Author Topic: Ransomware Alert for Macos fileproviderd  (Read 2710 times)

0 Members and 1 Guest are viewing this topic.

Offline CURT64

  • Newbie
  • *
  • Posts: 1
Ransomware Alert for Macos fileproviderd
« on: July 14, 2023, 03:31:12 PM »
I am constantly getting a ransomware shield message that states "We'ver just protected your file. /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd is trying to change or delete the file XXX.doc in your protected folder."

my understanding is that fileproviderd is used for syncing icloud files with hard drive. Is this actually ransomware or is it OK to remove from the ransomware protected directories? This just started happening in the last few days.

Offline ondrej.kolacek

  • Avast team
  • Sr. Member
  • *
  • Posts: 394
Re: Ransomware Alert for Macos fileproviderd
« Reply #1 on: July 24, 2023, 06:24:29 PM »
I am constantly getting a ransomware shield message that states "We'ver just protected your file. /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd is trying to change or delete the file XXX.doc in your protected folder."

my understanding is that fileproviderd is used for syncing icloud files with hard drive. Is this actually ransomware or is it OK to remove from the ransomware protected directories? This just started happening in the last few days.
Hello,
the executable should be safe; if you are using the latest version of Avast, there should be no popup for it...
Kind regards,
Ondrej Kolacek