A lot of mysterious executable files inside /Users/SharedMavericks: User no longer owner of Home folder and contentIs it possible to remove the “Shared” folder under Users?How to display tagged files inside hidden directories?Where are stored C “object” and “executable” files in Xcode?What are locked files (already inside Trash)?OS X: common paths for executable filesWhy under /bin are there so many ‘Unix executable files’?Access iCloud shared photo stream files on filesystemRecovering folders in executable drive converted into 0 byte “Unix Executable” filesAutomatically tag newly shared files?

Customize circled numbers

Can someone explain how this makes sense electrically?

How should I respond when I lied about my education and the company finds out through background check?

How to align and center standalone amsmath equations?

Translation of Scottish 16th century church stained glass

Greco-Roman egalitarianism

Varistor? Purpose and principle

Proving a function is onto where f(x)=|x|.

How do ground effect vehicles perform turns?

How can "mimic phobia" be cured or prevented?

Transformation of random variables and joint distributions

Difference between -| and |- in TikZ

Could the E-bike drivetrain wear down till needing replacement after 400 km?

Is possible to search in vim history?

Create all possible words using a set or letters

Can the Supreme Court overturn an impeachment?

How do I repair my stair bannister?

Is it possible to use .desktop files to open local pdf files on specific pages with a browser?

Bob has never been a M before

Why did the HMS Bounty go back to a time when whales are already rare?

THT: What is a squared annular “ring”?

My friend sent me a screenshot of a transaction hash, but when I search for it I find divergent data. What happened?

Does the Mind Blank spell prevent the target from being frightened?

If a character with the Alert feat rolls a crit fail on their Perception check, are they surprised?



A lot of mysterious executable files inside /Users/Shared


Mavericks: User no longer owner of Home folder and contentIs it possible to remove the “Shared” folder under Users?How to display tagged files inside hidden directories?Where are stored C “object” and “executable” files in Xcode?What are locked files (already inside Trash)?OS X: common paths for executable filesWhy under /bin are there so many ‘Unix executable files’?Access iCloud shared photo stream files on filesystemRecovering folders in executable drive converted into 0 byte “Unix Executable” filesAutomatically tag newly shared files?













2















Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus







share|improve this question



















  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday















2















Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus







share|improve this question



















  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday













2












2








2








Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus







share|improve this question
















Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus




macos finder disk-space virus






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited yesterday







Jonathan Filbert

















asked yesterday









Jonathan FilbertJonathan Filbert

213




213







  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday












  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday







3




3





Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

– nohillside♦
yesterday





Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

– nohillside♦
yesterday













Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

– Jonathan Filbert
yesterday





Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

– Jonathan Filbert
yesterday













Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

– Pete Cooper
yesterday





Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

– Pete Cooper
yesterday













Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

– Jonathan Filbert
yesterday





Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

– Jonathan Filbert
yesterday













Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

– nohillside♦
yesterday





Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

– nohillside♦
yesterday










1 Answer
1






active

oldest

votes


















4














Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer























  • Thanks for the advice!

    – Jonathan Filbert
    yesterday










Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "118"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f354586%2fa-lot-of-mysterious-executable-files-inside-users-shared%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









4














Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer























  • Thanks for the advice!

    – Jonathan Filbert
    yesterday















4














Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer























  • Thanks for the advice!

    – Jonathan Filbert
    yesterday













4












4








4







Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer













Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.







share|improve this answer












share|improve this answer



share|improve this answer










answered yesterday









Pete CooperPete Cooper

34616




34616












  • Thanks for the advice!

    – Jonathan Filbert
    yesterday

















  • Thanks for the advice!

    – Jonathan Filbert
    yesterday
















Thanks for the advice!

– Jonathan Filbert
yesterday





Thanks for the advice!

