Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 2

347 points

Is the New Security Update Working on My Computers?

I have noticed that the XProtect.plist on 2 different computers have never updated since I installed the new Security Update on June 1. I have an Apple Care Product Specialist trying to figure it out.

But, I ran across this (pasted below) today when checking Console, and if anyone can dechiper logs, maybe some independent analysis will tell me why I'm not getting the "MacDefender" scan this security update was supposed to provide (and why the subject .plist has never updated since installing the Security Update on 2 10.6.7 Intel iMacs 4 days ago).

If anyone can dechiper the log and tell me what I might do to correct this problem, kudos!

The log entries (which contain a series of "failed") are:

Version:1.0StartHTML:0000000149EndHTML:0000004433StartFragment:0000000199EndFrag ment:0000004399StartSelection:0000000199EndSelection:00000043996/4/11 8:59:20 AM com.apple.launchd[1] (com.apple.xprotectupdater[39]) Exited with exit code: 255
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 22
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 21
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 20
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 19
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 18
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 17
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 15
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 16
And
6/4/11 12:15:50 PM com.apple.launchd[1] (com.apple.xprotectupdater[39]) Exited with exit code: 255
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 22
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 21
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 20
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 19
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 18
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 17
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 15
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 16
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 30
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 29
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 28
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 27
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 26
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 25
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 23
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 24
6/4/11 12:15:55 PM com.apple.WindowServer[80] Sat Jun 4 12:15:55 {INFO REMOVED}-imac.local WindowServer[80] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
6/4/11 12:16:32 PM com.apple.launchd.peruser.501[126] (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
6/4/11 12:16:39 PM com.apple.launchd.peruser.501[126] (com.apple.Kerberos.renew.plist[161]) Exited with exit code: 1
6/4/11 1:03:18 PM System Preferences[222] Could not connect the action resetLocationWarningsSheetOk: to target of class AppleSecurity_Pref
6/4/11 1:03:18 PM System Preferences[222] Could not connect the action resetLocationWarningsSheetCancel: to target of class AppleSecurity_Pref

Posted on Jun 4, 2011 10:29 AM

177 replies

MadMacs0

Level 5

5,221 points

Jul 4, 2011 12:31 AM in response to pcbjr

pcbjr wrote:

OK.

10.6.7 came out. I updated on many computers. All had the new Security Check in Sys Prefs. Didn't update one (my Wife's) to 10.6.7. Did today. No Automatic Safe Downloads List on that computer, but on 7 others.

???????????????

Sorry, but that is just not possible. The 10.6.7 combo update contains Security.prefPane v2.2 dated 12/21/2010, months before the XProtect Update capability came out for SL. The first time the update option became available was in v2.3 dated 5/25/2011. Also, none of the other components of the update system are included in the 10.6.7 update package. The only way you could have seen such an option on the other seven is if the SecUpd2011-003Snow.dmg was installed at the same time, after 5/31/2011. Note that your first post on this subject was June 4.

pcbjr Author

Level 2

347 points

Jul 4, 2011 6:58 AM in response to MadMacs0

Not quite following you.

I updated a bunch of iMacs to 10.6.7 with the download Combo, and added whatever other updates were called for in Software Update on those.

All of them have the Automatic Safe Downloads List in System Prefs. All have the XProtector .plists in CoreTypes Bundle>Package Contents>Resources.

By contrast:

I updated my Wife's MBP from 10.6.5 to 10.6.7 yesterday - and it does not have that Automatic Safe Downloads List in Sysyem Prefs>Security. I went to HD>System>Library>Core Services>CoreTypes Bundle>Package Contents>Resources and there is no XProtector .plist to be found.

I reapplied the Combo to the MBPand alas, same results.

Something is either wrong with the update I did, in which case I'm asking for assistance, OR Apple hase changed it.

Can anyone clarify and/or assist?

pcbjr Author

Level 2

347 points

Jul 4, 2011 8:08 AM in response to pcbjr

Allow me to add a P.S. -

On the MBP, inside CoreTypes Bundle>Package Contents>Resources there is an XProtect.plist - dated January 9, 2011; there is no XProtect.meta.plist.

Apple>About This Mac shows 10.6.7 on the MBP.

There is no security update under Software Update for the MBP.

R C-R

Level 6

17,782 points

Jul 4, 2011 8:10 AM in response to pcbjr

pcbjr wrote:

I updated a bunch of iMacs to 10.6.7 with the download Combo, and added whatever other updates were called for in Software Update on those.

If you do the same for your wife's MBP, you should get the same results.

You seem to be confused about what the 10.6.7 update includes. As others have said, it does not include the XProtect update. To get that, you must install Security Update 2011-003 (or the 10.6.8 OS update).

pcbjr Author

Level 2

347 points

Jul 4, 2011 8:15 AM in response to R C-R

OK - I understand now and Thanks!

However, the is no Security Update called for under Software Update on the MBP.

Is there a way to determine if it has even been installed?

R C-R

Level 6

17,782 points

Jul 4, 2011 8:48 AM in response to pcbjr

The Software Update app does not list the Security Update 2011-003 now that the 10.6.8 OS update has been released because the 10.6.8 update includes it.

Software Update always offers the smallest, most efficient download that will bring a Mac's installed OS software up to the latest available version. Since the security update has been rolled into the 10.6.8 update, there is no reason for SU to offer it separately. So if you want to avoid updating to 10.6.8 for some reason, but still want (most of) the latest security features, you will need to download the Security Update 2011-003 from Apple & install it manually, in the same way you might install a Combo update when Software Update only offers a smaller delta version.

"XProtect" is Apple's name for the malware detection software it quietly introduced in an earlier Snow Leopard update, sometime around version 10.6.4 or so. Originally, it only detected two OS X trojans; a third one was added in a later update. (This is why your wife's MBP has a XProtect.plist file.) But after the advent of the MacDefender trojan & all its variants, Apple upgraded XProtect's capabilities in two ways: the automatic update feature was added so detecting new variants would not require a separate security or OS update, & the ability to remove as well as detect the malware was added.

Jul 4, 2011 8:55 AM in response to pcbjr

pcbjr wrote:

Is there a way to determine if it has even been installed?

Try opening Console.app from an administrator account and look at the install.log. Do a text search for "2011-003". If the update was installed from the stand-alone update, then I think it should show up here.

pcbjr Author

Level 2

347 points

Jul 4, 2011 9:15 AM in response to steveBinLA

Thanks!

It wasn't installed and wasn't showing up for the reason that R C-R explained.

How do I give each of you a Helpful tag (still can't figure out the layout on the revised Board!

Jul 4, 2011 11:22 AM in response to pcbjr

you can also just open the software update preference pane and choose the "installed" tab to see what and when something was installed.

ArieRoos

Level 1

0 points

Jul 4, 2011 12:48 PM in response to powerbook1701

powerbook1701 wrote:

as Madmac stated, security update 2011-003 required OS 10.6.7 to install.

By the way, do we know what the new security update preference version fixed with the 10.6.8 update?

Since I installed 10.6.8 I don't get any errors anymore about network connections after a reboot of my system.

Can't say if the update mechanism is now actually checking daily as no updates have been made in the last week.