Suspicious Activity Detected helper.plist

carmine104 wrote:

Hi,

I'm running WebRoot to scan a MacBrook Pro with Catalina 10.15.7 and WebRoot detected suspicious activity System Folder Modified: /System/Library/LaunchAgents/com.apple.quicklook.ui.helper.plist/usr/libexec/runningboardd

Is that really what it said? Because that makes no sense. There is a file "/System/Library/LaunchAgents/com.apple.quicklook.ui.helper.plist" and there is a file "/usr/libexec/runningboardd" but they don't have anything to do with each other.

I guess it is complaining that /usr/libexec/runningboardd is making this change. However, it is referencing a system file, not a system folder. And the system folder is read-only in Catalina so there aren’t any changes at all being made. I guess you would have to get WebRoot to explain it. I sure can’t.

... determine how industry auditor's might react to no A/V.

"No A/V" is a common misconception. macOS already incorporates all the anti-virus protection it needs. It has been so since its inception two decades ago, and was derived from an inherently secure operating system decades older than that. It resides on a protected and unalterable volume off-limits to anything beyond Apple's sole ability to alter through servers under Apple's exclusive control. It updates its virus / malware definitions constantly. For some third party vendor to assert they know more about Macs and macOS than the most famously secretive company on Earth is one of life's great mysteries. Such claims should be regarded with extreme suspicion, if not outright derision.

"Webroot" may prove difficult to eradicate, a common characteristic of junk. This site is littered with tales of misery that began with installing it and things like it. The resulting aggregate cost expressed in terms of lost productivity, time, money, data, tears, suffering and general mental anguish is beyond human comprehension.

That is the reason for my "rule 1" comment. It's a lot shorter than this longwinded explanation. Just don't do it.

<< This software was 'sold' to me by an Authorized Apple Dealer, Best Buy. >>

Those guys make money from the sale of anti-Virus, either directly from you, or kickbacks from the anti-Virus vendors. They are NOT dis-interested parties and can give you impartial advice.

-------

In my opinion, if you are running El Capitan or later, you don't need third-party anti-Virus, unless you want Less performance (they never stop reading your files and interfering with your communication) or you LIKE crashes.

Effective defenses against malware and ot… - Apple Community

.

this article, by John Galt, is a good treatise on the subject. He is too modest to recommend it himself.

Effective defenses against malware and ot… - Apple Community

.

I have the exact same software and the exact same problem. This software was 'sold' to me by an Authorized Apple Dealer, Best Buy. When I asked if something like this was necessary, I was told that although Mac's are 'supposed' to be safe, he (the sales rep) said he has had more and more Mac users tell him they're have had 'issues.' He said that as he handed me a card for Webroot saying this is what he tells all Mac users to download.

For over a year, I have never had an issue...now, I am getting the same notice. Repeatedly.

Whoever said Webroot was changing the system to clarify IGNORE or OK is completely wrong. You're comments are from 2017 and my purchase was in December 2019. NOPE...it is STILL confusing! What am I ignoring and what am I saying OK too? Totally confusing. After 30+ scans without an issue, I have suddenly started to get this message. Again, when it says IGNORE, what am I ignoring and if I press OK, what am I saying OK too. WHY am I getting this message now when I haven't seen anything like it for over a year.

So, IF Mac's really have BUILT-IN armor and are totally impenetrable which someone alluding too in this thread, then WHY am I getting this message repeatedly, all of a sudden? I've not downloaded anything recently. However, my message doesn't say quicklook (?) or runningboardd....mine refers to microsoft....and I do use Word for Macs.

I have the same question

There are 12 people with the same question, including me.

Halimaryland wrote:

There are 12 people with the same question, including me.

And John Galt’s reply solves them all!