DetectX Swift Release Notes

Version 1.0983

22 May 2022

Improved

internal search criteria updated
malware search heuristics updated

Fixed

Several false positive issues have been addressed

Version 1.0982

28 Nov 2021

Improved

internal search criteria updated
malware search heuristics updated

Fixed

DetectX Swift no longer repeatedly asks for the admin password when launching on macOS 12 Monterey.

Changed

DetectX Swift no longer uses the Sparkle update framework. See the Notes below.

Notes

DetectX Swift v1 is now EOL (end-of-life). Aside from any critical bug fixes, there will be no further updates to DetectX Swift version 1. Work on DetectX Swift v2 is in progress.
Version 1.0982 is supported on macOS 10.11 El Capitan to macOS 12 Monterey. No future versions of macOS will be supported by DetectX Swift version 1.
Removal of the Sparkle framework means any critical updates for v1.0982 are now handled manually by users. The UI provides indication when an update is available and a link to this Release Notes web page from where the latest version can be downloaded. The 'Check for Updates' action in the application menu can also be used to check if an update is available.

Version 1.0981

17 Aug 2021

Improved

adware search heuristics updated

Note

Versions 1.0981 and earlier of DetectX Swift are not supported on macOS 12 Monterey

Version 1.0980

01 Aug 2021

New

Native Support for M1 ARM64 architecture
DetectX Swift now warns if it is not running with Full Disk Access permission

Improved

internal search criteria updated
malware search heuristics updated

Note

Version 1 of DetectX Swift is not supported on macOS 12 Monterey

Version 1.0971

26 Aug 2020

Fixed

Removed a logic error that could falsely convict a benign application mounted on a DMG (Disk Image).

Version 1.097

24 Aug 2020

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Version 1.096

05 Jul 2020

Improved

malware search heuristics were updated

Version 1.095

22 Jun 2020

Fixed

Detection heuristics were adjusted to remove two unrelated false positives.

Version 1.094

20 Jun 2020

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Changed

Registration is no longer necessary for versions 1.xxx of DetectX Swift.
The 'Achievements' feature has been removed.
The 'Uninstall' menu item has been removed from the application menu.

Version 1.093

08 Sep 2019

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Fixed

A bug was addressed that could prevent DetectX from removing some items even when it had the correct privileges to do so.
The CLI tool now knows better than to try and run a SHA checksum on a directory and has promised to refrain from doing so in future.

Changed

The 'Update available' notification and button in the UI has been made more salient.

Version 1.092

26 Aug 2019

Improved

adware search heuristics updated
malware search heuristics updated

Fixed

Some unwanted logging messages have been removed.

Changed

DTXS will only do a full search for eicar test files if you enable the following preference from the command line:
```
defaults write com.sqwarq.DetectX-Swift eicarTest 1
```
For most users this is unnecessary and not recommended.
Setting it back to '0' will disable it again.
This change was made so as not to unnecessarily slow down search times for the majority of users and use cases.

Version 1.091

16 Jun 2019

Improved

adware search heuristics updated

Fixed

the UI no longer hangs while waiting for the search to complete

Version 1.090

01 Jun 2019

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Version 1.089

10 May 2019

Fixed

squashed another bug that could cause DetectX to appear to hang on launch
squashed some bugs in the deletion routine related to permissions
DTXS now properly unmounts issues found on mounted DMGs

Changed

DTXS now refuses to remove the MKAuthPlugin.bundle belonging to MacKeeper as it cannot do so safely. If you encounter this file, do not attempt to remove it. Contact Sqwarq Support for help with manual removal.

Version 1.088

10 May 2019

Version 1.088 was merged with Version 1.089

Version 1.087

22 April 2019

New

DetectX Swift is notarized for macOS 10.14+

Improved

better at finding duplicates without multiple searches
internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Fixed

squashed a bug that could cause DetectX to appear to hang on launch

Version 1.086

16 April 2019

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Changed

CleanMyMac is no longer flagged in the default search
a blacklist option appears in the Search Preferences; this function is currently disabled but will be activated in a future release

Version 1.085

4 March 2019

Fixed

a bug in the Profiler which could generate error messages from lsof when parsing some running software
a bug in the Profiler that failed to enumerate User login items correctly on 10.13 and above
a regression introduced in 1.084 in the Activity Log which caused the Trash button and file size display not to function

New

Some limited support for detecting Eicar test files

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated

Version 1.084

18 February 2019

Improved

adware search heuristics updated

Version 1.083

9 February 2019

New

Report a Problem logs now include scutil --proxy
Report a Problem logs now include LSQuarantineEvents

Improved

internal search criteria updated
adware search heuristics updated
malware search heuristics updated
more sanity checks to ensure DTXS does not return legitimate System and User folders

