I use Avast in many of my devices and I'm satisfied with is protection. Downloaded from AMAZON and it does not install in MacBook Pro running Sierra, so I went to the Avast site and got their version and it was fully installed without any issues. Hello there I wanted to run Avast for Mac and Sophos on my Mac running Snow Leopard 10.6.8. I like Avast but Sophos also covers Windows viruses which Avast does not.

Yesterday I ran a full system scan using my Avast antivirus software and it found a infection file. The file's location is :

Avast categorizes the infection file as :

So, after deleting the file I did several more full system scans to check to see if there were any more files. I found nothing, until I restarted my macbook pro today. The file reappeared in the same location. So I decided to let Avast put it in the virus chest, restarted the laptop, and again the file was in the same location again. Therefore the virus is re-creating the file every restart of the laptop.

I want to avoid wiping the laptop and re-installing everything, so that is why I am here. I researched the file path and cryptonight and found out that cryptonight is/can be malicious code that can run in the background of someone's computer to mine cryptocurrency. I've been monitoring my CPU usage, Memory, and Network and I haven't seen a single odd process running. My CPU is running below 30%, my RAM is generally below 5GB (installed 16GB), and my network hasn't had any processes sending out/receiving large amount of data. So if something is mining in the background, I can't tell at all. I have no clue what to do.

My Avast runs full system scans every week, so this just recently became an issue this week. I checked all of my chrome extensions and nothing is out of order, I haven't downloaded anything special within the past week, besides the new Mac operating system (macOS High Sierra 10.13.1). So I have no clue where this has came from to be honest and I have no clue how to get rid of it. Can someone please help me out.

I suspect that this supposed “virus” is coming from the Apple update and that it is just a pre-installed file that is created and runs every time the OS is booted/rebooted. But I am unsure since I only have one MacBook and no one else that I know that has a mac has updated the OS to High Sierra. But Avast keeps labeling this as a potential “Cryptonight” virus and no one else online has posted anything about this issue. Therefore, a common virus removal forum isn't helpful in my situation, since I've already attempted to remove it with both Avast, malwarebytes, and manually.

1 Answer

Pretty sure there is no virus, malware or trojan at play and his is all a highly coincidental false positive.

It’s most likely a false positive since /var/db/uuidtext/ is related to the new “Unified Logging” subsystem that was introduced in macOS Sierra (10.2). As this article explains:

The first file path (/var/db/diagnostics/) contains the log files. These files are named with a timestamp filename following the pattern logdata.Persistent.YYYYMMDDTHHMMSS.tracev3. These files are binary files that we’ll have to use a new utility on macOS to parse them. This directory contains some other files as well including additional log *.tracev3 files and others that contain logging metadata. The second file path (/var/db/uuidtext/) contains files that are references in the main *.tracev3 log files.

But in your case the “magic” seems to come from the hash:

Just check out this reference for known Windows malware files that references that one specific hash. Congratulations! Your Mac has magically created a filename that matches a known vector that has been primarily seen on Windows systems… But you are on a Mac and this filename is just a hash that is connected to the “Unified Logging” database system’s file structure and it is completely coincidental that it matches that malware filename and should not mean anything.

And the reason that specific file seems to regenerate is based on this detail from the above explanation:

The second file path (/var/db/uuidtext/) contains files that are references in the main *.tracev3 log files.

So you delete the file in /var/db/uuidtext/, but all it is is a reference to what is in /var/db/diagnostics/. So when you reboot, it sees it is missing and recreates it in /var/db/uuidtext/.

As for what to do now? Well, you can either tolerate the Avast alerts or you can download a cache cleaning tool such as Onyx and just force the logs to be recreated by truly purging them from your system; not just that one BC8EE8D09234D99DD8B85A99E46C64 file. Hopefully the hash names of the files it regenerates after a full cleaning won’t accidentally match a known malware file again.

UPDATE 1: It seems like Avast staff acknowledges the issue in this post on their forums:

I can confirm this is a false positive. The superuser.com post describes the issue quite well - MacOS seems to have accidentally created a file that contains fragments of malicious cryptocurrency miner which also happen to trigger one of our detections.

Now what is really odd about this statement is the phrase, “…MacOS seems to have accidentally created a file that contains fragments of malicious cryptocurrency miner.”

What? Is this implying that someone on the core macOS software development team at Apple somehow “accidentally” setup the system so it generates neutered fragments of a known malicious cryptocurrency miner? Has anyone contacted Apple directly about this? This all seems a bit crazy.

UPDATE 2: This issue is further explained by someone Radek Brich the Avast forums as simply Avast self-identifying itself:

Hello, I'll just add a bit more information.

The file is created by MacOS system, it's actually part of 'cpu usage' diagnostic report. The report is created because Avast uses the CPU heavily during the scan.

