<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I'm not sure what solution you are seeking here. DetectX will record each and every time a key file is added or removed to/from selected locations, which includes all LaunchAgents, LaunchDaemons, Applications and a few other places where malware is often installed. When you see such a notice, if it's something you recall having allowed, then no further action is required. If it's a file that you cannot associated with an action on your part, then check the latest DetectX scan to see if that file or files are detected as malware. If not, then you should spend some time as you have here determining where it came from. <div class=""><br class=""></div><div class="">At this point, you have solved the mystery and should simply go back to work and forget about it. DetectX did it's job and so have you.</div><div class=""><br class=""></div><div class="">-Al-<br class=""><div class=""><br class=""><div class="">On Nov 3, 2019, at 02:19, Michael Newman via macports-users <<a href="mailto:macports-users@lists.macports.org" class="">macports-users@lists.macports.org</a>> wrote:</div><blockquote type="cite" class=""><br class="Apple-interchange-newline"><div class=""><span class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Thank you.</span><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Locate did not find this plist on the boot volume. It did find it in a Carbon Copy Cloner SafetyNet directory on a backup drive.</div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="">MrMuscle:home mnewman$ locate org.macports.postgresql83-server.plist</div><div class="">/Volumes/Clorox2/_CCC SafetyNet/2019-10-30 (October 30) 01-00-52/Library/LaunchDaemons/org.macports.postgresql83-server.plist</div><div class="">/Volumes/Clorox2/_CCC SafetyNet/2019-10-30 (October 30) 01-00-52/opt/local/etc/LaunchDaemons/org.macports.postgresql83-server/org.macports.postgresql83-server.plist</div><div class=""><br class=""></div><div class="">I think the first one is a symbolic link to the second.</div><div class=""><br class=""></div><div class="">So, I’m stuck. I can tell DetectX to ignore this, but that seems more like a coverup than a solution.</div><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Nov 3, 2019, at 16:51, Ryan Schmidt <<a href="mailto:ryandesign@macports.org" class="">ryandesign@macports.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span class="" style="caret-color: rgb(0, 0, 0); font-family: Courier; font-size: 24px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">MacPorts creates plists for ports that are meant to act as servers when you install those ports. The plists are removed, along with all of the port's other files, when the port is uninstalled.</span><br class="" style="caret-color: rgb(0, 0, 0); font-family: Courier; font-size: 24px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class="" style="caret-color: rgb(0, 0, 0); font-family: Courier; font-size: 24px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class="" style="caret-color: rgb(0, 0, 0); font-family: Courier; font-size: 24px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">You can use find or locate to try to determine whether a org.macports.postgresql83-server.plist file still exists even after you have uninstalled the port.</span></div></blockquote></div><br class=""></div><br class="Apple-interchange-newline"><br class=""></div><br class="Apple-interchange-newline"><style class="">ul[class*='mb-extra__public-links'], ul[class*='mb-note__public-links'], ul[class*='mb-task__public-links'] { display: none !important; }</style></blockquote></div></div></body></html>