– Jonathan Filbert
yesterday

















draft saved

draft discarded
















































Thanks for contributing an answer to Ask Different!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f354586%2fa-lot-of-mysterious-executable-files-inside-users-shared%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

getting Checkpoint VPN SSL Network Extender working in the command lineHow to connect to CheckPoint VPN on Ubuntu 18.04LTS?Will the Linux ( red-hat ) Open VPNC Client connect to checkpoint or nortel VPN gateways?VPN client for linux machine + support checkpoint gatewayVPN SSL Network Extender in FirefoxLinux Checkpoint SNX tool configuration issuesCheck Point - Connect under Linux - snx + OTPSNX VPN Ububuntu 18.XXUsing Checkpoint VPN SSL Network Extender CLI with certificateVPN with network manager (nm-applet) is not workingWill the Linux ( red-hat ) Open VPNC Client connect to checkpoint or nortel VPN gateways?VPN client for linux machine + support checkpoint gatewayImport VPN config files to NetworkManager from command lineTrouble connecting to VPN using network-manager, while command line worksStart a VPN connection with PPTP protocol on command linestarting a docker service daemon breaks the vpn networkCan't connect to vpn with Network-managerVPN SSL Network Extender in FirefoxUsing Checkpoint VPN SSL Network Extender CLI with certificate

Image
If human space travel is limited by the G force vulnerability, is there a way to counter G forces? Did Shadowfax go to Valinor? Do I have a twin with permutated remainders? Blender 2.8 I can't see vertices, edges or faces in edit mode 1960's book about a plague that kills all white people How can I make my BBEG immortal short of making them a Lich or Vampire? Alternative to sending password over mail? Is it inappropriate for a student to attend their mentor's dissertation defense? Why is Collection not simply treated as Collection<?> Took a trip to a parallel universe, need help deciphering Assassin's bullet with mercury Why is it a bad idea to hire a hitman to eliminate most corrupt politicians? I Accidentally Deleted a Stock Terminal Theme Is there a hemisphere-neutral way of specifying a season? What about the virus in 12 Monkeys? Why can't we play rap on piano? Arrow those variables! Today is the Center Modeling an IP Ad...
Read more

NetworkManager fails with “Could not find source connection”Trouble connecting to VPN using network-manager, while command line worksHow can I be notified about state changes to a VPN adapterBacktrack 5 R3 - Refuses to connect to VPNFeed all traffic through OpenVPN for a specific network namespace onlyRun daemon on startup in Debian once openvpn connection establishedpfsense tcp connection between openvpn and lan is brokenInternet connection problem with web browsers onlyWhy does NetworkManager explicitly support tun/tap devices?Browser issues with VPNTwo IP addresses assigned to the same network card - OpenVPN issues?Cannot connect to WiFi with nmcli, although secrets are provided

Image
What typically incentivizes a professor to change jobs to a lower ranking university? Reorder a Master List Based on a Reordered Subset How does one intimidate enemies without having the capacity for violence? Is it possible to do 50 km distance without any previous training? Java Casting: Java 11 throws LambdaConversionException while 1.8 does not How much RAM could one put in a typical 80386 setup? Is it legal for company to use my work email to pretend I still work there? Are astronomers waiting to see something in an image from a gravitational lens that they've already seen in an adjacent image? How is it possible to have an ability score that is less than 3? Why does Kotter return in Welcome Back Kotter? Can I ask the recruiters in my resume to put the reason why I am rejected? Why is consensus so controversial in Britain? Which country benefited the most from UN Security Council vetoes? Do infinite dimensional systems make sense? What's the poi...
Read more

