4 ms·
If the file /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist contains: <dict> <key>Description</key>
by nodesocket 11y ago
If the file /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist contains:
<dict>
<key>Description</key>
<string>OSX.KeRanger.A</string>
<key>LaunchServices</key>
<dict>
<key>LSItemContentType</key>
<string>com.apple.application-bundle</string>
</dict>
<key>Matches</key>
<array>
<dict>
<key>MatchFile</key>
<dict>
<key>NSURLTypeIdentifierKey</key>
<string>public.unix-executable</string>
</dict>
<key>MatchType</key>
<string>Match</string>
<key>Pattern</key>
<string>488DBDD0EFFFFFBE00000000BA0004000031C04989D8*31F64C89E7*83F8FF7457C785C4EBFFFF00000000</string>
</dict>
</array>
</dict>
Does that mean I am infected?
- brians 11y agoNo. That means you have up to date protection against being infected.
- unfamiliar 11y agoWhat does the <string> match pattern mean exactly, how is it used to identify the executable?
- tomschlick 11y agoThe match type is saying that to match a file it must be fingerprint (hash) match using the Key provided below it.