A lot of mysterious executable files inside /Users/SharedMavericks: User no longer owner of Home folder and contentIs it possible to remove the “Shared” folder under Users?How to display tagged files inside hidden directories?Where are stored C “object” and “executable” files in Xcode?What are locked files (already inside Trash)?OS X: common paths for executable filesWhy under /bin are there so many ‘Unix executable files’?Access iCloud shared photo stream files on filesystemRecovering folders in executable drive converted into 0 byte “Unix Executable” filesAutomatically tag newly shared files?

Can someone explain how this makes sense electrically?

Sampling Theorem and reconstruction

Drawing ramified coverings with tikz

Can a significant change in incentives void an employment contract?

Greatest common substring

Has Darkwing Duck ever met Scrooge McDuck?

Is possible to search in vim history?

Some numbers are more equivalent than others

Bob has never been a M before

Proof of Lemma: Every nonzero integer can be written as a product of primes

Transformation of random variables and joint distributions

Will adding a BY-SA image to a blog post make the entire post BY-SA?

Is XSS in canonical link possible?

Divine apple island

Should I stop contributing to retirement accounts?

What's the difference between 違法 and 不法?

If a character with the Alert feat rolls a crit fail on their Perception check, are they surprised?

Why does Async/Await work properly when the loop is inside the async function and not the other way around?

Journal losing indexing services

Do Legal Documents Require Signing In Standard Pen Colors?

Greco-Roman egalitarianism

How to color a curve

Can I sign legal documents with a smiley face?

Is it possible to use .desktop files to open local pdf files on specific pages with a browser?



A lot of mysterious executable files inside /Users/Shared


Mavericks: User no longer owner of Home folder and contentIs it possible to remove the “Shared” folder under Users?How to display tagged files inside hidden directories?Where are stored C “object” and “executable” files in Xcode?What are locked files (already inside Trash)?OS X: common paths for executable filesWhy under /bin are there so many ‘Unix executable files’?Access iCloud shared photo stream files on filesystemRecovering folders in executable drive converted into 0 byte “Unix Executable” filesAutomatically tag newly shared files?













2















Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus







share|improve this question



















  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday















2















Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus







share|improve this question



















  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday













2












2








2








Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus







share|improve this question
















Recently I've noticed that a lot of mysterious .tar.gz and executable files have spawned inside my Shared folder, and by a lot I mean 466 total.



/Users/Shared $ ls | wc -l
 466


I'm the only user on my Macbook Pro and out of the 466, I only recognized 6 of them being folders with an installed application name (CleanMyMac, Renewed Vision Media, etc) so those are not the problem. As for the rest, they look horrific:



