macOS Catalina update flagging file libecomlodr.dylib

[Scott Irvin]

After a recent update to Catalina, I now have a user reporting a system popup on startup that says the following:

"libecomlodr.dylib" will damage your computer.  The file was downloaded was downloaded on an unknown date.  Shall I just delete this?

After some digging it appears this is a component of Symantec that is being flagged.  Has anyone else seen this error?  

References to it on the Apple forums here:
https://discussions.apple.com/thread/251182010
https://discussions.apple.com/thread/251225642

https://discussions.apple.com/thread/251216130

https://macsecurity.net/view/352-libecomlodr-dylib-malware

Some of these posts suggest just deleting the file, but I am unsure what that would do to Symantec.

[ALee]

Hi Scott, which version of SEP for macOS are you using? I seeing this happens on random files which SEP 12.1 version.

------------------------------
Sr Manager, Product Management
------------------------------

[hemang]

Hi ALee, I am facing the same issue after I've updated to macOS Catalina 10.15.4.
I keep getting this popup once macOS updates gets done.

Can you please help me?

[ALee]

Hi, which version of the SEP are you using? Make sure you are using at least 14.x release. I seen this issue on 12.x when combine with 10.15.

------------------------------
Sr Manager, Product Management
------------------------------

[Shinu Abdulu Vayyattu Kavil]

I'm on macOS 10.15.5 and SEP 14.2.0 and have the same issue as the original poster reported. 

[ALee]

Hi Shinu, can you upgrade to SEP 14.2 RU2MP1, this is the version that support Catalina. Check the release version https://knowledge.broadcom.com/external/article/152316/symantec-endpoint-protection-sep-client.html.

If you are still seeing problem, please log a case to follow up.

Thanks.
Alan

------------------------------
Sr Manager, Product Management
------------------------------

[Shinu Abdulu Vayyattu Kavil]

Can I upgrade the SEP client on my side, without really upgrading the Endpoint server? In other words, does the 14.2.2_MP1 client works with 14.2.0 Endpoint Server?

 

Thanks,

Shinu

 

 

 

 

::DISCLAIMER::

---

The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. E-mail transmission is not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or may contain viruses in transmission. The e mail and its contents (with or without referred errors) shall therefore not attach any liability on the originator or HCL or its affiliates. Views or opinions, if any, presented in this email are solely those of the author and may not necessarily reflect the views or opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of authorized representative of HCL is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any email and/or attachments, please check them for viruses and other defects.

---

[ALee]

Shinu, yes you can test it out on your computer before upgrading the SEPM.

Alan

------------------------------
Sr Manager, Product Management
------------------------------