Sequoia 15.4 refusing to open files - possible malware

Hello Dessicator,

Your file is probably marked with a quarantine flag. This can happen for files downloaded from odd sources.

To remove the flag, open the Terminal app (in the Applications > Utilities folder) and execute the following command:

xattr -d com.apple.quarantine <filename>

By replacing <filename> by the full path of your file, or by dragging the file from Finder and dropping it after the word "quarantine" in the command.

Here's the simplest workaround I found for opening .srt files without triggering the Mac OS 15.4 malware warning. It's not quite as easy as double-clicking but it's a little easier than opening an application and then using the File > Open or dragging a file into that application. As others have noted, simple double-clicking, right-click > Open with... and other methods force you to get rid of the malware warning for each file that is downloaded or that you make fresh, etc... The method here allows editing such .srt files without dealing with the malware warning.

It uses BBEdit and involves right-clicking an .srt (or multiple .srt's) and selecting Open File in BBEdit from the context menu (see image). To customize your context menu like this go to System Settings > Keyboard > Services > Files and Folders > and check the box for Open File in BBEdit (optional: add a shortcut key)

Notice that there is also a box to check for "Open Selected File in TextEdit" but I couldn't get that to work.

If anyone comes up with something simpler than this, let me know.

FYI: I'd hate to disable the security, so for now I reported the issue with Apple and use xattr to clear the extended attributes for my source folder;

xattr -c -r /path/to/folder

For me this was -never- a problem until I updated to 15.4. 😞

Could not reproduce the SRT issue either, but then again I do not have any SRT files that I had downloaded.

The problem is most likely two fold;

1) the file was downloaded

2) Gatekeeper ignores the fact that both files are plain ASCII Text.

Hans Luijten wrote:

I know reporting may not do a thing, but not reporting for sure doesn't do a thing 😉

While I agree with you in principle, I disagree it's a bug or anything Apple will take a serious interest in addressing.

It has been my experience that, when addressed, legitimate bug reports will generally fall into one of several categories.

They are:

• addressed within a macOS update or two, or
• bounced back to the user with some questions to be answered, or requesting additional data, or
• comprehensively bundled into a feature released in some future product upgrade, or
• identified as "performing as designed / expected" or words to that effect.

That last category is the most frustrating when something so clearly isn't. More on that later.

Again, this is for legitimate, demonstrable and repeatable bugs that can reliably be produced on an unmodified system. If the so-called "bug" is due to some third party product incompatibility, the most Apple will ever do is to forward it to the product developer. Unless that developer is large and influential and represents a significant risk to Apple's customer satisfaction, I doubt they will do even that much. In such cases the developer and Apple have a mutual interest in fixing things. Mutual interest is the only circumstance in which anything ever gets fixed.

Now... for legitimate bug reports indicating something should be working when it isn't, and for which Apple's reply appears to be inexplicably curt, there is a reason for that too. That reason may not become apparent until a future product or service or OS upgrade obviates the complaint, nullifying its relevance. That can take years. I can think of a number of examples for both Macs and iOS. The passage of time and product improvements is what makes that reply sensible in retrospect. Apple's engineers might even take an active interest in your concern, requesting additional data, reports, logs, feedback, etc right up to the moment their project manager tells them to stop. If they should protest, the hapless engineer is told "you don't need to know."

In the case of the OP, the answer to "how do I turn off the whole thing" is you can't. Not if you mean that literally, and certainly not without making compromises I would not recommend to the casual user who represents the overwhelming majority of Apple's customer base.

If you were to file a bug report Apple is nearly certain to say it's "performing as designed / expected" or words to that effect, because it is. The user will need to implement a workaround. But if you are motivated to file feedback or a bug report, go ahead. I won't discourage you. I just wanted to let you know what to expect.

I have found a workaround, with no need to change the security settings on my Mac with OS 15.4. At least it worked for me.

I think it is important to tell you that I have loads of .srt files for my business (I am in video production and use .srt subtitles normally and frequently) and I generally open them with TextEdit.

I, too, have received two .srt files that generate the same problem described by the OP. And the difference with other .srt files lies in the fact that the other files are not considered malware.

I tried to open both with Microsoft Word, which is not a recommended application.

I did not proceed when Word asked me to convert the files and canceled the routine.

Then I reopened the .srt files and the warning message was not shown.

I can read them with TextEdit and they are not damaged in any way.

I have no idea how Microsoft Word was able to override the security warning and, in any case, I had checked the files for malware and there was none.

But, hey, at least I do not have to go through the annoying process of "opening anyway".

My guess is that it has nothing to do with the application that made the file but purely with the .srt extension in the filename. Why? Because when I change the extension of a file that gives the malware warning from .srt to .txt it opens without a malware warning when I double-click it. This happens whether the file was downloaded from a subtitle website or if I made the .srt file myself using code (Excel vba). I think they are just text files, although I always make sure to save the ones I make using unicode UTF-8.