 ls -l /Users/Shared
total 824456
drwxrwxr-x 5 root wheel 160 Feb 12 14:38 Adobe
drwxrwxrwx 2 root wheel 64 Aug 10 2018 AdobeInstalledCodecs
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 12 10:02 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 10:32 App_01D422FE-C147-4010-9A44-D4358E33D212-1210-0000006734D5E80A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 31 20:29 App_02966A96-E2BC-48F1-A082-387BFD2559A6-1246-0000005E71CF0D2B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 2 00:44 App_041C25CA-E276-4BBD-87FF-1AAF42FB62CF-1199-0000004DE163A3E6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 28 16:51 App_05BDF17A-375B-45DA-B054-D77F0BBA7061-1166-000000502FEEE31D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 26 13:54 App_070BFBA2-26D0-448F-9123-DADD3A2ECB49-1218-0000007FCF9E349B.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 12:44 App_0977FD4D-5953-4F70-BE63-FD750A3BF6DC-1231-0000005027783E91.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 11:10 App_0A03682C-6DB4-4908-B386-A6BB644D3C74-1276-0000005B2AD5C511.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 23 15:53 App_0A8D9DBD-BAA7-444B-9E85-87972AF665EF-1216-0000005A3907D09A.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 9 19:22 App_0ABFFC9E-731F-46BD-B117-17A76FBCA084-1236-0000004ED1B99385.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 12 21:02 App_0C6FC480-EF97-4009-BF39-96F58799E7ED-1192-0000005E9FC8FC9F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 15 00:01 App_0DAD0990-45B0-4F11-A37A-DC9F8784C3C9-1185-000000610AEAD23D.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 30 21:13 App_0F3DAB99-B214-4DBF-BBE4-A51C779F6987-1153-0000006B23FCBCB3.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 08:53 App_126A36AB-A0C5-4D4C-A23A-113EA6E7C970-1806-0000009535B1B6CB.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 21 15:40 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 16 14:36 App_12E3E8A1-9788-4ABF-915A-F199A0C6143C-1221-000000541C12C17A.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 11 23:07 App_12EBEA64-5051-4122-89DF-9FB8DADAA41B-1275-00000063D967AF8B.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 19 15:51 App_149EDAB5-6A58-40F6-9FC8-B3E4F3279538-1218-0000006CC5FF38F4.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 31 14:57 App_16277D4A-ACA9-4730-8929-892500D29B19-1132-000000503FDB731F.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 8 20:18 App_16A18583-FD97-4644-BF06-137B0FFD35E1-1204-0000006A2372C7CA.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 17 19:50 App_175B9F9E-2372-4165-AA2B-F0123E12ABEB-1895-00000095CD045C8F.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 25 00:10 App_17D25F31-21C7-4C55-97B4-278F3EF29F8B-1295-0000004E3FCB237E.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585
-rw-r--r-- 1 jonathanfilbert wheel 331578 Nov 21 18:27 App_18987876-EDA5-44F8-839D-9D0ED9E85C10-1225-00000058DFD63585.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:01 App_18CFA5BA-85C7-4EC0-930C-73A0847EA055-1197-00000056895B3D96.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 7 15:44 App_18E54EEA-52A5-4EE5-BC99-1D112C18A214-1352-00000051E2111EC0.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:29 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Feb 2 18:25 App_1AB67930-C1CE-46E9-AB02-B6E24E0385B7-1223-00000051EB8F1D18.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Dec 21 19:17 App_1AC8F899-D2AA-4AB9-9BF1-35BE98ED1EDE-16157-000006E2D274F110.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Feb 6 15:28 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56
-rw-r--r-- 1 jonathanfilbert wheel 4660684 Jan 26 12:39 App_1F263B6A-077E-482C-94FF-3C3D6892F2B9-1324-0000005F3A9C6E56.tar.gz
drwxr-xr-x 3 jonathanfilbert wheel 96 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 5 19:34 App_221EA77C-0E38-421F-9BF6-D5465E75EE63-2756-000000D9B2A9FFF6.tar.gz
drwxr-xr-x 2 jonathanfilbert wheel 64 Mar 23 16:59 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0
-rw-r--r-- 1 jonathanfilbert wheel 331578 Dec 17 23:39 App_22BBCFA5-1384-4B28-9688-C5463795FD48-1143-0000006521EDAAE0.tar.gz


