Unknown zip and exec files keep re-appearing on downloads folder after restart

Every time I restart my Macbook two particular files keep appearing in my downloads folder. I delete them every time but always come back. The files are a zip file called "cinematic 01.zip" and an exec file called "mimetype". I fear there is something malicious in the background of my OS causing these files to keep showing up. Any help on navigating this issue or finding out what causes this behavior?


Model Name: MacBook Pro (mid 2014)

OS Catalina 10.15.4

MacBook Pro 15", macOS 10.15

Posted on Mar 28, 2020 11:39 AM

Reply
8 replies

Mar 30, 2020 6:21 AM in response to el_andres

I understand but if you want to isolate the cause you have to start somewhere. I only mentioned Adobe due to its predilection for littering a Mac with all manner of processes, as well as the fact cinematic 01.zip happens to be the name of an Adobe Lightroom product. It's not an entirely unique name but it raises Adobe's profile as a potential culprit.


Restoring a Mac from a Local Snapshot is one of Time Machine's advantages. That means you can uninstall everything Adobe, observe the effect, and then restore the Local Snapshot. That entire process from start to finish will take about fifteen minutes including making a cup of coffee.


If you decide to take that approach make absolutely certain all Adobe processes are removed. Run EtreCheck again to confirm. Repeat for any other non-Apple products that could be contributing factors: Dropbox. Google. Microsoft. Etc. It's an iterative approach.


Come to think of it I suspect the problem isn't strictly being caused by Adobe. The mysterious downloads are more likely arising from one the "cloud" storage services you're using. Try turning them off, disabling them, uninstalling them, whatever it takes to eliminate them from the list of unknowns.

Mar 28, 2020 11:58 AM in response to el_andres

It seems that something is either regenerating them or causing them to be downloaded whenever you restart or log in to your Mac. You need to determine what that something is.


Simple remedial questions involve asking if you are using any Login Items. If the answer is no, the questions get more involved (which really just means more work for me). Often it's easiest to use EtreCheck, which may identify likely culprits. To learn how to use it and how to post its report in a reply to this Discussion, read Using EtreCheck - Apple Community.

Mar 28, 2020 1:16 PM in response to el_andres

I only have dropbox and spectacle in my login items


Try removing them from Login Items. That will have no effect other than to prevent them from launching when you log in. You can just as easily launch them yourself. However, like you, I doubt they're causing the problem. If those files reappear without launching those apps then they're not the cause, and you might as well add them to Login Items again.


Continued troubleshooting involves a process of elimination. I don't know what Adobe does but it's among the possible culprits. You would need to remove (uninstall) Adobe from your systems to isolate it as a potential cause. Obviously you will need to determine what it takes to reinstall them again. The easiest thing to do would be to restore a Time Machine backup, which takes about two minutes if you restore a Local Snapshot:


"If your backup disk isn't available, keep going: You might be able to restore from a local snapshot on your startup disk."

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Unknown zip and exec files keep re-appearing on downloads folder after restart

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.