Snow Leopard's Xprotect malware scanner currently protects against two files, more could come

Seth Weintraub
|
August 26, 2009
|
Share

More from yesterday's revelation that Snow Leopard is protecting Mac users against certain file types.  Xprotect is the name of the plist file that Snow Leopard uses to look for malware.  It can be found here:

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist

Currently there are two files that Snow Leopard is looking for.  OSX.RPlug.A and OSX.iservice (described as a very low threat by Symantec) are trojans that can be attached as payloads on shady bittorrent installs like the iWork and CS4 files discovered earlier this year.  They need users to purposefully install them after entering administrator credentials.

The file is below:

Although a baby step, this is Apple's first forray into OS protection.  Apple could (and probably will) update this file as new threats emerge with Security Updates however .  Apple administrators could also edit this file, "protecting" users against bittorrent installers and other corporate "no-nos".

 

Comments (7)

9to5Mac Noob (not verified) | August 26, 2009 - 4:36pm

Well, it doesn't hurt to have protection. right?

9to5Mac Noob (not verified) | August 26, 2009 - 6:58pm

that's why i use trojans every time (i love the pun, haha)

9to5Mac Noob (not verified) | August 26, 2009 - 7:04pm

i agree and its another reason not to download software illegally.

CripMan (not verified) | August 26, 2009 - 8:48pm

I personally think this is the start to what Vista went through... all the authorizations and crap like that to make sure u dont install anything bad. The numbers may not be there yet but i fear they will soon come

AG - 9to5Mac Noob (not verified) | August 26, 2009 - 10:11pm

No vista was in a league all of its own.

And that had nothing to do with stopping malware. That was Microsoft trying to stop stupid users from breaking the most basic of features.....

For example playing around with msconfig.msc

This on the other hand is basic code implemented to stop malware without the need of a 3rd party application that PC users have come so used too needing.

Even though there are not many (i wont say no because that's just impossible) viruses/trojans/spyware etc for macs. It doesn't mean that we have to keep a blind eye on them.
Isn't it better to stop them in their tracks before it comes to the point of having them cripple a system.

Mind you on saying all that as soon as Microsoft find out that macs can possibly get virus' and have implemented software. I have no doubt that they will try to use it in some lame laptop hunters ad somewhere.

9to5Mac Noob (not verified) | August 29, 2009 - 5:29am

suck my balls

VARIASSUB (not verified) | September 03, 2009 - 1:33am

genisoneync
rfeg
Breewsteewnok
Bpgf