5 ms·

If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potent

If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potentially right before they are opened?), but the XProtect.plist file is automatically updated by Apple, and that's what you're seeing. The entry doesn't exactly mean you're infected, but just that your copy of the file was updated. I have the entry for instance, but I was never infected. You can check your copy of XProtect with this command (I have 2076): defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version Edit: Looks like you do get a message before launching an app, if it's identified by XProtect/File Quarantine.

Philipp__ 11y ago
Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then? Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.
- russjr08 11y ago
  If you ran the app before the XProtect definitions were updated, then it would've ran with no problem and you would've been infected.
  - Philipp__ 11y ago
    Now it bugs me cause i can't find info on when the file was edited... Stats and defaults read display 20th January. wierd thing is that I ran the app during problematic time interval but havent found any single process or file that was mentioned in Palo Alto Security page, no kernel_services process or any other misbehaving. Anyway I did Time Capsule backup 10 days ago, and haven't plugged the drive into my computer since, so if anything happens I will roll it back. We shall see, but it is kinda uncomfortable to keep using "maybe infected" machine. Who knows what else may be left, supposedly nothing... Thanks anyway for the help! Cheers

Philipp__ 11y ago

Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then? Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.

russjr08 11y ago
If you ran the app before the XProtect definitions were updated, then it would've ran with no problem and you would've been infected.
- Philipp__ 11y ago
  Now it bugs me cause i can't find info on when the file was edited... Stats and defaults read display 20th January. wierd thing is that I ran the app during problematic time interval but havent found any single process or file that was mentioned in Palo Alto Security page, no kernel_services process or any other misbehaving. Anyway I did Time Capsule backup 10 days ago, and haven't plugged the drive into my computer since, so if anything happens I will roll it back. We shall see, but it is kinda uncomfortable to keep using "maybe infected" machine. Who knows what else may be left, supposedly nothing... Thanks anyway for the help! Cheers