Hacker News Reader

Comment by Philipp__ | Hacker News Reader

Can someone explain me what Xprotect.plist contains? Are those malware's that are recognized by Apple and are blocked and dealt with?

I saw some post on forum where dude said how his Xprotect now contains at the top OSX.KeRanger.A entry, and said how it means he got infected. It didn't made much sense to me, but I checked mine this morning and found the same entry? Does it mean I am infected too?

But I didn't download anything from their website like 3 months back, I just did the update to 2.90 in Thursday or Friday can't remember, and yesterday as soon as I saw the news I update everything and checked for malicious files and processes which weren't present on my machine.

View on HN

If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potentially right before they are opened?), but the XProtect.plist file is automatically updated by Apple, and that's what you're seeing.

The entry doesn't exactly mean you're infected, but just that your copy of the file was updated.

I have the entry for instance, but I was never infected. You can check your copy of XProtect with this command (I have 2076):

defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version

Edit: Looks like you do get a message before launching an app, if it's identified by XProtect/File Quarantine.

Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then?

Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.

If you ran the app before the XProtect definitions were updated, then it would've ran with no problem and you would've been infected.

Now it bugs me cause i can't find info on when the file was edited... Stats and defaults read display 20th January. wierd thing is that I ran the app during problematic time interval but havent found any single process or file that was mentioned in Palo Alto Security page, no kernel_services process or any other misbehaving. Anyway I did Time Capsule backup 10 days ago, and haven't plugged the drive into my computer since, so if anything happens I will roll it back. We shall see, but it is kinda uncomfortable to keep using "maybe infected" machine. Who knows what else may be left, supposedly nothing... Thanks anyway for the help! Cheers

Reply on news.ycombinator.com