Fixed

a bug that could cause false positives for Sparkle AutoUpdate app and Devmate
a bug that prevented DetectX Swift from recognising usernames that contained emoji characters

Version 1.082

1 January 2019

Improved

internal search criteria updated
malware search heuristics updated

Changed

Dock icon behaviour during CLI search is less perceptible

Version 1.081

3 December 2018

New

Report a Problem logs now include install history

Improved

internal search criteria updated

Fixed

some unnecessary logging to stderr during a search
a bug that could cause DTXS to incorrectly report Sharing Preferences status

Version 1.080

17 November 2018

Improved

malware search heuristics updated
adware search heuristics updated

Version 1.079

9 November 2018

Improved

internal search criteria updated

Fixed

a bug that could prevent launch when licensing details are corrupt
a bug that caused DetectX Swift to search TimeMachine volumes mounted as Disk Images

Version 1.078

12 October 2018

Improved

Internal search criteria have been updated.

Fixed

A bug that could prevent the Folder Observer from respecting Managed and User Preferences has been addressed.
A bug that caused DetectX Swift to search smb file systems mounted as Disk Images has been addressed.

Version 1.077

3 October 2018

Improved

Malware search heuristics have been improved.
Internal search criteria have been updated.

Fixed

A bug that could cause a crash on launch when trying to check registration status was addressed.
A false positive on SuperDuper! Launch Agents has been removed.
A bug that could prevent the Folder Observer from detecting changes to Launch folders has been addressed.
A display bug that caused the Folder icon in the History view to be misaligned when running on macOS 10.14 was addressed.

Changed

Shared mounts that appear as Disk Images are no longer traversed. This change is necessary to avoid excessively long search times. This change does not affect ordinary DMGs mounted locally.
Removed sending a notification when the CLI Achievement is completed. The achievement is still recorded.

Version 1.076

9 August 2018

New

Activity Log (use Cmd-L) provides further details about what DTXS is doing behind the scenes. This includes items removed, processes killed, recommended further actions and lists of open ports and files belonging to suspects.

Improved

Malware search heuristics have been improved.
Internal search criteria have been updated.

Fixed

Some unwanted debug messages have been removed from the CLI tool output.

Changed

The Expertise level indicator now auto-hides after a few seconds. When hidden, you can view the indicator by hovering over either the 'Expertise' button or the area where the indicator normally appears.

Version 1.075

8 July 2018

Improved

Search heuristics are now able to find threats and issues based on Developer ID.
Better support for finding unwanted / malicious cron jobs.

Fixed

A bug that could cause a crash on launch was addressed.
A bug that could cause a crash when exercising the All History function was addressed.
A vulnerability in loading external frameworks was addressed.

Version 1.074

20 June 2018

New

Help > Show Checksums allows DetectX Swift to report its own checksum in the main UI's Status field. The checksum is calculated in real-time against the running binary.

This can be checked against the canonical value shown on the Sqwarq Product Security page, which simultaneously opens in the default browser.
DetectX Swift can now be relaunched either from the Dock icon's contextual menu or from the 'DetectX Swift > Relaunch' menu bar.

Fixed

The Ignore Keywords checkbox in Preferences > Observer now works correctly.
The CLI tool no longer returns an unwanted error message related to Firefox.

Version 1.073

13 June 2018

New

The command line tool's search command now has an -ignore switch
```
-ignore /Users/user/path1,/Users/user/path2
```
```
-ignore -f ~/path_to_whitelisting_file
```
Use -help or consult the Sqwarq slack #documentation channel for more details.
The search function can be prevented from updating the live search definitions. This is for troubleshooting purposes only and not recommended for general use. Further details are in the slack #documentation channel. The User Guide will be updated shortly to reflect this change.
The 'Status' panel in the main user interface now includes an alert if a running browser's anti-phishing and malware protection preference has been turned off. The alert only applies to the first browser found where the preference is off (i.e., if two running browsers have the preference turned off, the alert will not be shown for the second browser until the first has been rectified). Further details are in the slack #documentation channel. The User Guide will be updated shortly to reflect this change.

Improved

Report a Problem logs now include information on Managed Profiles.

Changed

Registration email field is now case insensitive.
The command line tool's formerly deprecated 'scan' command has been removed.

Version 1.072

25 May 2018

New

AppleScript can now return whitelisted Search paths.

Improved

Report a Problem logs now include information on installed packages.
Report a Problem logs now include information on processes by kind (foreground, statusbar, background).

Fixed

A non-critical error in execution flow was addressed.

Version 1.071

21 May 2018

Improved

Adware search heuristics have been updated.
Report a Problem logs now include information on periodic scripts.

