False positive is back again: BaseSystem.dmg

@Annoyed User Welcome to the Webroot Community Forum. ☺️

Annoyed User wrote:

I am normally a very civil and calm person, but this is really getting under my skin. Will webroot ever give a crap about the Mac product?

The answer to your question I believe is what you see is what you get with WSA on a Mac computer sorry to say. I'm waiting for the new surprises with WSA when Apple releases macOS Catalina 10.15.

Please see THIS POST that I posted a few days ago.

Dave.

This has been reported to our threat team and we will get back shortly.

Thanks
Pawani

@Annoyed User

This is an older FP that occasionally pops up here and there in a couple of circumstances. It's possible that an older definitions file is still being used by the agent on this system, or it had an older definitions file upon it's first start up after a long period of not being started up. If a scan is performed in this state, older false positives can be detected and reported to the console.

Another possibility is that this infection was detected with the original false positive date and has continued to report to the console that the machine is infected, even after a definitions file has been updated. This could be a bug that we would want to investigate through support channels.

If this is the case, the agent on the physical machine would actually show a green, "Protected" status, while the only the console shows the infection history.

I don't have many details from your post. Could you try to confirm whether the agent reports a green status? Also could you reply and let me know if this false positive alert was noticed from within your console.

We do not have any other volume on support regarding this false positive detection. Feel free to PM me your email details and I would be glad to look at your account information.

Regards,

Matt

It just completed a full scan (10 Hours for one SSD drive!) and it is still showing as detected as PUA.OSX.Adware.BucaApps.1.r. The console is not showing green, it still shows "Threats Detected"

VirusTotal shows the 470MB disk image to be clean.

I'll PM you with info.

Late follow up on this post.

There was a file contained within this DMG that is a list of plain text malicious URLs that OS X used in a previous version (10.11) Parental Controls. This file is not included in current releases that I have found so I believe that they have changed the method in which they store these URLs or provide an entirely different mechanism.

Annoyed User opted to allow the file manually so that we could continue to protect against any malicious file that embed the URL in question within a payload file.

I have had this threat on my control panel for some time, and whilst I was aware it wasn't anything serious, it is becoming quite annoying, and I would like to remove it.

I am still running MacOS Sierra.

Basesystem.dmg - PUA.OSX.Adware.BucaApps.1.r

Any idea how I actually go about this without wrecking anything?

Hello @shaneb, Welcome to the Webroot Community Forum.

I would have the Professionals at Webroot Support do this. Please submit a Support Ticket or Contact Webroot Support to sort this problem. This service is FREE with a Paid Subscription.
Support Ticket System is Open 24/7

Note: When submitting a Support Ticket, Please wait for a response from Support. Putting in another Support Ticket on this problem before Support responses will put your first Support Ticket at the end of the queue.

HTH,
Dave.

Thanks Dave, I will do that! 🙂