False notification with Microsoft Defender?

tgwilloughby

I have tried and currently use different anti-virus and trojan detection software on my desktop Mac (27" iMac, 3.6 GHz) as well as my MacBook Pro 16, both still running the last Intel chipsets. I am running the latest versions of MacOS and anti-virus software as well as the latest version of SecuritySpy.

I also have a subscription for Microsoft Office 365 for Mac and have been trying the Microsoft Defender app for the Mac. The Microsoft Defender app appears to be quite good, especially at catching junk email trojan attempts, except it keeps giving me virus alerts for the past three versions of SecuritySpy software.

This is an example of the error: /Applications/SecuritySpy.app/Contents/Resources/ips2crash and /private/tmp/dmg.n0Yrmu/SecuritySpy.app/Contents/Resources/ips2crash and will either quarantine or delete the file.

I can work around the anti-virus app software and install SecuritySpy and all seems well. I just want to share my concern and see if anyone else has seen this alert. It does not seem to happen with BitDefender, Intego Antivirus, nor with CleanMyMac malware scan. All other scans do not show any virus infections to be concerned with. Is it just a false positive for this particular resource file?

Thanks!

Tom

Ben

This appears to be a false-positive detection by Defender. This is actually the second report we've had this week about this, so it could be a new problem in a recent update of Defender. Upon further reading, this seems to be quite a common false-positive with Defender in general.

ips2crash is a small command-line utility that converts from one format of macOS crash log (.ips) to another (.crash) for the purposes of creating human-readable versions of these logs. SecuritySpy uses this for creating debug files, which we request from users if they are experiencing problems, and this greatly helps us debug and fix users' problems.

While this isn't our code, we have audited it to confirm it's legitimate and doesn't contain anything malicious. It's public code, has existed for many years, and is used by many other developers.

Due to it's nature, it contains references to computer architecture and low-level macOS workings, and it could be these that are tripping up Defender. Note also that the particular virus that Defender is flagging ("Wacatac.A!ml") appears to be malware for Windows, whereas ips2crash is a macOS utility - there would be no point in including a Windows virus in macOS software.

I would say that the best thing to do is to remove Defender, or at least add an exception so that it doesn't bother you about this.

Robbie

@tgwilloughby. My suggestion would be to uninstall Defender. These third-party apps cause nothing but problems.

Note that the Mac comes with multiple levels of security built-in.

And in that regard, you may find the following article of interest?

https://support.apple.com/en-gb/guide/security/sec469d47bd8/web

Ben

I agree with @Robbie

tgwilloughby

Thanks all! Just trying to keep ahead of the hackers and spammers.

Ben, thank you for great products and service!

Tom

Robbie

I came from Windows -- 20 years ago now -- and the first thing I bought for my Mac was an anti-virus package. 😁

I think you'll find that the majority of grognards don't recommend anti-virus software for the Mac, especially as more recent iterations of MacOS has completely separated the operating system itself from the user's data. Only Apple has access to the operating system.

That said, I do recall and understand the comfort that an anti-virus package offers..... They just aren't necessary.