Avast WEBforum

Consumer Products => Avast Mac Security => Topic started by: CURT64 on July 14, 2023, 03:31:12 PM

Title: Ransomware Alert for Macos fileproviderd
Post by: CURT64 on July 14, 2023, 03:31:12 PM

I am constantly getting a ransomware shield message that states "We'ver just protected your file. /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd is trying to change or delete the file XXX.doc in your protected folder."

my understanding is that fileproviderd is used for syncing icloud files with hard drive. Is this actually ransomware or is it OK to remove from the ransomware protected directories? This just started happening in the last few days.

Title: Re: Ransomware Alert for Macos fileproviderd
Post by: ondrej.kolacek on July 24, 2023, 06:24:29 PM

Quote from: CURT64 on July 14, 2023, 03:31:12 PM

I am constantly getting a ransomware shield message that states "We'ver just protected your file. /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd is trying to change or delete the file XXX.doc in your protected folder."

my understanding is that fileproviderd is used for syncing icloud files with hard drive. Is this actually ransomware or is it OK to remove from the ransomware protected directories? This just started happening in the last few days.

Hello,
the executable should be safe; if you are using the latest version of Avast, there should be no popup for it...
Kind regards,
Ondrej Kolacek