Files getting deleted automatically on external drives

This particular issue has happened twice so far on separate external drives, which leads me to believe this may be malware or something malicious.


First time was my sd card that had my newborn's photos on them that were completely wiped clean.


Now recently my 5TB external hard drive with my backups were also wiped clean after being plugged into my computer for several hours.


I ran an EtreCheck scan and will post results below.





MacBook Pro 15″, macOS 10.15

Posted on Sep 20, 2024 8:42 AM

Reply
Question marked as Top-ranking reply

Posted on Sep 21, 2024 12:03 PM

You should clean up all these fragments of things that are damaged and unusable. the exact location are shown:


Clean up:

/Library/LaunchAgents/com.epson.pma.launcher.plist

/Applications/Epson Software/Epson Ink Replenishment Agent.app/Contents/MacOS/pma.app/Contents/MacOS/pma

Executable not found


/Library/LaunchAgents/com.epson.esua.launcher.plist

/Applications/Epson Software/EPSON Software Updater.app/Contents/EPSON Software Updater Agent.app/Contents/MacOS/EPSON Software Updater Agent

Executable not found


/Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist

/Applications/Epson Software/Epson Low Ink Reminder.app/Contents/EpsonLowInkReminderAgent.app/Contents/MacOS/EpsonLowInkReminderAgent

Executable not found


/Library/LaunchAgents/com.epson.eventmanager.agent.plist

/Applications/Epson Software/Event Manager.app/Contents/Resources/Assistants/Event Manager/EEventManager.app/Contents/MacOS/EEventManager

Executable not found

--------


You should remove all parts of NordVPN scare-ware and NEVER re-install it. VPN software you install yourself Promises great additional protection from Bad guys, and delivers: EXACTLY the opposite -- you data are concentrated on the VPN vendor's servers and sometimes harvested in bulk. no additional protections against ANYTHING is accomplished by any part of that. Your Mac already protects itself really well.


--------

Your external drive is not showing in the report.

Drives like the MyBook came with software, and the manufacturer suggested you install that software.


What that software does is to "spare you the annoyance of having to re-initialize the drive" from its factory set Windows New Technology File System (NTFS, the W is silent because there are no other Operating Systems) or similar unusual (on a Mac) format. Instead, the software they provided would simulate a MacOS drive inside an NTFS file for your Mac.


The downside of using the manufacturer's software is that if the manufacturer's software is not loaded, the Macintosh Volume may not be readable, or may not be writable. This means that in startup manager, Installer, and in Recovery such as after a data loss, the Macintosh Volume may not be visible.


The standard advice given here to all users, including novice users, is to discard the manufacturers software and NEVER use it. "Best Practice" is to erase the physical device when new, using only MacOS Disk Utility, and create the fundamental data structures needed for consistent, reliable use by MacOS.


Similar questions

13 replies
Question marked as Top-ranking reply

Sep 21, 2024 12:03 PM in response to Solebrotha

You should clean up all these fragments of things that are damaged and unusable. the exact location are shown:


Clean up:

/Library/LaunchAgents/com.epson.pma.launcher.plist

/Applications/Epson Software/Epson Ink Replenishment Agent.app/Contents/MacOS/pma.app/Contents/MacOS/pma

Executable not found


/Library/LaunchAgents/com.epson.esua.launcher.plist

/Applications/Epson Software/EPSON Software Updater.app/Contents/EPSON Software Updater Agent.app/Contents/MacOS/EPSON Software Updater Agent

Executable not found


/Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist

/Applications/Epson Software/Epson Low Ink Reminder.app/Contents/EpsonLowInkReminderAgent.app/Contents/MacOS/EpsonLowInkReminderAgent

Executable not found


/Library/LaunchAgents/com.epson.eventmanager.agent.plist

/Applications/Epson Software/Event Manager.app/Contents/Resources/Assistants/Event Manager/EEventManager.app/Contents/MacOS/EEventManager

Executable not found

--------


You should remove all parts of NordVPN scare-ware and NEVER re-install it. VPN software you install yourself Promises great additional protection from Bad guys, and delivers: EXACTLY the opposite -- you data are concentrated on the VPN vendor's servers and sometimes harvested in bulk. no additional protections against ANYTHING is accomplished by any part of that. Your Mac already protects itself really well.