I just from 15.4 to 15.4.1 and found the problem is still there. I'm hoping a future update will remove this problem, but until then I'm getting used to right-click>open file in BBEdit

Hans Luijten wrote:

+1 here for ".inc" files (used in Pascal), which are also plain text files as well.

This is prime example of two problems that appear similar, but are not.

No one was able to reproduce the problem with ".srt" files. But it is possible to reproduce this with ".inc" files. So kudos to you for posting a reply instead of following the OP's suggestion to disable your system security.

Not sure what Gatekeeper is expecting to find in a simple plain text file.

It's expecting to find some kind of executable code.

Observations:

".md" and ".pas" files open just fine without a Malware nonesense dialog popping up.

Apparently, Markdown used to be the example for this kind of behaviour. I don't know if Apple has changed that for Markdown or if the system is actually inspecting the contents. But regardless, I cannot reproduce this, even with Markdown containing HTML with Javascript.

Unfortunately, Markdown is very popular and Pascal is not.

• Looking at file info (in Forklift) shows the content just fine of these blocked files.

That's what you'll have to do with these files. You can always open them in some other app. You just won't be able to double-click them in the Finder.

ps I did report this issue with "Feedback Assistant" as well (applefeedback://), I recommend others to do the same thing so it may appear on Apple's blooper radar.

Don't get your hopes up. Remember that you are trying this with vanilla ".inc" files that are harmless. There is a huge industry dedicated to hacking Apple products. I'm not talking about a few guys in dark rooms wearing hoodies. I'm talking about trillion-dollar international corporations. They have probably figured out that they can construct a malicious ".inc" with executable code that bypasses Gatekeeper due to it being considered "text". Therefore, Apple has to be more careful. It doesn't matter if this is an extremely rare situation that only affects 8 people in the world. Most of those "update your Apple device now!" viral stores that you see on social media involve these extremely rare situations that only affects 8 people in the world

I have exactly the same problem.

The issue is in place for all *.properties files. As a developer, you have plenty of them. Non of them is downloaded from the Internet but from some repository.

After update to 15.4, none of these file can be open e.g. from Finder.

I have associated BBEdit application for opening all *.properties files. BBEdit application has been installed from App Store. But whenever I try to open any property file, I need to explicitly allow it for each single file, which takes like three click and you need to go to Settings as well. This drives me crazy!

The only thing, which helped was to delete com.apple.quarantine attribute by using xattr command.

But that is just a workaround and of course would never work for any new file.

@Apple - please allow this setting to be system wide - to allow certain files to be opened directly by selected application.

Thx.

I found someone stating that changing file extension from .srt to .txt will work. It opens up the file and if need be, I can edit it. There is definitely a glitch somewhere. The files I download come from subtitle depository sites such as subsource and opensubtitles. Earlier versions of Sequoia allowed TextEdit to open them, later ones have not. So... I guess if I must update I will have to change the .srt to .txt, edit if need be, then rename again to .srt and use it with the app I use to embed subs in videos. I fail to understand why a text file is considered an app.

Select one of the .srt files, press command+i, in the Get Info window that opens, choose TextEdit from "Open with:" then press the "Change All…" button. That should sort it out.

These are movie subtitle files that are UTF-8 (with BOM) text, with CRLF line terminators. The only Finder Open With application that presents itself on my Mac is the VLC player — which is not the correct tool to singularly view these subtitles.

Launching BBEdit and asking it to open one of these *.srt files won't work. However, if one chooses to install the BBEdit Command Line Tools from its application menu, then in the Terminal:

bbedit /path/to/foo.srt

will open the file in a new BBEdit window with line endings translated and normal text entries for timeframe and translation text.

Install an antivirus. Macs usually don't need antivirus (despite the fact that they can catch virus). However, it's always a great idea to install one two or three times year, just to run a full deep scan to catch and remove any possible threats. In this case, you should install an antivirus. Avast One Essential is a free good choice. However, if it's a one time only, you can install a better paid antivirus with the free trial. You should, after that, reinstall macOS and, if possible, erase the Mac before (do a Time Machine backup before). After this, you should select manually (to mitigate the risk of transferring again files possibly infected with virus) important files that you have to transfer to your Mac disk. Do not transfer any apps, if possible; always download them manually from the Mac App Store and, if important apps that you use are not there, download them from the internet, only from secure/trustable sources.

My personal experience is that all applications and related files which have not been validated by Apple, because they are not in the Apple Store or not created by approved software developers, are considered "possibly malware" by all versions of Sequoia, and that includes some independent and reliable applications I use for work for which I alerted the developers, who contacted Apple to fix this issue.

In the case of .srt files flagged as malware, what I am trying to understand is whether they may have been created with an app that is not Apple-endorsed.

So, in my view it is an OS "security feature", not processor-related, and does not apply to all .srt files -- in fact, 99% of the .srt files I have open in 15.4, but the two files I got two days ago don't.

I'd use file to determine the file type. I surmise the file in question is not an ASCII text file.