XProtect Brain

Color Brain

XProtect Brain

XProtect Brain 1.0 by BrainScan Software

* REJECTED BY THE MAC APP STORE *
Apple decided they didn't want this app in the store, which didn't surprise me, but I find it useful and hope others do as well, so it is being made available for your downloading pleasure here:

•Download XProtect Brain Now
XProtect Brain is free for your use. See the Read Me file in the download package for details.

Want to support BrainScan Software? Purchase Color Brain from the Mac App Store. It's only $3.99 and you may find it useful.

XProtect Brain is a utility for managing the "XProtect" malware defense system that Apple® has built in to Mac OS X.

XProtect is the name of Apple's malware defense system. As is Apple's way, there is little official documentation available regarding the system, but in a nutshell:

In 2009, with the Snow Leopard (OS X 10.6) release, Apple added the XProtect anti-malware feature to the system
When certain applications (most notably Safari) download files from the Internet, the XProtect system scans them for known malware variants, warning the user when found, and suggesting the item be deleted immediately
In May 2011 (Security Update 2011-003 for OSX 10.6.7), in the wake of the "MAC Defender" trojan horse attack, Apple updated the system with new malware definitions, an automatic daily malware definition update, and the ability to check the system for running variants of MAC Defender, with the ability to remove it from your system

With this security update, Apple added an option to the "General" tab of the "Security" System Preferences panel labeled "Automatically update safe downloads list". If this option is enabled (which it is by default) then approximately every 24 hours the system will check Apple's servers to see if a new version of the malware definition list is available, and will install the update if found.

If the option is turned off, then no automatic malware definition update will take place.

What the system won't tell you:

When was the last update installed?
Is there a newer version of the malware definitions available now?
What malware variants are currently defined?
How do I force the update to happen now?

Enter XProtect Brain.

XProtect Brain will check your system to see when the last update was installed, what version of the malware definitions file is installed, and what malware variants are currently known by your system.

XProtect Brain will check Apple's server to see what version of the malware definitions is available and what malware variants are defined there.

XProtect Brain will, when commanded, force the download of new malware definitions now. This is performed by executing the same system tool that Apple uses when updating the definitions.

For further reading, see:

Everything You Wanted To Know About Apple's New Anti-Virus Spotter (Cult of Mac)

Apple Malware Cat And Mouse (Ars Technica)

Using XProtect Brain

The main XProtect Brain window shows a side-by-side comparison of the XProtect malware definitions stored on your Mac vs those currently residing on Apple's servers. You can see the definitions' version, creation date, and list of defined malware variants.

Buttons in the main window will allow you to manually refresh the comparison, view the locally stored defintion files, view the online definitions in your web browser, and update the local definitions if they are older than what is available online.

The XProtect Brain Info window shows helpful information about the XProtect system and XProtect brain (a subset of the information shown on this page).

The About XProtect Brain window shows the installed version XProtect Brain, and has buttons leading to this page and to the XProtect Brain page in the Mac App Store.

XProtect Brain's preference settings include:

Automatic launching of XProtect Brain when you log in
Whether or not XProtect Brain is visible when it is launched during login
How frequently to automatically check for new XProtect malware definitions while XProtect Brain is running
How you would like to be notified when XProtect Brain finds new definitions available when it automatically checks for updates