Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Get Safe Downloads List last update time and current version System 10.6
Snow Leopard only hintWhether you are an IT admin or a vigilant home user who wants to know when the Safe Downloads list (used with Safari) was last updated, here's the Terminal command to do that.

Date and Time (GMT):
defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta LastModification
Version Number:
defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version

[crarko adds: I tested this, and it works as described. I always turn off the 'Open safe files after downloading' setting in Safari on any machine I use, but this is good info to know.]
    •    
  • Currently 3.75 / 5
  • 1
  • 2
  • 3
  • 4
  • 5
  (4 votes cast)
 
[7,498 views]  

Get Safe Downloads List last update time and current version | 12 comments | Create New Account
Click here to return to the 'Get Safe Downloads List last update time and current version' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Get Safe Downloads List last update time and current version
Authored by: whustedt on Jun 03, '11 10:25:11AM

I wrote a shellscript to debug the update-process in more detail.

It displays:
1. The changedates of the relevant files.
2. The version of the malware-def
3. Entries related to XProtect from System.log

You might need to modify the username for the grep-command though. Mine is "admin".


#!/bin/bash
# this is to test the XProtectUpdater-service.

XPROTECT_DIR="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/"
LOG_DIR="/private/var/log/"

echo
echo -e "\033[1;37m META-INFO \033[0m"
ls -l ${XPROTECT_DIR}XP*

echo
echo -e "\033[1;37m META-CONTENT \033[0m"
defaults read ${XPROTECT_DIR}XProtect.meta

echo
echo -e "\033[1;37m SYSTEM.LOG \033[0m"
su admin -c "grep XProtect* ${LOG_DIR}System.log"



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: joelbruner on Jun 03, '11 10:57:49AM
I decided I needed some dashcode exercise and made a widget too, you can find it on my blog... Safe Downloads List Info Widget

[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: chrischram on Jun 03, '11 11:18:11AM

Nice looking widget. How about adding a "Force Update" button that runs:

sudo /usr/libexec/XProtectUpdater



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: joelbruner on Jun 03, '11 02:44:50PM

Well the trick is that it's a sudo command, so there needs to be a way to authenticate via GUI. I can map that command to a button, but then it freezes the widget because there is no user interface to authenticate to. So rather than figure out a way (maybe I could have it spawn a terminal window that is fed the sudo command that then prompts? But that is sort of inelegant for a widget) So, I figure I'll leave that in the hands of Apple, the only apparent way is to force an update is to toggle the setting on and off in the Security prefPane. So for now it'll be a purely informational widget. Thanks of the suggestion though!



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: glusk on Jun 07, '11 09:31:14PM

Maybe applescript to authenticate?

osascript -e 'do shell script "sudo /usr/libexec/XProtectUpdater" with administrator privileges'



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: everkleer80 on Jun 09, '11 08:19:47AM

I think I recall reading some Apple KB article saying you shouldn't use 'sudo' with 'with administrator privileges' (ie. I think your applescript shell script will work without sudo - though I'm not positive on that.)

Edited on Jun 09, '11 08:20:12AM by everkleer80



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: hdms on Jun 03, '11 05:23:50PM

Thanks for this hint - this was an interesting exercise running these scripts.

I'd installed the Apple Security update when it came out 1st June, and noted it reset some of my Safari prefs. I have Open Safe Files off by default - it was turned back on after the security update. I turned it back OFF again. iMac has been rebooted several times since then. Safari is my main browser.

I ran the first script, which informed me the modification date was 1st June. I ran the second script, which told me the version number was 1.

I then unchecked/checked the updates box in Security prefs to force an update, as was mentioned in the article, and re-ran the scripts - the mod date was then 3 June (it's 4 June here), but the version number was now 4.

If I hadn't forced the update, I'd still be at version 1 of the updates, 1st June. The question is - why is it not auto-updating like it's supposed to? Is it because I have 'Open Safe Files' off that it doesn't download the update when I use the iMac / Safari? Or is the update mechanism independent of Safari?

Also, is this security update only Safari-oriented, and not machine global in its application? Does it function if you use other browsers like Firefox?



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: whustedt on Jun 06, '11 10:58:17PM

Same problem here. (That's why I wrote the script).
I guess you're not logged in as an admin all the time? Updates seem to be prevented by this.

I already filled a bugreport. But you should do that as well, so they might notice this is a real issue.
-> bugreport.apple.com/



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: chrischram on Jun 04, '11 12:12:49AM

I have posted a very quick-and-dirty shell script that incorporates the above hint, but also forces XProtect to update itself:

<http://dl.dropbox.com/u/20247393/UpdateXProtect.zip>

The archive contains the shell script as well as the script enclosed in a Platypus wrapper. I stole the app's icon from somewhere linked by Google Images, and it's used it without permission. Don't sue me.



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: alvarnell on Jun 12, '11 10:15:52PM

Three users have reported completely losing their login.keychain immediately after using this tool to manually update their XProtect defs. I don't see any way that it could directly cause this, it could well be the XProtect process itself, but I am more inclined to think the sudo process when checking for an admin password. It could also be a corrupt keychain and a user who has never issued a sudo command.

In any case I recommend what I understand Apple is telling users who are not getting automatic updates, to uncheck and recheck the "Automatically update safe downloads list" box in the Security Preferences Panel. Rebooting works for some, but not all users.

---
-Al-



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: peterhoneyman on Jun 16, '11 09:37:27AM

i like scripting as much as the next guy, so i played around a little making the shell script a little simpler, but i ended up with this:

cat /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

imho, there's not much reason to do more (for the informational script, i mean).

discuss \(^;^)/



[ Reply to This | # ]
Get Safe Downloads List last update time and current version
Authored by: asmeurer on Sep 05, '11 01:39:18PM

Very nice!



[ Reply to This | # ]