The latest I've heard through the grapevine is that Apple is indeed using a Symantec API. UPDATE: Ryan Naraine from Kaspersky Lab and Threatpost says in his ZDNet column that he has 'confirmed that Apple is not using the open-source ClamAV engine to handle these scans so it's likely the company has entered into an agreement with a commercial anti-virus company.' This supports my theory that Apple may have licensed the technology from Symantec, maker of Norton AntiVirus.

Regardless of whose engine is being used, it's exciting that Apple may be including anti-virus functionality in its next-gen consumer OS (if you believe the 'reports' that Intego claims to have seen).

Could it be that Apple licensed Symantec's virus scanning engine? Or could Apple have developed its own custom AV engine?

The only other company that appears to use the same malware name is Symantec. Since Intego obviously didn't know about this until today, it's clear that Apple didn't license the technology from Intego. The name ''-one of many names of a particular type of Mac-infecting malware-is used by Intego and Symantec, while Sophos and McAfee use different names (OSX/RSPlug-A and OSX/Puper.a, respectively).ĬlamAV seems like a logical engine for Apple to choose since it's freely available and has been part of Mac OS X Server for years, but ClamAV doesn't appear have a virus definition called it apparently only detects it as 'OSX.RSPlug'. The only clue seems to be the name of the malware in the screenshot. Intego's blog post is sparse on details, but one thing that they haven't explored is which antivirus engine Apple might be using behind the scenes. The following screenshot is alleged to show a system warning after downloading malware via Safari:

I just noticed a very intriguing post on Intego's Mac Security Blog claiming that Apple's upcoming operating system, Mac OS X v10.6 'Snow Leopard,' will have built-in antivirus functionality.

Sophos antivirus mac snow leopard