대한민국 목차 국명 지리 역사 정치 국방 경제 사회 문화 국제 순위 관련 항목 각주 외부 링크 둘러보기 메뉴북위 37° 34′ 08″ 동경 126° 58′ 36″ / 북위 37.568889° 동경 126.976667°  / 37.568889; 126.976667ehThe Korean Repository문단을 편집문단을 편집추가해Clarkson PLC 사Report for Selected Countries and Subjects-Korea“Human Development Index and its components: P.198”“http://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EB%8C%80%ED%95%9C%EB%AF%BC%EA%B5%AD%EA%B5%AD%EA%B8%B0%EB%B2%95”"한국은 국제법상 한반도 유일 합법정부 아니다" - 오마이뉴스 모바일Report for Selected Countries and Subjects: South Korea격동의 역사와 함께한 조선일보 90년 : 조선일보 인수해 혁신시킨 신석우, 임시정부 때는 '대한민국' 국호(國號) 정해《우리가 몰랐던 우리 역사: 나라 이름의 비밀을 찾아가는 역사 여행》“남북 공식호칭 ‘남한’‘북한’으로 쓴다”“Corea 대 Korea, 누가 이긴 거야?”국내기후자료 - 한국[김대중 前 대통령 서거] 과감한 구조개혁 'DJ노믹스'로 최단기간 환란극복 :: 네이버 뉴스“이라크 "韓-쿠르드 유전개발 MOU 승인 안해"(종합)”“해외 우리국민 추방사례 43%가 일본”차기전차 K2'흑표'의 세계 최고 전력 분석, 쿠키뉴스 엄기영, 2007-03-02두산인프라, 헬기잡는 장갑차 'K21'...내년부터 공급, 고뉴스 이대준, 2008-10-30과거 내용 찾기mk 뉴스 - 구매력 기준으로 보면 한국 1인당 소득 3만弗과거 내용 찾기"The N-11: More Than an Acronym"Archived조선일보 최우석, 2008-11-01Global 500 2008: Countries - South Korea“몇년째 '시한폭탄'... 가계부채, 올해는 터질까”가구당 부채 5000만원 처음 넘어서“‘빚’으로 내몰리는 사회.. 위기의 가계대출”“［경제365］ 공공부문 부채 급증…800조 육박”“"소득 양극화 다소 완화...불평등은 여전"”“공정사회·공생발전 한참 멀었네”iSuppli，08年2QのDRAMシェア・ランキングを発表(08/8/11)South Korea dominates shipbuilding industry | Stock Market News & Stocks to Watch from StraightStocks한국 자동차 생산, 3년 연속 세계 5위자동차수출 '현대-삼성 웃고 기아-대우-쌍용은 울고' 과거 내용 찾기동반성장위 창립 1주년 맞아Archived"중기적합 3개업종 합의 무시한 채 선정"李대통령, 사업 무분별 확장 소상공인 생계 위협 질타삼성-LG, 서민업종인 빵·분식사업 잇따라 철수상생은 뒷전…SSM ‘몸집 불리기’ 혈안Archived“경부고속도에 '아시안하이웨이' 표지판”'철의 실크로드' 앞서 '말(言)의 실크로드'부터, 프레시안 정창현, 2008-10-01“'서울 지하철은 안전한가?'”“서울시 “올해 안에 모든 지하철역 스크린도어 설치””“부산지하철 1,2호선 승강장 안전펜스 설치 완료”“전교조, 정부 노조 통계서 처음 빠져”“［Weekly BIZ］ 도요타 '제로 이사회'가 리콜 사태 불러들였다”“S Korea slams high tuition costs”““정치가 여론 양극화 부채질… 합리주의 절실””“〈"`촛불집회'는 민주주의의 질적 변화 상징"〉”““촛불집회가 민주주의 왜곡 초래””“국민 65%, "한국 노사관계 대립적"”“한국 국가경쟁력 27위‥노사관계 '꼴찌'”“제대로 형성되지 않은 대한민국 이념지형”“［신년기획-갈등의 시대］ 갈등지수 OECD 4위…사회적 손실 GDP 27% 무려 300조”“2012 총선-대선의 키워드는 '국민과 소통'”“한국 삶의 질 27위, 2000년과 2008년 연속 하위권 머물러”“［해피 코리아］ 행복점수 68점…해외 평가선 '낙제점'”“한국 어린이·청소년 행복지수 3년 연속 OECD ‘꼴찌’”“한국 이혼율 OECD중 8위”“［통계청］ 한국 이혼율 OECD 4위”“오피니언 ［이렇게 생각한다］ `부부의 날` 에 돌아본 이혼율 1위 한국”“Suicide Rates by Country, Global Health Observatory Data Repository.”