Here is the ls -l results for some of the directories



-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 13 20:41 a_0058AB63-F619-42E5-BBA5-86532551CFA3-1193-00000054FCB20168
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 23 15:51 a_0153215B-DE1E-47B0-B4DF-961804DB2CB2-1216-00000057AE7086FB
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 17 13:00 a_01BDBE1A-5EDC-413E-BE41-33A611EF871F-1134-000000754A4E692A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Jan 2 11:33 a_01F076CE-B02D-4C1F-8058-A4A832333CE7-1291-0000004D445928B5
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 19 14:09 a_02B73853-967A-4723-98BA-D81553A2D7FE-1189-0000004EACDB9D9C
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 11 15:30 a_036B3671-AF44-4439-9BA5-1B31232B6CE1-1243-0000004FA1CF7311
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 17 19:08 a_06AEA1F5-2958-4AAB-A9FE-741837F4FCA9-1206-0000004E458C7071
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 1 23:56 a_0880EF4F-ADF4-4DF5-A0F7-C5689828D5DC-9985-0000041F7999B6FA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 16 18:15 a_0898EB66-62FE-4D6A-8D60-E4EC2A2489E4-1178-000000541561A81E
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 8 17:32 a_0ABD7D94-04C0-40FC-A637-01DB09630972-1233-0000004D07EB2930
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Dec 5 12:22 a_0D32C0E7-A993-47B1-A7C6-4D41C2B691E1-1160-0000005194510DAA
-rwxrwxrwx 1 jonathanfilbert wheel 183456 Dec 25 00:10 a_0D3F7A43-9BB0-4D09-9811-6953AD28AE4D-1295-00000051353554A9
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 29 21:33 a_0D5D220A-C3C0-49B7-A64B-49C64E3DD865-6976-000000680ED5309B
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 10 23:11 a_1288DB46-490B-49D4-840F-3E725AF6F4AE-1243-0000006C70925320
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 11 23:08 a_132D252F-B372-468B-A748-D084AEE5E355-1275-0000006BA6ED0EBA
-rwxrwxrwx 1 jonathanfilbert wheel 244928 Jan 17 19:50 a_141E730D-6CE1-470B-86B9-8CABEF1F4A4C-1895-0000009B37EC280A
-rwxrwxrwx 1 jonathanfilbert wheel 210848 Nov 25 23:53 a_1817CEF5-03C3-4968-8CA9-03F5D24540BF-1330-0000006C576DC205


My question is, aside from the 6 recognized folders, is it safe to delete those things? As they take up quite a lot of space, and recently, I found a malicious file named SystemExtr residing inside one of the folders, and deleted it, but somehow it returned.






macos finder disk-space virus




macos finder disk-space virus






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited yesterday







Jonathan Filbert

















asked yesterday









Jonathan FilbertJonathan Filbert

213




213







  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday












  • 3





    Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

    – nohillside♦
    yesterday











  • Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

    – Jonathan Filbert
    yesterday











  • Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

    – Pete Cooper
    yesterday











  • Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

    – Jonathan Filbert
    yesterday











  • Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

    – nohillside♦
    yesterday







3




3





Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

– nohillside♦
yesterday





Please don't post screenshots of Terminal output, copy/paste the text instead and apply code formatting (the in the editor menu). While editing, can you please replace the Finder screenshot with the result of ls -l /Users/Shared (not all lines, just 10-20 so we can see the full names, the dates, the permissions etc).

– nohillside♦
yesterday













Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

– Jonathan Filbert
yesterday





Hey @nohillside thanks for the reply, I've edited the question and replaced the images with code formatted Terminal output. Thanks!

– Jonathan Filbert
yesterday













Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

– Pete Cooper
yesterday





Each executable has an associated directory - can you post the ls -l results from one or more of those, please?

– Pete Cooper
yesterday













Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

– Jonathan Filbert
yesterday





Hey @PeteCooper I've modified the question and included what you asked. Thanks in advance!

– Jonathan Filbert
yesterday













Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

– nohillside♦
yesterday





Can you run file on some of these files? Having said that I'm quite sure that you can just delete the whole mess, at least that's what I would do. But this doesn't solve the underlying problem of whether your Mac has some malware of course.

– nohillside♦
yesterday










1 Answer
1






active

oldest

votes


















4














Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer























  • Thanks for the advice!

    – Jonathan Filbert
    yesterday










Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "118"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f354586%2fa-lot-of-mysterious-executable-files-inside-users-shared%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









4














Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer























  • Thanks for the advice!

    – Jonathan Filbert
    yesterday















4














Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer























  • Thanks for the advice!

    – Jonathan Filbert
    yesterday













4












4








4







Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.






share|improve this answer













Note: this doesn't answer your question directly but is advice and some further steps to troubleshoot.



If your computer has been reported as being affected my malware, you are likely better off long-term to back up your personal data (i.e user directory etc), note the apps you have installed, and start over with a nuke & repave. A few hours spent doing this is better than rescuing a system with unquantified levels of malware -- it could be just 'SystemExtr' or it could be a whole heap of other things -- and the nature of some malware means it can't be 100% removed.



