Sequoia 15.4 refusing to open files - possible malware

I just updated to 15.4. Trying to open a simple text file (with srt extension) pops this up: "Apple could not verify" xxxx.srt "is free of malware that may harm your Mac or compromise your privacy." Some other srt files open fine.


This is a dealbreaker for me if I can't disable this "feature". I know I can go burrowing into settings and exempt this one file. No. How do I turn off the whole thing?

MacBook Pro 16″

Posted on Apr 1, 2025 2:06 PM

Reply
Question marked as ⚠️ Top-ranking reply

Posted on Apr 3, 2025 2:06 PM

Dessicator wrote:

etresoft, why do you think that's a malware site? I've downloaded many subtitles from it. They have nothing but subtitles in them, and I've never had any trouble.

Any subtitle file that I click on opens up this very respectable looking new "Browser Update" window:


I've obscured the name of the site, but I left the very respectable "xyz" TLD.


To display that page, it redirects to a couple of other similarly respectable domains first. One of those URLs is 12 lines long. It isn't doing these redirect via standard HTTP methods. The first redirect is done via Javascript somewhere on the site itself. I didn't bother to look where. The second redirect is also done via Javascript, but this time using very respectable and very obfuscated Javascript.


Normally I would look at these things on the command line with curl or similar. That didn't work in this case. I had to use Safari's Web Inspector timeline. I must have clicked on links at least 30 times altogether.


But curiously, one of those clicks via Safari's web Inspector actually didn't give me the whole respectable redirection. It gave me a different page with what may have been download links. So it's a website that seems to be able to detect when it's being inspected and alter its behaviour to work more legitimately in that scenario. OK, then!


I did once get a page for the "Best Crypto Casino and Online Sports Betting". Sadly, it wasn't available in my jurisdiction. Maybe because we have laws here?


I keep trying. Now I get a page where I can "Get paid for testing apps, games & surveys". Sure. Oh, look. I can sign in with Google or Facebook, but not Apple. Bummer.


But still I keep trying. I am able to get that legitimate-looking download page one more time. I click on one of the "translate" buttons and I'm back to the original redirector.


But wait! The "English" version has a "download" button. I click that - still the redirection. In not a single case was I able to download an SRT file.


If this really is a source of 10,364,786 subtitles, then perhaps Apple is right to associate SRT files with malware.


31 replies
Sort By: 

Apr 1, 2025 3:58 PM in response to Dessicator

Hello Dessicator,


Your file is probably marked with a quarantine flag. This can happen for files downloaded from odd sources.


To remove the flag, open the Terminal app (in the Applications > Utilities folder) and execute the following command:

xattr -d com.apple.quarantine <filename>


By replacing <filename> by the full path of your file, or by dragging the file from Finder and dropping it after the word "quarantine" in the command.

Reply

Apr 2, 2025 5:31 AM in response to John Galt

John Galt wrote:

I'd use file to determine the file type. I surmise the file in question is not an ASCII text file.

I've found one possible cause. But the OP has solved the problem by disabling system security. So I have a suggestion ready for the next time I see this problem reported.

Reply

Apr 2, 2025 7:38 AM in response to John Galt

Thanks John Galt, that's a good suggestion. But these are text files.


This one Finder refused to open:

jim@JimsMBPro ~: file . . .

Unicode text, UTF-8 text, with CRLF line terminators


This one (with BOM) opened no problem in BBedit (my default for srt):

jim@JimsMBPro ~: file . . .

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Reply

Apr 3, 2025 9:44 AM in response to Dessicator

FYI: I'd hate to disable the security, so for now I reported the issue with Apple and use xattr to clear the extended attributes for my source folder;


xattr -c -r /path/to/folder


For me this was -never- a problem until I updated to 15.4. 😞

Could not reproduce the SRT issue either, but then again I do not have any SRT files that I had downloaded.

The problem is most likely two fold;

1) the file was downloaded

2) Gatekeeper ignores the fact that both files are plain ASCII Text.

Reply

Apr 5, 2025 1:13 PM in response to Dessicator

Install an antivirus. Macs usually don't need antivirus (despite the fact that they can catch virus). However, it's always a great idea to install one two or three times year, just to run a full deep scan to catch and remove any possible threats. In this case, you should install an antivirus. Avast One Essential is a free good choice. However, if it's a one time only, you can install a better paid antivirus with the free trial. You should, after that, reinstall macOS and, if possible, erase the Mac before (do a Time Machine backup before). After this, you should select manually (to mitigate the risk of transferring again files possibly infected with virus) important files that you have to transfer to your Mac disk. Do not transfer any apps, if possible; always download them manually from the Mac App Store and, if important apps that you use are not there, download them from the internet, only from secure/trustable sources.

Reply

Sequoia 15.4 refusing to open files - possible malware

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.