Google Drive Workflow is recognised as Maleware by Malwarebytes

[chrisspiegl]

I am using the Workflow and it's working great.

Today, I ran a Maleware check with Malewarebytes (free version) and noticed that the workflows launch agent is recognised as a maleware by the program.

It does not seem to be all that serious and is only recognised as "OSX Generic Suspicion" but I thought to mention it here non the less.

Here is a screenshot of what Malewarebytes shows as a result:

Maybe something about the workflow can be changed so that it does not trigger the scanner and possibly confuse people?

Cheers, Chris

[vitorgalvao]

but I thought to mention it here non the less.

Thank you.

Maybe something about the workflow can be changed so that it does not trigger the scanner

Probably not. The launchd agent is super simple (it just calls an External Trigger in the Workflow) and removing it would require users to remember to rebuild their caches manually. I’d wager they’re just checking ~/Library/LaunchAgents and triggering on everything they don’t know about.

They have a forum to report false positives. Would you mind posting there? I don’t use Malwarebytes and they want the scanner logs together with the report. I’m available to answer questions they may have.

[chrisspiegl]

I'll try and submit it sometime next week. Thanks for the update.

[vitorgalvao]

Thank you. I’ll be closing as solved, then. If you wish to add a link back here afterwards it’s appreciated, but no worries if not. Thank you again! Have a great weekend.

[chrisspiegl]

Hello @vitorgalvao, as requested I did report this on the Forum.

They responded and gave a suggestion about how this could be prevented pretty easily by simply moving the Apple Script into a text file with a shell shebang.

Forum Thread here

[vitorgalvao]

moving the Apple Script into a text file

This wouldn’t work because the launchd agent wouldn’t know where to look for the script. The location of a Workflow on a file system depends on the user’s sync settings. Alfred expects to be called via osascript because it provides a way of interaction otherwise not possible. It is the solution designed for the problem.

Thank you for trying.

[chrisspiegl]

Thanks for the update @vitorgalvao, I am just trying to figure this out.

Interestingly — not sure why — the 1Password Workflow does not get recognised by Malwarebytes despite almost looking the same in code.

Maybe there will be a different approach in the future which could change the behaviour to one that is not marked as suspicious by Malwarebytes.

But for anyone landing here from finding this as suspicious:

1. Open Malwarebytes
2. Open Detection History
3. Allow List
4. Add Button
5. Find the following two file:
   • ~/Library/Launchagents/com.alfredapp.googledrive.plist
6. Add it to the Allow List