In the meantime:



  • use a reputable macOS malware scanner like Malwarebytes or Sophos to see if they pick anything up;

  • upload one of the executables to VirusTotal to see if it find anything;

And for ongoing homework: learn a bit about hard drive space management and reduce reliance on the whizzy apps (especially the free ones) that do all this for you. Some are reputable, some are junk. Using a disk viewer like Grand Perspective will give you better visibility into what's going on inside your hard drive, and give you more control overall.







share|improve this answer












share|improve this answer



share|improve this answer










answered yesterday









Pete CooperPete Cooper

34616




34616












  • Thanks for the advice!

    – Jonathan Filbert
    yesterday

















  • Thanks for the advice!

    – Jonathan Filbert
    yesterday
















Thanks for the advice!

– Jonathan Filbert
yesterday





Thanks for the advice!

– Jonathan Filbert
yesterday

















draft saved

draft discarded
















































Thanks for contributing an answer to Ask Different!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f354586%2fa-lot-of-mysterious-executable-files-inside-users-shared%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

Image
17 \\$\\begingroup\\$ I need an answer because I am a beginner. And I got the players handbook and it does not say a thing about this. pathfinder-1e pathfinder-beginner-box share | improve this question edited 2 days ago V2Blast ♦ 33.8k 5 5 gold badges 123 123 silver badges 212 212 bronze badges asked 2 days ago Brys Brys 89 1 1 silver badge 3 3 bronze badges New contributor ...
Read more

Sum ergo cogito? 1 nng

Image
3 Following Descartes but in the opposite direction: I exist. Something has made the assertion in the previous sentence and must have thought it to do so. Therefore my thoughts exist. Combining with the direction established by Descartes I have cogito ⇔ sum . Since assuming either is equiavlent to assuming the other I conclude that Descartes does not establish existence as following from something more basic or fundamental. Instead he has merely stated a tautology. Am I right or wrong? Or both, or neither? ontology descartes share | improve this question asked yesterday Dzamo Norton...
Read more

三茅街道4182Guuntc Dn precexpngmageondP

Image
三茅街道 概览 国家   中华人民共和国 上级行政区 扬中市 行政区类型 街道办事处 行政区划代码 32 11 82 001 村级区划单位数 30 - 社区数 14 - 行政村数 16 地理、人口、经济 坐标 32°14′25″N 119°49′08″E  /  32.24028°N 119.81884°E  / 32.24028; 119.81884 坐标： 32°14′25″N 119°49′08″E  /  32.24028°N 119.81884°E  / 32.24028; 119.81884 电话区号 +86  时区 UTC+8（北京时间） 三茅街道 是中华人民共和国江苏省镇江市扬中市下辖的一个街道办事处 [1] 。西部毗邻新坝镇，东南方毗邻油坊镇、八桥镇，北隔长江主航道與泰州市高港区相望。 2000年以后，丰裕镇并入，三茅镇面积达到49.45平方千米，人口73284人。2005年，兴隆镇并入，面积133.19平方千米，人口13万，占扬中全市40%。 行政区划 [ 编辑 ] 三茅街道下辖以下村级行政区划单位 [2] ： 文化新村社区、扬子新村社区、江州路社区、英雄社区、广宁社区、中桥社区、建设社区、金星社区、同心社区、丰裕社区、新民社区、港联社区、新胜社区、新扬社区、民主村、中华村、友好村、锦程村、三桥村、大众村、滨江村、企东村、兴华村、指南村、兴阳村、明华村、营房村、永和村、永勤村和普济村。 参考资料 [ 编辑 ] ↑ 2017年统计用区划代码和城乡划分代码：扬中市. 中华人民共和国国家统计局. 2017.   ↑ 2017年统计用区划代码和城乡划分代码：三茅街道. 中华人民共和国国家统计局. 2017.     这是一个关于江苏行政区划的小作品。你可以通过 编辑或修订 扩充其内容。 查 论 编 扬中市行政区划 行政隶属：中华人民共和国江苏省镇江市 街道 三茅街道 兴隆街道 镇 新坝镇 油坊镇 八桥镇 西来桥镇 类似乡级单位 扬中市良种繁育场 扬中市种猪场 扬中市渔业社 雷公岛水产养殖场 扬...
Read more