New Mac OS X Trojan disguises itself as Adobe Flash

Cem
Valued Contributor

Hi Karthikeyan,

Mac OS has a mechanism to do; "Automatically update safe download list" in
System Preferences / Security. That should take care of it I wish to
believe...

See here for more info
http://support.apple.com/kb/ht4651

You can check the last modification date and time with this command.
defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.m
eta LastModification

And the version with this one.
defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.m
eta Version

Or this will tell you all.

cat /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.m
eta.plist

I think MCX, defaults or plistbuddy to this plist may force it to be
enabled for client Macs (TBC).
/System/Library/LaunchDaemons/com.apple.xprotectupdater.plist

Also another plist file to tell you what has been applied (you can see Mac
Defender etc...)
/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.p
list

There is a discussion regards xprotect and security updates here in
MacEnterprise:
http://groups.google.com/group/macenterprise/browse_thread/thread/ea80f7167
f5ffe53

Cem

0 REPLIES 0