is inserted into a drive, such as a CD-RW or DVD-RW.. (Used in Intego Personal Backup.)


The process of copying files from your backup to your active Mac, after files on the computer have been lost, erased, or damaged. (Used in Intego Personal Backup.)


A computer connected to either the Internet or a private network that provides data, files, or other services to computers called clients. (Used in Intego VirusBarrier.)


A network function available on a server, such as HTTP, FTP, e-mail, etc. (Used in Intego VirusBarrier.)


Unwanted e-mail messages, usually sent to thousands or even millions of people at a time, often with a goal of selling products or services, or deceiving people. Also called unsolicited commercial e-mail, or junk e-maill. Sometimes used as a broad catch-all term that encompasses phishing scams (messages that link to attacker-controlled lookalike sites to try to steal your passwords) and other e-mails containing fraud, malware, or other malicious content.


Software that is installed secretively and enables a third party to spy on a victim, invading the victim's privacy. Spyware may include a keylogger (also called a keystroke logger; a tool that records everything a victim types) to capture sensitive information such as passwords and credit card details. Nefarious parties may also use spyware to monitor a victim's real-world geographic location or the Web sites they visit


The process of comparing two folders, volumes, or disks, and ensuring that both contain exactly the same files. Any files changed on one side are copied to the other. This is especially useful for ensuring that you have the same files on two computers you work on, such as an iMac and a MacBook. (Used in Intego Personal Backup.)


A utility that assesses the route that packets take to reach a particular destination host. (Used in Intego VirusBarrier.)

Trojan Horse

An app or file that claims to perform some useful task but contains malicious code. Trojan horses, also known as Trojans, usually rely on "social engineering" (deception) to get victims to install them. Trojan horses are consistently among the most common types of malware afflicting macOS.


Malicious computer code that is capable of reproducing and propagating. Viruses may infect apps, or files such as Microsoft Office documents (known as macro viruses). Viruses spread when the host app or infected files are run or opened. (Note: "Virus" is also sometimes used as a generic term to refer to all varieties of potentially harmful code; however, "malware" is the more accurate generic term.)


A mountable or attachable storage container for files, folders, and apps. Hard drives or removable media may contain a single partition or volume, or multiple. Disk image files may also contain one or more mountable volumes. (See also Partition and Disk Image.)


A list of trusted e-mail addresses, Web sites or domains, IP addresses, files, etc. Also known as an allowlist. In VirusBarrier, files and folders may be excluded from scans (i.e. whitelisted or allowlisted) by adding them to the Trusted Files list. Antonyms: blacklist, blocklist.


"Pronounced, "who is." An Internet directory service for looking up information on domain names and IP addresses. (Used in Intego VirusBarrier.)"

Windows Virus

A computer virus specifically designed to infect, or capable of infecting, a Windows-based system. Sometimes used generically to refer to any variety of Windows malware. Although malware designed to infect Windows PCs usually cannot harm Macs, VirusBarrier can detect and eradicate Windows malware to ensure it doesn't get inadvertently shared with Windows users. Naturally, Intego Antivirus for Windows also protects against Windows malware. (See also Virus, Malware.)


Malware that self-propagates over a computer network, often by exploiting vulnerabilities. One of the oldest forms of malware, computer worms can be difficult to stop because of their viral nature.