Suspicious Activity Detected helper.plist

carmine104 wrote:

Two Macs are using WebRoot in separate physical locales. Only one has displayed the comment.

Today's message from Secure Anywhere:

System Folder Modified: /System/Library/LaunchAgents/com.apple.SoftwareUpdateNotificationManager.plist/usr/libexec/runningboardd

Sorry, but that simply makes no sense.

By the way, WebRoot offers the following: "To allow this app to make changes in the future press 'ignore'. If it means the MacOS app, then hit ignore. If it means WebRoot is the app, then I would say don't hit ignore.

Maybe a screen shot of that dialog would be helpful.

This indicates, to me, that WebRoot may be detecting software update changes. But, only one of the two systems show's this message. Before I uninstall it, want to make sure there is not something else going on AND determine how industry auditor's might react to no A/V.

Sorry, but I’m just totally confused about what this software is doing and what it is supposed to be telling you. I also don’t know what you mean about “industry auditors” either. You shouldn’t be running any kind of regulated industry from your home Mac.

To be clear, your Mac is perfectly secure. The macOS operating system already includes multiple levels of protection from malware. But Apple protects the system itself against malware. The user is always allowed to override those protections, even if they are being ill-advised or outright scammed. Third party antivirus software is only useful in the sense that it protects the computer from the user.

Either this software has gone completely haywire, or you don’t understand what it is telling you, or your operating system is corrupt beyond repair. I can’t tell which.

carmine104 wrote:

I'm running WebRoot ...

Don't.

Uninstall "Webroot" in strict accordance with its instructions. Rule 1 of Macs is don't install junk.