How do I delete these files and are they hazardous?

Question

Level 1

8 points

How do I delete these files and are they hazardous?

So last fall my programmer cousin had physical access to my cpu and installed some bad stuff, one of which was a program that automatically sent a backup of my entire laptop to his Dropbox account every time I logged in. I’ve been hounding through my files for a while and while I think I’ve removed everything, I’m no IT pro and I only did the best I could with the help of YouTube and the internet.

Recently I’ve been trying to clean up a bit more on my MacBook, and when I went to erase some files I wasn’t allowed to erase any of these. So my question to you, is this “datadetectors” file a problem? It says I “do not have permission to access or view its contents” and therefore I cannot delete it. Is there any other way to get rid of this, and are any of the other files in the photo a risk to my laptop or online safety? What is the best way for me to go through my Mac and clean this junk out?

TIA

MacBook Pro 13", macOS 10.15

Posted on May 13, 2020 1:13 PM

Reply

Answer 1

Kappy

Level 10

361,995 points

May 13, 2020 1:23 PM in response to Snory13

Those are all system files in system folders. DO NOT rename, move, or delete.

How to Free Up Space on The Hard Drive

You can remove data from your Home folder except for the /Home/Library/ folder.
Visit The XLab FAQs and read the FAQ on freeing up space on your hard drive.
Also, see Freeing space on your Mac OS X startup disk.
What is 'Other' and 'Purgeable' in About This Mac?
Files That Make Up the 'Other' Storage Category, and How to Remove Them
Free up storage space on your Mac.
See Where did my Disk Space go?.
Be sure to Empty the Trash to recover the space.
Replace the drive with a larger one. Check out OWC for drives, tutorials, and toolkits.
Use OmniDiskSweeper or GrandPerspective to search your drive for large files and where they are located.

Reply

Answer 2

Snory13 Author

Level 1

8 points

May 13, 2020 1:26 PM in response to Kappy

Ok thanks Kappy. I was thinking that may be, but with the amount of other crap my cousin put on my cpu when I stepped out of the house I couldn’t be sure. How should I go about putting these files back in this case? Thanks for your reply as well

Reply

Answer 3

KiltedTim

Level 10

223,638 points

May 13, 2020 1:28 PM in response to Snory13

If you really think your machine was compromised, you need to back up your data files, and completely wipe and re-install macOS from recovery mode.

You may want to hold off doing so, however as that will eliminate evidence that can be used in a criminal prosecution.

If what you believe happened, did indeed happen, it's a crime.

Reply

Answer 4

Snory13 Author

Level 1

8 points

May 13, 2020 1:33 PM in response to KiltedTim

It definitely happened and I’ve already consulted with an IT security professional a few months ago who guided me through a lot of the removal for free. He also told me that with privacy laws in Canada I’d spend more than it’s worth to have a charge filed and the evidence logged, as it’s a never ending path to trace it back to him and he’s likely doing everything he can to avoid that happening in the first place. I did a full restore after speaking with him but I’m concerned that he may have installed some root programs that cannot be wiped without manually finding them and eliminating them. Maybe I’m just being overly paranoid, but he is the kind of person who would do something like that unfortunately.

Reply

Answer 5

BDAqua

Level 10

250,247 points

May 13, 2020 1:40 PM in response to Snory13

Free Malwarebytes which may take care of it...

https://www.malwarebytes.com/mac/

Or Mojave Cache Cleaner, which runs on more than just Mojave & can test for Key Loggers also...

https://www.northernsoftworks.com/mojavecachecleaner.html

Reply

Answer 6

Kurt Lang

Level 9

68,208 points

May 13, 2020 1:58 PM in response to Snory13

he may have installed some root programs that cannot be wiped

There are no apps or files that can survive if you fully erase the drive in Disk Utility.

If that's what you did before restoring a backup that was made before this person had access to your Mac, then anything he installed, hidden or not, is gone.

Reply