“1. 또 다른 차별”“오피니언 ［편집자에게］ '왕따'와 '패거리 정치' 심리는 닮은꼴”“［미래한국리포트］ 무한경쟁에 빠진 대한민국”“대학생 98% "외모가 경쟁력이라는 말 동의"”“특급호텔 웨딩·200만원대 유모차… "남보다 더…" 호화病, 고질병 됐다”“［스트레스 공화국］ ① 경쟁사회, 스트레스 쌓인다”““매일 30여명 자살 한국, 의사보다 무속인에…””“"자살 부르는 '우울증', 환자 중 85% 치료 안 받아"”“정신병원을 가다”“대한민국도 ‘묻지마 범죄’,안전지대 아니다”“유엔 "학생 '성적 지향'에 따른 차별 금지하라"”“유엔아동권리위원회 보고서 및 번역본 원문”“고졸 성공스토리 담은 '제빵왕 김탁구' 드라마 나온다”“‘빛 좋은 개살구’ 고졸 취업…실습 대신 착취”원본 문서“정신건강, 사회적 편견부터 고쳐드립니다”‘소통’과 ‘행복’에 목 마른 사회가 잠들어 있던 ‘심리학’ 깨웠다“［포토］ 사유리-곽금주 교수의 유쾌한 심리상담”“"올해 한국인 평균 영화관람횟수 세계 1위"(종합)”“［게임연중기획］ 게임은 문화다-여가활동 1순위 게임”“영화속 ‘영어 지상주의’ …“왠지 씁쓸한데””“2월 `신문 부수 인증기관` 지정..방송법 후속작업”“무료신문 성장동력 ‘차별성’과 ‘갈등해소’”대한민국 국회 법률지식정보시스템"Pew Research Center's Religion & Public Life Project: South Korea"“amp;vwcd=MT_ZTITLE&path=인구·가구%20>%20인구총조사%20>%20인구부문%20>%20 총조사인구(2005)%20>%20전수부문&oper_YN=Y&item=&keyword=종교별%20인구& amp;lang_mode=kor&list_id= 2005년 통계청 인구 총조사”원본 문서“한국인이 좋아하는 취미와 운동 (2004-2009)”“한국인이 좋아하는 취미와 운동 (2004-2014)”Archived“한국, `부분적 언론자유국' 강등〈프리덤하우스〉”“국경없는기자회 "한국, 인터넷감시 대상국"”“한국, 조선산업 1위 유지(S. Korea Stays Top Shipbuilding Nation) RZD-Partner Portal”원본 문서“한국, 4년 만에 ‘선박건조 1위’”“옛 마산시,인터넷속도 세계 1위”“"한국 초고속 인터넷망 세계1위"”“인터넷·휴대폰 요금, 외국보다 훨씬 비싸”“한국 관세행정 6년 연속 세계 '1위'”“한국 교통사고 사망자 수 OECD 회원국 중 2위”“결핵 후진국' 한국, 환자가 급증한 이유는”“수술은 신중해야… 자칫하면 생명 위협”대한민국분류대한민국의 지도대한민국 정부대표 다국어포털대한민국 전자정부대한민국 국회한국방송공사about korea and information korea브리태니커 백과사전(한국편)론리플래닛의 정보(한국편)CIA의 세계 정보(한국편)마리암 부디아 (Mariam Budia),『한국: 하늘이 내린 한 폭의 그림』, 서울: 트랜스라틴 19호 (2012년 3월)대한민국ehehehehehehehehehehehehehehWorldCat132441370n791268020000 0001 2308 81034078029-6026373548cb11863345f(데이터)00573706ge128495

Image
고조선원삼국 시대삼국 시대남북국 시대후삼국 시대고려조선대한제국일제 강점기대한민국 임시 정부한반도 분단미군정개요제1공화국제2공화국제3공화국제4공화국제5공화국제6공화국4.3 사건6.25 전쟁4.19 혁명5.16 쿠테타한강의 기적부마 항쟁10.26 사태12.12 사태광주 민주화 운동6월 항쟁1988년 서울올림픽IMF 외환...
Read more