Moreover, the name of the category will be similarly highlighted: If known malware is detected, the item's name and VirusTotal button will be highlighted in red. Known files contain a link to the full analysis report and a 'rescan?' button that will rescan the file. If the file is unknown, clicking the 'submit?' button will submit the file for analysis. With the query complete, the button can be clicked to reveal a popup containing VirusTotal-specific information about the file. Once the query is complete, the title of the button is automatically updated with either the detection ratio, or a '?' if the binary is not known to VirusTotal. While VirusTotal is being queried, this button displays '■ ■ ■'. If the item is an executable binary, KnockKnock automatically queries VirusTotal with a hash of the binary in order to retrieve any information. These buttons provide information about item's VirusTotal (anti-virus) scan results, general information about the file, and the ability to view the item in Finder. Clicking on any of the categories will display the items for that category in the right-hand items' table.Įach row in this table contains the name of the detected item, an icon indicating whether it belongs to Apple,, or a 3rd-party (but still signed), or is unsigned, its full path, and then various informational and actionable buttons. Each row contains the name and brief description of the category, and the number of detected items.

The left-handle table contains the categories of persistent software that KnockKnock scans. Although by default signed-Apple binaries are filtered out, legitimate 3rd-party software will likely be displayed. By design, KnockKnock simply lists persistently installed software. Press the 'Start Scan' button to instruct KnockKnock to scan known locations where persistent software or malware may be installed. This is optional, but will allow KnockKnock to perform a more comprehensive scan.įor more information on 'Full Disk Access', see: ' Full Disk Access and Why You Shouldn't Be Afraid of It' On recent versions of macOS, KnockKnock will prompt for 'Full Disk Access':

How do i check for malware on my mac