Ransomware Alert for Macos fileproviderd

[CURT64]

I am constantly getting a ransomware shield message that states "We'ver just protected your file. /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd is trying to change or delete the file XXX.doc in your protected folder."

my understanding is that fileproviderd is used for syncing icloud files with hard drive. Is this actually ransomware or is it OK to remove from the ransomware protected directories? This just started happening in the last few days.

[ondrej.kolacek]

I am constantly getting a ransomware shield message that states "We'ver just protected your file. /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd is trying to change or delete the file XXX.doc in your protected folder."

my understanding is that fileproviderd is used for syncing icloud files with hard drive. Is this actually ransomware or is it OK to remove from the ransomware protected directories? This just started happening in the last few days.

Hello,
the executable should be safe; if you are using the latest version of Avast, there should be no popup for it...
Kind regards,
Ondrej Kolacek