Can DT be infected by the WizardUpdate malware?

Welcome @pliplin

As mentioned above, we feel it’s a false positive and are awaiting word from MacPaw.

3 Likes

I am having a problem similar to Toffy’s. It appears that, on my Mac, CMM interpreted DT3 and ScanSnap Manager as described in the thread above. Both applications are no longer on my system (MacMini M1). Fortunately, I have files backed up in TimeCapsule, Backblaze and they are synced to my iPad Pro. Since others are checking with MacPaw and new information is appearing here, I will wait to see more postings and MacPaw’s response before restoring DT3 on the Mac. However, I’ll keep looking any advice or success stories regarding this problem and best ways to assure a complete recovery.

Both applications are no longer on my system (MacMini M1).

Then you chose to allow CleanMyMac to delete them.

There is no need to get the applications from a backup. Download a new copy here: Downloads

There are also various other reports on Twitter mentioning even apps like Permute which are part of MacPaw’s SetApp. All our apps as well as Permute use Sparkle for distributing their updates so a theory could be that CMM added a signature to their list that matches something in Sparkle and now flags all apps using it as positive.

4 Likes

It seems that MacPaw follows our assessment and has released an update that no longer reports all these apps including ours as malware.

4 Likes

I have also filed an inquiry with MacPaw. Thanks for being proactive. Will be interesting to compare notes on replies. My gut also says “false positive”. FWIW, I’m an Objective-See fan and have deployed the relevant tools, and scanned with WebRoot and Malwarebytes – neither is able to replicate what CMM is reporting.

My instantiation may have updated without me seeing it (I have auto updates enabled)… I am on an M1 MBPro running CMM version: Version 4.11.1(41101.0.2207131611)

Would you mind verifying your version so we can all see what the “fixed” version number is…? (I’m being lazy asking here…I’ll also go over to the MacPaws blog and see if they’ve mentioned…too many balls in the air this morning…). Thank you!!

I’m going to wager a bet that Eric does not have CMM running on his Mac.

Nor do I - or anyone else in here, I believe.

1 Like

Welcome @ainosnews

It is indeed a false positive and for some other apps as well as ours. MacPaw has responded and their team has issued an update to their definitions. Check for a database update from them.

1 Like

Last software I would ever install on my Macs.

5 Likes

Interesting. Brett Terpstra highly recommends it.

I had to look up who that is, so I’m not sold on the name alone. I also note that on at least one occasion CleanMyMac X has sponsored Brett. Whilst Brett does point out that he only accepts sponsorship from advertisers he can personally endorse, to my mind sponsorship is liable to influence the sponsee.

More importantly though: as far as I have been able to determine, Brett, like all the other reviewers I have read, does not provide any sort of in-depth analyses of the software. What does it actually clean up, what difference does that make in real world terms, what does it optimise, how successful is it in detecting malware in the wild, and so on. To my mind, his - like all the other reviews I have read of the software - sounds like an ad to me.

I’m happy to point out that I have not installed CMM myself. I am no security professional. I am not commenting on the suitability of the software; what I am doing is pointing out that I can’t find anybody else doing so in an in-depth fashion either. For security software I find that disconcerting.

3 Likes

Just in case anyone is still in doubt: MacPaw have confirmed that this was a false positive and have released a fix (which should update automatically if the bad version updated automatically, otherwise check for updates manually).

I’ve been following Brett Terpstra’s blog roughly since I first started using nvALT, which must be a good twelve years ago, if not longer. He has been providing freeware and paid applications (e.g. Marked) for a long time, and I believe he has a solid reputation in the Mac community. CleanMyMac regularly appears on his annual list of favourite applications. In 2018 he wrote “CleanMyMac remains my favorite maintenance app for macOS. This year’s addition of Malware detection and cleanup seals the deal for me.” It is only his opinion, of course, but I have come to have some faith in his recommendations. I don’t share all of his choices, and when it comes to CleanMyMac I’ve found a few kinks (like the present one), but I try not to rely on any program 100%.

However, my comment was really motivated by my interest in the fact that knowledgeable people can hold such opposing views about a piece of software. I can only surmise that some have had negative experiences that others have not – a not uncommon scenario with software, it seems.

Cheers.

I did of course read Brett’s posts on CMM on his site, and the article he linked to, before I posted what I did. I just didn’t find any substance; like why do I need this app at all, what am I missing by not running it?

On the other hand, I spent days reading up on Patrick Wardle, his take on malware, his teardowns of malware, his descriptions of his software and why it works, and I still tried to find an independent expert who’d evaluated the software and - having been unable to - took about 6 months and many more hours humming and haring and reading before deciding to trust Objective-See’s tools. So perhaps I’m just that little bit weird :crazy_face: I have no experience of CMM; the available information just doesn’t fulfill my pre-installation requirements.

I fear I may have drifted this thread mildly OT; please excuse, and I’ll slap my own wrist, thank you.

4 Likes

Brett is a brilliant and well-respected tech guy for sure. But as noted, we all have our own views and opinions on things like software, privacy, security, etc.

I’ll clean my own Mac, thanks for the offer, but no thanks! :grinning:

1 Like

That’s roughly what I said to the IT guy who wanted to “do maintenance” on my Mac at the editorial office where I worked before we started DEVONtechnologies: “Touch my Mac and you’re dead.” :smiling_imp: I had to sign some document that he’d not be responsible if I accidentally burn down the building by installing some “unapproved system extension”. Fine for me.

6 Likes

Actually, now that I think of it, in the end I had to let him install some anti-virus software. The next day I could no longer transfer files to our file server. After switching off each of my system extensions that he claimed were “incompatible” to the then-new MacOS 8.5, the only one left was … the anti-virus software. After disabling it, it all worked fine again. So the only extension that was incompatible to my system software was his virus killer. I never told him :shushing_face:

2 Likes