Is the New Security Update Working on My Computers?

Just to add another variable here, I was having problems myself. My XProtect.plist had not been updated (modification date was 5/25), but everything I could find indicated that launchd was aware of it and was supposed to be running it every 24 hours. No errors whatsoever relating to XProtect in the Console.

I finally tried rebooting, which I hadn't done since before the update. (This update did not require a reboot.) Now I've got the updated XProtect.plist file with definitions all the way up to OSX.MacDefender.E. However, interestingly, I now have the following error, with the time matching up with when I rebooted:

6/4/11 8:00:24 PM com.apple.launchd[1] (com.apple.xprotectupdater[25]) Exited with exit code: 255

So, since I got this message on a successful update, it may not actually indicate a problem. But I guess time will tell. We'll see what happens at 8:00 tomorrow night!

chiming in, I mentioned I am getting that 255 as well. I am guessing that is not causing anyone of us issue, as long is that is the only thing showing up in console. I drilled down to the two plist files, viewed them with quicklook (thus avoiding actually opening the files) and was at "interger 5" on the meta plst, and all the way up to "E" version on the other plst file.

Odd that this SU did not require a reboot. At initial install, I waited about 30 mintues before rebooting (which may be why the CPU hog bug did not affect me). Maybe some people rebooted right away and interupted the one time only scan process.

I am also really surprised that the default is only every 24 hours. With the rate of new variants out there, you think Apple would have upped the frequency of checks. I'll be we see an update that lets us see "last updated on" and "update now" functions to the security preferences pane...

EDIT: since we are seeing this console line at startup, could this mean that the xprotect checks for updates upon restart regardless??

Message was edited by: powerbook1701

> Did this and it reverted back to 5/25/11.

Just so I'm clear you did the sudo... command and now you are seeing this date where, the file itself or in the AS window? If the file, is it the Creation or Modification date? What version does the AS give you?

Yes. No problem using Quicklook. However, I usually just read them with the Property List Editor, an Xcode tool. The last entry is OSX.MacDefender.E, since I'm now showing version 5 installed.

Just checked after booting into another volume w/o the update and back again this evening. I did get this in All Messages:

6/4/11 8:52:42 PM com.apple.launchd[1] (com.apple.xprotectupdater[23]) Exited with exit code: 255

As others have noted, probably meaningless. As long as the version updates after running the sudo updater command, you should be good to go.

thanks for verifying and reporting.

I use quicklook just because it's easy, means I don't actually open the file, and I have no idea if I ahve or how to use the xcode thing.

I just had the idea to use quicklook since I noticed it could read txt files and that meant I didn't have to risk accidently changing something by accident if I actually opened the plst files...

Over on the clamxav forum, a user reported some good other methods too...

oh, I asked this on the other forum, but since this line appears in console at startup, is it possible the updater is also checking at startup, regardless of the 24hr thing? I had read on Intego that this is so, but have seen no one else confirm it..

Follow-on. See bash exit codes for the 255 one.

More evidence of a bug, but mine is still at 5 (and I hear 6 is out), and I have restarted multiple times. So, since this is suppose to be checking at startup, I'd say the 255 error code IS an error that it isn't checking for new defs at startup.

Toggling the system prefs pane option does force and update (if you go that route). All the other options for checking work too (that have been released elsewhere), but I wanted to see if the system was working like it should...and it's not.

Is this a system that completey replaces the definition file, or does it just add to it? I can't tell...

baltwo, what message are you getting in terminal after running

sudo /usr/libexec/XProtectUpdater

are you getting anything in console as well?

I just checked the status and got this:

Ran the command and got this:

So, it appears that the LaunchDaemon script isn't getting invoked or is failing because there is this in Console:

6/6/11 6:02:47 PM com.apple.launchd[1] (com.apple.xprotectupdater[24]) Exited with exit code: 255

which might indicate that the script is failing. I'm preparing a bug report.

For bk1992 I see this after running the script:

6/7/11 11:29:42 AM sudo[940] root : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/libexec/XProtectUpdater

which from all appearances is just a status report.

So no messages in the Terminal window. I believe the exit message choices to be:

NSURLConnection error: %@

Unexpected status code: %ld

Unable to verify signature: %@meta

Ignoring new signature plist: Not an increase in version

Last-Modified GMTEEE',' dd MMM yyy HH':''mm':'ss 'GMT'

Last-modified date is later in time than current date

Unable to write new signature meta plist

Unable to write new signature plist

which would not be acceptable to bash, so reported as 255.

Don't know. Wrapped it all into an AppleScript app and run that, so Terminal window involved.