You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

pcbjr Author

Level 2

347 points

Is the New Security Update Working on My Computers?

I have noticed that the XProtect.plist on 2 different computers have never updated since I installed the new Security Update on June 1. I have an Apple Care Product Specialist trying to figure it out.

But, I ran across this (pasted below) today when checking Console, and if anyone can dechiper logs, maybe some independent analysis will tell me why I'm not getting the "MacDefender" scan this security update was supposed to provide (and why the subject .plist has never updated since installing the Security Update on 2 10.6.7 Intel iMacs 4 days ago).

If anyone can dechiper the log and tell me what I might do to correct this problem, kudos!

The log entries (which contain a series of "failed") are:

Version:1.0StartHTML:0000000149EndHTML:0000004433StartFragment:0000000199EndFrag ment:0000004399StartSelection:0000000199EndSelection:00000043996/4/11 8:59:20 AM com.apple.launchd[1] (com.apple.xprotectupdater[39]) Exited with exit code: 255
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 22
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 21
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 20
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 19
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 18
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 17
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 15
6/4/11 8:59:24 AM com.apple.notifyd[12] EV_DELETE failed for file watcher 16
And
6/4/11 12:15:50 PM com.apple.launchd[1] (com.apple.xprotectupdater[39]) Exited with exit code: 255
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 22
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 21
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 20
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 19
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 18
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 17
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 15
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 16
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 30
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 29
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 28
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 27
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 26
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 25
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 23
6/4/11 12:15:54 PM com.apple.notifyd[12] EV_DELETE failed for file watcher 24
6/4/11 12:15:55 PM com.apple.WindowServer[80] Sat Jun 4 12:15:55 {INFO REMOVED}-imac.local WindowServer[80] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
6/4/11 12:16:32 PM com.apple.launchd.peruser.501[126] (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
6/4/11 12:16:39 PM com.apple.launchd.peruser.501[126] (com.apple.Kerberos.renew.plist[161]) Exited with exit code: 1
6/4/11 1:03:18 PM System Preferences[222] Could not connect the action resetLocationWarningsSheetOk: to target of class AppleSecurity_Pref
6/4/11 1:03:18 PM System Preferences[222] Could not connect the action resetLocationWarningsSheetCancel: to target of class AppleSecurity_Pref

Posted on Jun 4, 2011 10:29 AM

177 replies

MadMacs0

Level 5

5,227 points

Jun 7, 2011 1:31 PM in response to baltwo

baltwo wrote:

Don't know. Wrapped it all into an AppleScript app and run that, so [no] Terminal window involved.

OK and I don't think we will ever see anything more in the Terminal window as all of these 255 errors are occurring with the automatic updates, correct? I don't recall reading that anybody doing a manual update has seen one, let alone anybody doing a manual update via the Terminal commands.

baltwo

Level 9

62,374 points

Jun 7, 2011 3:51 PM in response to MadMacs0

Based on the time stamp and the launchd call. I suspect it's happening when the daemon is launching to update.

Jun 7, 2011 5:08 PM in response to MadMacs0

As previously reported above the error I get when running it via terminal is:

2011-06-04 14:12:03.883 XProtectupdater[3435:903] Unable to verify signature: Error Domain=com.apple.security Code=-25307 UserInfo=0x101905ac0 "The operation couldn’t be completed. (com.apple.security error -25307.)"

baltwo

Level 9

62,374 points

Jun 7, 2011 5:50 PM in response to Doug Hardie

Then, you have permissions or authorization issues within your keychain, since the error is and has nothing to do with the update:

errKCNoDefaultKeychain = -25307

Run Keychain First Aid on your login.keychain.

Jun 7, 2011 6:04 PM in response to baltwo

It found no errors. No changes. Same thing for repair permissions.

MadMacs0

Level 5

5,227 points

Jun 7, 2011 6:09 PM in response to baltwo

baltwo wrote:

Then, you have permissions or authorization issues within your keychain, since the error is and has nothing to do with the update:

errKCNoDefaultKeychain = -25307

Run Keychain First Aid on your login.keychain.

Actually, it could very well have to do with the update. There is an almost 4,000 character "Signature" that precedes the plist in the update file downloaded by XProtectUpdater. It is obviously processed before the writing the update to insure that XProtect hasn't been rerouted to a phony database and is probably compared to an Apple certificate that should be in your Keychain. If it's not present or there are other issues with your Keychain, as you suggest, then the update will fail. Recall that is one of the errors I listed earlier.

baltwo

Level 9

62,374 points

Jun 7, 2011 6:20 PM in response to MadMacs0

Could well be. That said, no I don't recall, but not surprising since there's so much other stuff going on and this isn't the only thread I'm following. As I noted, it's working here if I manually update and then check. Until Apple resolves the issue, that's about all I can offer.

Jun 7, 2011 6:22 PM in response to baltwo

In my case it works without any errors if I uncheck the auto download and then recheck it. It doesn't update automatically or manually via terminal.

MadMacs0

Level 5

5,227 points

Jun 7, 2011 6:28 PM in response to Doug Hardie

Doug Hardie wrote:

It found no errors. No changes. Same thing for repair permissions.

The Apple Certificates can be found here: http://www.apple.com/certificateauthority/ but I'm not familiar enough with it to tell you what you need or explain why you would not already have it. The computer I'm on right now has the first two in the KeyChain "System Roots" along with an "Apple .Mac Certificate Authority" and a couple of MobileMe certificates, one of which has expired.

baltwo

Level 9

62,374 points

Jun 7, 2011 6:48 PM in response to Doug Hardie

Interesting, since I have that checked in the Security prefPane and the Terminal command works without failure. Maybe you ought to download and reinstall the update and repair permissions.

MadMacs0

Level 5

5,227 points

Jun 7, 2011 7:18 PM in response to pcbjr

FYI, Apple just posted version 8.

MadMacs0

Level 5

5,227 points

Jun 7, 2011 7:23 PM in response to baltwo

baltwo,

Having the option checked or not will not affect execution via the Terminal command, it is just another way of forcing an out-of-cycle update.

Jun 8, 2011 9:31 AM in response to MadMacs0

something new to report here. As of today, I am seeing no code 255 at all. I am wondering if Apple tuned something on their end. I also, starting today, am getting the automatic updates. I have changed nothing, so it must be on their end...

MadMacs0

Level 5

5,227 points

Jun 8, 2011 11:10 AM in response to powerbook1701

powerbook1701 wrote:

starting today, am getting the automatic updates.

And by that you mean you got your update when you rebooted, but have not yet gotten an update 24 hours after a reboot, correct?

Jun 8, 2011 11:51 AM in response to powerbook1701

Still seeing the 255 error here and not getting the updates unless I manually invoke them

Is the New Security Update Working on My Computers?