The UUID (7BBC8EE8-D092-34D9-9DD8-B85A99E46C64) identifies a library which is a part of Avast detections DB (algo.so). The content of the file is debugging information extracted from the library. Unfortunately, this seems to contain a string which is in return detected by Avast as a malware.

(The 'rude' texts are probably just names of malware.)

protected by Community♦Nov 26 '17 at 20:07

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged macosmacvirusanti-virusavast or ask your own question.

Besides the World’s most popular antivirus for Windows, Avast is offering a comprehensive antivirus for Apple Mac OS X (Macintosh). The product is called Avast Free Mac Security 2018 (version 11) and same as the Windows version it’s completely for free. It doesn’t even require the registration, so you can just download, install and use it without any hassle.

While some Mac users are still questioning the need for the antivirus/security software on OS X, we definitely recommend have Avast installed as the number of hacker attacks on Mac users is rising rapidly.

Avast for Mac Key Features & Benefits

• Award-winning antivirus engine with 100% detection rate (according to the independent test by AV-TEST and AV-Comparatives)
• Real-time protection with 3 layers (File System Shield, Mail Shield, Web Shield)
• Automatic streaming updates of the virus definitions
• Excellent performance – very low on system resources
• Simple and intuitive user interface
• Completely for free – no registration required

Avast for Mac Free Download & Installation

Avast for Mac is unfortunately not available on iTunes or App Store. But you can simply download Avast Free Mac Security using the link below:

From the Official Avast Servers

After you finish the download you can proceed with the installation. The installation process is really easy and doesn’t require any technical skills:

1. Close the Safari browser, locate the setup file called ‘avast_free_mac_security.dmg‘ and run it
2. Confirm the Avast License Agreement by clicking on ‘Agree‘
3. You can customize the installation by clicking on ‘Customize’, click on ‘Install’ to start the installation
4. If prompted enter the administrator name and password
5. Once the installation is complete, you should get the confirmation screen

Please note it’s heavily recommended to uninstall any other antivirus/security software from your Mac before installing Avast.

Avast Security Pro for Mac – Is it worthy to pay extra?

Besides the free version of Mac antivirus, there is also a premium one called Avast Security Pro for Mac. The pro version offers two extra features

Avast Mac Download

• Wi-Fi Alerts – This feature will immediately notify you if someone connects to your Wi-Fi network. This helps you to keep hackers/neighbors out of your network.
• Ransomware Shield – Ransomware shields keep your personal data from being encrypted without your permission.

For these, you need to pay for the premium version which costs $59.99 per year. Is it worthy? We would say yes as ransomware on Mac is on the rise and Avast offers solid protection against it.

Avast for Mac User & Experts Reviews – What others are saying?

Avast Free Mac Security is also really popular among the users and technical experts. It is by far the most downloaded Mac antivirus/security on Download.com with more than 4.5 million downloads! While other competitors don’t have even half a million (Sophos 247k, Avira 80k, Norton 30k, Kaspersky 12k, McAfee 11k, Eset 9k).

Avast Free Mac Security is the most downloaded antivirus for Mac with more than 4.5 million downloads

Can I Use Avast For My Macbook Pro

Also, the user reviews on Download.com are very positive. Avast Free Mac Security 2018 has 4.5 stars (out of 5) from 1,641users.

Avast for Mac is doing really well also in the independent tests. It has been certified with 100% detection rate by the German laboratory AV-TEST. Same results were measured also by the Austrian laboratory AV-Comparatives.

According to Tom’s Guide, Avast Free Mac Security was better in detecting viruses than the other paid solutions: ‘it was better at malware detection than all three of the paid antivirus solutions we reviewed‘.

Avast for Mac System Requirements – Will it run on your Mac?

Minimum system requirements are quite easy to comply and really nothing special. Avast Free Mac Security will run even on the older MacBooks (Air/Pro) and iMacs:

• OS X Version: Apple Mac running macOS 10.9 (Mavericks) or newer
• Processor: Intel-based Mac computer with 64-bit processor
• Memory: 128 MB RAM or above (1 GB RAM or higher preferred)
• Free space: 500 MB minimum hard disk free space

Where Is My Avast Download

Avast for Mac Uninstall – How to remove it from your Mac?

If you decide to uninstall Avast Free Mac Security from your Mac, there is nothing special you would need to do compared to any other Mac application. To remove it simply follow the instructions below:

1. Close Safari browser and open Avast by going to ‘Finder’ » ‘Applications’ and double-click on the Avast orange icon
2. Open ‘Avast Mac Security‘ in the menu bar at the top-left, select ‘Uninstall Avast‘ and confirm (you may need to log in as an administrator)
3. Wait and the uninstall process to finish and Avast Free Mac Security is completely removed

Unfortunately, there is no removal tool or uninstall utility for Mac. Avast Uninstall Utility (AvastClear) is available only for Windows.