Version 1.070

18 May 2018

New

The search results table now allows you to check all results with one click of the 'All' button.
Expertise Achievements encourage you to learn how to use DetectX Swift's many functions to secure your Mac (this feature is only available on macOS 10.12 or higher).

Improved

Adware search heuristics have been updated.
The GUI search engine is better able to detect and remove running processes belonging to items found in the search (this feature does not apply to the CLI search).

Version 1.060

15 March 2018

Improved

Adware search heuristics have been updated.

Changed

Calendar 2 / CalendarFree is now only flagged if it is v2.6.1 or earlier.

Version 1.050

13 March 2018

New

User cron jobs are now shown in the Profiler.

Improved

New search heuristics for adware variants added.
New search heuristics for Python RATs added.
Hard-coded search paths have been updated.

Changed

MPlayer OSX Extended is no longer included in the search items.

Version 1.044

4 March 2018

Fixed

Removed several regressions resulting from the 1.04 update.
Resolved a logic error in the search heuristics.
Some debugging messages have been removed from the CLI tool output.

Changed

Search results are now deselected by default and users are reminded of the necessity of having a backup disk before making deletions.

Version 1.04

2 March 2018

New

An 'Update Available' button is now shown in the User Interface. This can be controlled in the Preferences > General tab and managed via defaults key "VisualUpdates" (takes 0 | 1 for off | on, respectively).

For registered users, the Folder Observer can now be told to ignore certain keywords in the new Folder Observer preference tab.

For Management license holders, the DetectX Swift main interface can now be branded with your own custom text.

A notification alert appears when items are added or removed from the list of Accessibility apps in System Prefs > Security & Privacy > Accessibility while DetectX Swift is running.

Improved

New search heuristics added.

Fixed

A number of bugs have been squashed, and much code has under gone optimization to improve security and reliability.

Version 1.03

7 February 2018

New

The Help menu now contains a direct link to the Sqwarq User Group (hosted by Slack and subject to Slack Terms of Use).

The verb compare has been added to the AppleScript Dictionary. This allows you to run a diff on any two runs held in History.

The Application Support folder now contains some example AppleScripts that can be modified to suit your needs. In the event that you need to reinstall or recreate the default examples, delete the Example Scripts folder then (re)launch DetectX Swift.

The command line tool now has a status command which returns the registration status for use of the CLI Search function.

Pro & Management license holders can now customise the title, icon, text and confirm button text in the Folder Observer alert.

Changed

The Folder Observer alert now shows the DetectX Swift icon by default.

Fixed

A bug in the search heuristic that caused a false positive was removed.

Version 1.02

29 January 2018

New

AppleScript Support: Please see the DetectX Swift Terminology Suite in your AppleScript editor's Dictionary viewer.

We plan to add further AppleScript functionality going forward, so please put in requests for specific commands, classes and properties you'd like exposed for scripting.

QuietLaunch: A hidden preference that launches DetectX Swift without running either the profiler or the search. This can only be set and unset via the command line:

defaults write com.sqwarq.DetectX-Swift QuietLaunch -boolean true
defaults write com.sqwarq.DetectX-Swift QuietLaunch -boolean false

QuietLaunch is primarily intended as an aid to AppleScripters and is not recommended for general use. See the Advanced section in the forthcoming update to the User Guide for more details.

Fixed

A bug was addressed that could cause the Uninstall procedure to falsely warn that uninstalling had failed.
The command line tool should now exit with an appropriate return code.
Several issues regarding the Registration window and the registration process have been addressed.

Notes

An incompatibility with some configuration settings of McAfee Anti-Virus has come to light. In the event that McAfee AV is installed and DetectX Swift quits soon after launch, please adjust the AV settings to allow execution of DetectX Swift.
After upgrading to v1.02, earlier versions of DetectX Swift will be unable to recognize existing registration details. This will only affect a registered user that subsequently downgrades to v1.01 or earlier (perhaps as a result of restoring from backup). In that event, the original registration details will need to be reentered.

Version 1.01

21 January 2018

Improved

New search heuristics added.
The reportGatherer function now collects information on any configured emond clients.

Fixed

DetectX Swift now correctly switches to the main view when the reportGatherer function is run.
An unwrapped optional that could cause DetectX Swift to crash when entering the registration details is now handled properly.

Deprecated

The CLI's scan & vscan commands will be removed in a future release. Please use search and vsearch instead.

Version 1.0

15 January 2018

New

Initial public release.

Note: your DetectX Swift update and these release notes are secured using encrypted https protocols.

See the User Guide for full documentation of all features.

Requires macOS 10.11 or higher.

For support, visit

DetectX Swift Support

For more apps for your macs, visit us at Sqwarq.com