My XProtect.plist and XProtect.meta.plist files are not updating.

In System Preferences -> Apple Store deselect the 'Automatically loook for....' option. And select it again.

If that doesn't work, check your hosts file for unwanted entries with apple.com in it:

To find the hosts file, open Finder and, in Finder’s menu bar, select Go > Go to Folder. In the box, type the following location and press Return.

/private/etc/hosts

Open that file in any text editor.

Some claim the files where updated yesterday, mine isn't. There's a direct link to the new files floatin' around, but given the recent developments it might not be wise to use that. (Check the MacRumors site if you're feeling up to it. 😉 )

See if these files are present. If so, the best course of action is to re-install the OS.

Malware - iWorm

/Library/Application Support/JavaW/JavaW

/Library/LaunchDaemons/com.JavaW.plist

What makes you think that's not the last update?

sgginc wrote:

Thanks for the suggestions.

The option to Automatically look…was not checked.

I checked it and checked for updates in the Mac App Store.

XProtect updates do not show up in the Mac App Store, they are silent system updates that occur no more than once a day.

When where yours last updated?

The one before that was September 24.

Check your install.log in the Console and filter for "031-08850" without the quotes. That will tell you whether it has been cued for installation yet and when it get's installed. The previous update number was "031-05312" last month.

sgginc wrote:

I saw that file.

It supposedly downloads directly from apple:

http://configuration.apple.com/configurations/macosx/xprotect/3/cl

I don't want to copy and paste it into the plist.

I would not recommend that either since it's the update for Mountain Lion which could possibly be different. If you need the direct link to the Mavericks installer package, let me know. It's a full installer, not copy and paste.

Given that the definitions were updated the last couple of days, follow the steps in http://security.thejoshmeister.com/2011/11/how-to-update-apples-safe-downloads.h tml and run this command to manually update them:

sudo launchctl start com.apple.xprotectupdater

baltwo wrote:

sudo launchctl start com.apple.xprotectupdater

No longer works with Mavericks and above. The xprotectupdate function has been removed and integrated into the critical software update process.

sgginc wrote:

I would appreciate the Mavericks link.

http://swcdn.apple.com/content/downloads/25/16/031-08850/xuavybw3pll44md3r5ijzzx g85kb7jxa07/XProtectPlistConfigData.pkg

Recognize that this will only protect you against future malware downloads and will not find something that has already been installed on your machine.

Also, as far as we have been able to determine, the current iWorm threat is only found in pirated software downloads, so as long as you stay away from those you need not be overly concerned with this update.

Lastly, you should probably be concerned that something is wrong with the automatic update process on your computer. Although XProtect is one of the more important, there are many other critical updates that are supposed to take place almost daily.