Hello,

I'm currently running 10.11.4 Beta (15E56a).  I'm digging into the Transmission BT malware fiasco - and I see that OSX.KeRanger.A is in the XProtect update 2076.

I'm on 2075 - and I can't seem to get the update to install:

onosendai:vom   root$ defaults read /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta Version
2075

So I run this:

onosendai:vom   root$ softwareupdate --background-critical
softwareupdate[1500]: Triggering background check with forced scan (critical and config-data updates only) ...

And get the following in /var/log/install.log:

Mar  6 15:02:10 onosendai softwareupdated[454]: BackgroundActivity: Initiating com.apple.SoftwareUpdate.Activity activity
Mar  6 15:02:10 onosendai softwareupdated[454]: BackgroundActivity: Starting Background Check Activity
Mar  6 15:02:40 onosendai softwareupdated[454]: BackgroundActivity: Finished Background Check Activity

When I open App Store or check through Settings, I can seem to get it to recognize pending updates - but they are 'Ramped':

Mar  6 11:57:24 onosendai softwareupdated[454]: SUScan: Elapsed scan time = 12.3
Mar  6 11:57:24 onosendai softwareupdated[454]: Scan (f=1, d=0) completed
Mar  6 11:57:24 onosendai softwareupdated[454]: 6 updates found:
        031-04978        | CoreLSKD Configuration Data 8
        031-46302        | MRT Configuration Data 1.6
        031-48444        | Gatekeeper Configuration Data 86
        031-51822        | Chinese Word List Update 4.10
        031-52144        | Core Suggestions Configuration Data 731
        031-52944        | XProtectPlistConfigData 1.0
Mar  6 11:57:24 onosendai softwareupdated[454]: Ramped updates marked

And I can see an XProtect update waiting.

Is this is a known behavior running beta OSX updates ?  What is a 'Ramped' update ?

My wife's machine is stock 10.11.3 - I was able to run softwareupdate and she now has 2076.

Any info would be greatly appreciated.