Solved

Macbook Pro issue with Threats/Quarantine

  • 30 October 2015
  • 11 replies
  • 170 views

Hope someone can help, this started 2 days ago when my scan was running. The threats were quarantined, I did the removal option, scan started again and all was good. Today, the same thing only this time, it keeps telling me the threats are there, I use the removal option, it starts scanning again and the threats reappear. Haven't a clue what is going on, hope someone can direct me to how to fix it. It's the same threat, over and over again.

icon

Best answer by Ssherjj 30 October 2015, 16:49

View original

11 replies

Userlevel 7
Badge +62
Hello ?,
 
Welcome to the Webroot Community,
 
I would like to ping our Mac Threat Reseacher ? to see if these are false positives. Either way leave those "text files in Quarantine until you hear from him.
 
You could also submit a Support Ticket free of charge with an active Webroot subscription. They usually will get back to you right away. You can use this link here to send to support so that you don't have to explain this again as this will show your issues.
 
Hopefully Wanderingbug will be online shortly.
 
Thanks,
 
 
Userlevel 7
Hello alik57,
 
Can you please provide the path that the threats are being found at?  This will help me understand what is happening.
 
Thanks,
Is it this?
 

Userlevel 7
@ wrote:
Is it this?
 


We are unable to remove any files from backups due to the way that OSX is set up.  I recommend that you allow the files in your backup or if you are not using timemachine backup to turn it off in your settings and this will resolve your issues.
Thank you so much for getting back to me with a solution.  It was driving me crazy!  So just to be clear, these aren't a threat to my system?
Userlevel 7
Badge +62
Hello ?,
 
Please have a look at https:///t5/Webroot-SecureAnywhere-Antivirus/How-do-I-remove-pua-bundleinstaller-gen-from-my-macbook-pro/m-p/180342#M11916by ? that explains this for you.
 
 
Hope this helps?
I have the same issue and I looked at the threads to look at but am still confused about what this is.  It is hard to ignore even though just on the back up.  Is there a way to get rid of it completely so I don't have to just ignore it?
 
Gary
Userlevel 7
Badge +62
Hello ?,
 
Welcome to the Webroot Community,
 
Do you have Time Machine hooked up as your backup? Do you have in your Settings Scan Mounted Drive checked?
 
Uncheck this.. as shown HERE in the Mac User Guide? Also you may understand this better by looking at this post
 
If Webroot continues to detect these files that you uncheck the box next to them on the removal page. This will tell Webroot to ignore the files in their current location. I am not sure of anyother way to do this otherwise.

? do you have anything to add here?
 
If you still need help then my advice would be to Submit a Support Ticket so that they can assist you further with this. This is a free service with an active Webroot subscription.
 
Hope this helps?
 
 
Sherry, thank you for your reply.  I did uncheck the mounted disk drive so it no longer scans the time machine backup but isn't that just putting my head into the sand.  Don't I want to get rid of it?
 
Gary
Userlevel 7
Badge +62
Hi Gary!
 
Maybe this explanation from here can help you understand how the threat cannot hurt your system if it is in the back up drive. 
 
? Has explained to me...  https://community.webroot.com/t5/Webroot-SecureAnywhere-Internet/thread-in-time-machine-backuo/m-p/178303#M4518. 
 
If if you have problems understanding this procedure then remember there is an option to Submit a Support ticket and they can help you as well.
 
Our Mac Threat Researcher will be on later today and he'll be able to assist us further...ok?
 
Thanks!
Userlevel 7
Hello gmcarlmrnet,
 
This file is in the Apple Kext Exclude List, which is a file that Apple uses to allow certain files to run on the machine without Gatekeeper's permission. The reason we are picking it up is because we are looking for a string of code which Apple is also looking for. There is an exclusion in place to allow the file on the actual machine but we do not have an exclusion for backups like this as this would cause an exploit in our detections.  The file is not malicous in nature at all.  
 
regards,
 

Reply