mikermcneil01/28/2023, 12:17 AM
table might be wrong: https://fleetdm.com/tables/xprotect_meta
But when I query some Macs, I see "com.viewanysearch", which looks pretty sketchy, with its minimum version listed as "any". Should this actually say:- The minimum allowed plugin version.
- The minimum banned plugin version
thing which is presumably effectively a virus)
mikermcneil01/28/2023, 12:54 AM
mikermcneil01/28/2023, 12:57 AM
is actually min_version blocked Looks like it's set for some other random things like flash player and Java:
entries (which is where the
is). They do set it for
where it might actually be correct as documented.
mikermcneil01/28/2023, 1:00 AM