xprotect

[dennisfcampbell]

inadvernly downloaded opened an attachment in mail ..........it was a windows attachment and "sender" did not send ......changed pass words called bank and email service provider
am running 10.6.8 snow lep. activity monitor indicated that xprotector had been terminated checked in core services and it had been modified that day i have very little personal info on system but im afraid that key logging may be engaged how do i check and what can i do besides a clean /reinstall.......have limited knowledge of tech stuff .....
am afraid this late 2007 mac will not survive reinstall ......mother board replaced 3 yrs ago and a sandisk ssd U11 125 gb installed recently.......need some direction/ help ...
thanksd

 

[Cory Cooper]

Hello and welcome.

XProtect is Apple's built-in anti-malware service. It regularly updates itself, so it was probably a coincidence that it updated the same days as your email issue.

As long as you didn't do more than download the attachment, you can simply delete the file from your Downloads folder and you should be just fine. Just let us know if you have any additional issues, or if your Mac starts to act outside the norm.

C

 

[dennisfcampbell]

thanks for the welcome and getting back to me ............
i did open it ...its was an old word text box application and opened in word, it said beware macros is off click edit to read, the text never opened so i binned it.....so began the possibility that id had made a huge mistake and something may or may not have loaded into my computer
my understanding is that apple stopped doing security updates for snow lep. some time ago .... did snow lep.Xprotect get abandoned as well?..........does date created on the plst / meta plst refer to an update ?....time machine back up will not open package contents to view previous date changes in Xprotect plst / meta plst .....( the icon on the last back up before the email and the current icon are the same ..however all previous back ups going to back 2013 have a plain plug in icon w/o the orange P. is this in anyway connected or separate ? ) thanks again for the help...........
d.

 

[Cory Cooper]

Correct...Apple doesn't update Snow Leopard any longer. However, the XProtect definitions are still updated. I am currently typing on an old Mac mini that is running Snow Leopard. My XProtect.meta.plist has the exact same modified date as yours. Also, my CoreTypes.bundle icon is the same - with the orange P. Strange that is on there, as that P is the Microsoft PowerPoint logo icon. But, my Mac is running 100% flawlessly, so no worries there.

As a courtesy suggestion, it really isn't wise to be digging around in the System folder if you don't have experience and know what you are doing, You can easily damage Mac OS X and cause issues that could prevent your Mac from starting up.

I really think you are OK since you trashed the original downloaded file.

C

 

[dennisfcampbell]

c,
thanks for the information and the advice ...........all i do is look, never any changes, as you say i dont have the experience to be moving things around .......ric is the tech genius in the village and when i see the waters rising he is the go to..........stay safe......
regards
peaceful