Uxprotect mac app
According to their names, one is effectively MRT version 3, and the others tackle the following known malware: What’s unusual about this app is that it contains eight executables, XProtect itself (which hadn’t previously existed as a discrete app or binary), and seven XProtect Remediator executables. When first installed in 12.3, it reported that it was version 1, and has already become version 2, upgraded as part of macOS rather than as a separate security data update. This new XProtect.app is on the Data volume in the folder /Library/Apple/System/Library/CoreServices, which is firmlinked to merge with the matching folder on the System volume at /System/Library/CoreServices. No one thought anything more about the sudden appearance of its executables, and the offending component was duly added to the Webroot exclusions definitions.
The day after 12.3 was released, some of those using Webroot Business Endpoint security protection reported that one of its components was triggering a false positive report as malware. I’m not the first to notice something odd about this new app. After a quick look through my Time Machine backups, I discovered that it had been installed with the 12.3 update, so looked a bit deeper. I happened to be looking for something in the CoreServices folder, which is firmlinked between System and Data volumes, and noticed an app there named XProtect.app which looked unfamiliar despite its name. MRT’s successor is now installed on every Mac running macOS 12.3 or later: it’s XProtect, or to be more specific XProtect Remediator. While I wasn’t entirely wrong, Apple had already changed this back in Monterey 12.3, released on 14 March. It seems only a week ago that I was assuring you that Apple’s Malware Removal Tool wasn’t going away.