Sequoia 15.4 refusing to open files - possible malware

I just updated to 15.4. Trying to open a simple text file (with srt extension) pops this up: "Apple could not verify" xxxx.srt "is free of malware that may harm your Mac or compromise your privacy." Some other srt files open fine.


This is a dealbreaker for me if I can't disable this "feature". I know I can go burrowing into settings and exempt this one file. No. How do I turn off the whole thing?

MacBook Pro 16″

Posted on Apr 1, 2025 2:06 PM

Reply
Question marked as ⚠️ Top-ranking reply

Posted on Apr 3, 2025 2:06 PM

Dessicator wrote:

etresoft, why do you think that's a malware site? I've downloaded many subtitles from it. They have nothing but subtitles in them, and I've never had any trouble.

Any subtitle file that I click on opens up this very respectable looking new "Browser Update" window:


I've obscured the name of the site, but I left the very respectable "xyz" TLD.


To display that page, it redirects to a couple of other similarly respectable domains first. One of those URLs is 12 lines long. It isn't doing these redirect via standard HTTP methods. The first redirect is done via Javascript somewhere on the site itself. I didn't bother to look where. The second redirect is also done via Javascript, but this time using very respectable and very obfuscated Javascript.


Normally I would look at these things on the command line with curl or similar. That didn't work in this case. I had to use Safari's Web Inspector timeline. I must have clicked on links at least 30 times altogether.


But curiously, one of those clicks via Safari's web Inspector actually didn't give me the whole respectable redirection. It gave me a different page with what may have been download links. So it's a website that seems to be able to detect when it's being inspected and alter its behaviour to work more legitimately in that scenario. OK, then!


I did once get a page for the "Best Crypto Casino and Online Sports Betting". Sadly, it wasn't available in my jurisdiction. Maybe because we have laws here?


I keep trying. Now I get a page where I can "Get paid for testing apps, games & surveys". Sure. Oh, look. I can sign in with Google or Facebook, but not Apple. Bummer.


But still I keep trying. I am able to get that legitimate-looking download page one more time. I click on one of the "translate" buttons and I'm back to the original redirector.


But wait! The "English" version has a "download" button. I click that - still the redirection. In not a single case was I able to download an SRT file.


If this really is a source of 10,364,786 subtitles, then perhaps Apple is right to associate SRT files with malware.


40 replies
Sort By: 

Apr 5, 2025 1:13 PM in response to Dessicator

Install an antivirus. Macs usually don't need antivirus (despite the fact that they can catch virus). However, it's always a great idea to install one two or three times year, just to run a full deep scan to catch and remove any possible threats. In this case, you should install an antivirus. Avast One Essential is a free good choice. However, if it's a one time only, you can install a better paid antivirus with the free trial. You should, after that, reinstall macOS and, if possible, erase the Mac before (do a Time Machine backup before). After this, you should select manually (to mitigate the risk of transferring again files possibly infected with virus) important files that you have to transfer to your Mac disk. Do not transfer any apps, if possible; always download them manually from the Mac App Store and, if important apps that you use are not there, download them from the internet, only from secure/trustable sources.

Reply

Apr 15, 2025 9:55 AM in response to Dessicator

I have found a workaround, with no need to change the security settings on my Mac with OS 15.4. At least it worked for me.


I think it is important to tell you that I have loads of .srt files for my business (I am in video production and use .srt subtitles normally and frequently) and I generally open them with TextEdit.


I, too, have received two .srt files that generate the same problem described by the OP. And the difference with other .srt files lies in the fact that the other files are not considered malware.


I tried to open both with Microsoft Word, which is not a recommended application.


I did not proceed when Word asked me to convert the files and canceled the routine.


Then I reopened the .srt files and the warning message was not shown.


I can read them with TextEdit and they are not damaged in any way.


I have no idea how Microsoft Word was able to override the security warning and, in any case, I had checked the files for malware and there was none.


But, hey, at least I do not have to go through the annoying process of "opening anyway".

Reply

Apr 16, 2025 3:48 PM in response to Dessicator

I have one Mac running Sequoia 15.3.2 which is with an i5 Intel Core. My .srt files open beautifully with TextEdit- always have. Now my iMac Mini running Sequoia version 15.4 but with the M2 Chip refuses to open the same file and considers it malware. Ridiculous! Now I am afraid to update my 15.3.2 to 15.4.1. Does anyone know if the Sequoia version is to blame for this problem or the actual processor? (i.e. Silicon vs Intel)

Reply

Apr 17, 2025 10:41 PM in response to caracu

This file extension change workaround does not work at all on my computer with 15.4.1, where the problem still appears.


I am almost sure the cause of this problem lies in the app where the .srt file was created.


Each app has attributes that are inherited by the resulting files, and I believe all we need is some user here who could tell us how to identify the attribute(s) leading to the original app, so we could let the developer know he or she has to contact Apple to fix this issue.

Reply

Sequoia 15.4 refusing to open files - possible malware

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.