How to Check if your Mac Malware Definitions List is Updated
The malware protecting Mac OS X Security Update will automatically download and update it’s malware definitions list from Apple, but if you’re like me you probably want to know how to manually check if the list is updated or not.
Check When the Mac Malware Definitions List was Last Updated
You’ll need to use the command line for this but it’s simple:
- Launch the Terminal (/Applications/Utilities/)
- Paste in the following command
- Look at the date entry between the string tags, shown highlighted below:
cat /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist
The date listed shows when the file was last modified, and the integer tag shows you which version the definitions list is. Assuming you haven’t disabled the anti-malware automatic updates (not recommended) and you are connected to the internet, this list should update on it’s own from Apple every day.
Force the Malware Definitions List to Update
If your malware definitions are outdated, you can force the list to download from Apple by doing the following:
- Launch System Preferences and click on the “Security” panel
- Click on the unlock icon in the bottom corner, enter your Administrator password to make changes
- Under the “General” tab, click to uncheck and then recheck the box next to “Automatically update safe downloads list”
The list should now update from Apple, you can verify you have the most up to date version by using the command line again as shown above.
This is a great tip, heads up to MacWorld, although they chose to use the ‘more’ command and I went with ‘cat’ mostly because it is shorter.
This seems to not be applicable to Snow Leopard Server.
pfbbt…
as root, a la sudo, if you please…
# ls -l /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist
-rw-r–r– 1 root wheel 7881 May 31 16:44 /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist
# /usr/libexec/XProtectUpdater
# ls -l /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist-rw-r–r– 1 root wheel 8991 Jun 2 14:48 /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist
huzzah!
Huzzah indeed! Why eat grass with the sheep when you can have bread and mutton with the farmer?
Is it just me or is this too complicated for Apple? Why can’t the definitions list update information be in the Security prefs right alongside the option itself? Wouldn’t that make more sense?
A rare failure of Apple’s generally simplistic handling of complex tasks.
Yes, “cat” is shorter than “more” but only if you have a short file to display other wise it is longer because you have to type: “cat|more” to page and doing so is really a waste of time.
[...] [via] Condividi questo articolo [...]
On Mountain Lion, after entering your administrator password, you’ll need to click on the Advanced button at the bottom of the General tab to see that setting.
Is there a terminal command I can send out via ARD that will do the equivilant of un-checking the “Automatically update safe downloads list” for all users ?
We are a school district and our main school data application on our Mac OS X 10.6.8 computers will not function completely without Java (Infinite Campus/Gradebook won’t work). We have to edit the Xprotect.meta.plist to get Java working again, then un-check “Automatically update safe downloads list” in Security control panel on thousands of computers. Looking for some terminal commands to resolve this via ARD.
Our service provider, an entity that works in all school in our area, has blocked the malicious attacks at firewalls and such and we have antivirus running on all computers so we should be safe with Apples items disabled until Oracle/ JAVA issue is resolved or until infinite campus gets a fix for JAVA issues from Oracle.