Intego: OSX/Amos.ext

Targets macOS
1

I have had this ‘OSX/Amos.ext’ problem since an update of the Intego definitions a few weeks ago, but only with MBS plugins @christian_schmitz.

A full scan of the Mac, the Xojo folder, the MBS plugins and the project gives no error. As soon as I compile or run a project using MBS plugins, Intego notifies me that all the MBS dylib files in that app are infected by OSX/Amos.ext.

Scan - Malware Found (255 scanned, 9 infected, 0 repaired): myApp.debug
Infected (Trojan: OSX/Amos.ext): myApp.debug ▸ Contents ▸ Frameworks
▸ MBS_Main_NSBase_Plugin_21311.dylib
▸ MBS_MacBase_NSImage_Plugin_21311.dylib
▸ MBS_MacBase_NSAttributedString_Plugin_21311.dylib
▸ MBS_MacBase_NSUtil_Plugin_21311.dylib
▸ MBS_MacFrameworks_NSVisualEffect_Plugin_21311.dylib
▸ MBS_Main_Registration_Plugin_21311.dylib
▸ MBS_MacBase_NSView_Plugin_21311.dylib
▸ MBS_MacBase_NSFont_Plugin_21311.dylib
▸ MBS_MacCocoa_NSStatusItem_Plugin_21311.dylib

But this only happens with new builds, older versions of the same app, even with the same plugins, are unaffected, strange… There must be something during the creation of the dylibs that resembles the virus’s signature.

A test with the affected dylib files gives no error on VirusTotal. Trying different versions of the plugins and Xojo makes no difference.

I’ve of course contacted Intego several times since mid-October, but the response is always the same: “Kindly note that we are still investigating this issue.”

I suspect these are all false positives, but I still haven’t received any confirmation.
Am I the only one having this problem with MBS and Intego?

2

Sorry for the trouble.
Potentially someone wrote malware in Xojo and used our plugin.

Since we have no details, we don’t know what they match against. Could be the file name or version.

Can you download and try a newer version of the plugins?

3

I just downloaded 25.6 pr1 and the result is the same. No one else uses Intego and MBS, is the problem only on my end?

4

Have you filed a false positive report with the vendor?

5

Yes, three times with a copy of the dylibs. They tell me they’ve escalated the problem to the “appropriate team”…

6

I finally received a answer from Intego yesterday. They were able to resolve the issue with an update to their virus definitions. So it was indeed a false positive.

3 Likes