--------

Your external drive is not showing in the report.

Drives like the MyBook came with software, and the manufacturer suggested you install that software.


What that software does is to "spare you the annoyance of having to re-initialize the drive" from its factory set Windows New Technology File System (NTFS, the W is silent because there are no other Operating Systems) or similar unusual (on a Mac) format. Instead, the software they provided would simulate a MacOS drive inside an NTFS file for your Mac.


The downside of using the manufacturer's software is that if the manufacturer's software is not loaded, the Macintosh Volume may not be readable, or may not be writable. This means that in startup manager, Installer, and in Recovery such as after a data loss, the Macintosh Volume may not be visible.


The standard advice given here to all users, including novice users, is to discard the manufacturers software and NEVER use it. "Best Practice" is to erase the physical device when new, using only MacOS Disk Utility, and create the fundamental data structures needed for consistent, reliable use by MacOS.


Sep 20, 2024 8:57 AM in response to Solebrotha

Hello! I can't see malware in EtreCheck scan.. could you try to check WD Discovery to see if there's some special setting in there? Also uninstall this app, I feel you don't need it.


SD card might be able to be recovered if you find someone that can do this. But it's mandatory to not use it after the incident.


Another question, are you using the same disk (5TB) for Time Machine?

Sep 21, 2024 1:32 PM in response to Solebrotha

Solebrotha, if you know how to use Terminal, I would say to use the commands below to clean up your mac. If not App Cleaner & Uninstaller from Nektony is the best choice!


After that we check the way external disks work.


But if you used the same disk for Time Machine and files for long time, you should see if it's full or not!


To start with I would say unload agents and then delete them from your system! If you are not feeling ok with Terminal use only AppCleaner to clean!


sudo launchctl unload /Library/LaunchDaemons/com.microsoft.EdgeUpdater.update.system.plist
sudo rm /Library/LaunchDaemons/com.microsoft.EdgeUpdater.update.system.plist

sudo launchctl unload /Library/LaunchAgents/com.epson.pma.launcher.plist
sudo rm /Library/LaunchAgents/com.epson.pma.launcher.plist

sudo launchctl unload /Library/LaunchAgents/com.epson.esua.launcher.plist
sudo rm /Library/LaunchAgents/com.epson.esua.launcher.plist

sudo launchctl unload /Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist
sudo rm /Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist

sudo launchctl unload /Library/LaunchAgents/com.epson.eventmanager.agent.plist
sudo rm /Library/LaunchAgents/com.epson.eventmanager.agent.plist

You can completely uninstall old apps using Nektony's App Cleaner. I can see many in your EtreCheck report.

Shuffit Expander, Backup and Sync (old Google Drive), Epson apps, WD Discovery or other apps from WD, WinZip etc etc.


-- To replace WinZip you can use: Keka, The Unarchiver


Also there are some paths you need to clean to completely remove something like a Microsoft app. For Edge those are the ones:


use sudo rm in front of each path, like so:


sudo rm "~/Library/Application Scripts/com.microsoft.edgemac.wdgExtension"


"~/Library/Application Scripts/com.microsoft.edgemac.wdgExtension"

"~/Library/Application Support/Microsoft Edge"

"~/Library/Application Support/Microsoft/EdgeUpdater"

"~/Library/Caches/com.microsoft.edgemac"

"~/Library/Caches/com.microsoft.EdgeUpdater"

"~/Library/Caches/Microsoft Edge"

"~/Library/Containers/com.microsoft.edgemac.wdgExtension"

"~/Library/HTTPStorages/com.microsoft.edgemac"

"~/Library/HTTPStorages/com.microsoft.edgemac.binarycookies"

"~/Library/HTTPStorages/com.microsoft.EdgeUpdater"

"~/Library/LaunchAgents/com.microsoft.EdgeUpdater.update.plist"

"~/Library/LaunchAgents/com.microsoft.EdgeUpdater.update-internal.*.plist"

"~/Library/LaunchAgents/com.microsoft.EdgeUpdater.wake.*.plist"

"~/Library/Microsoft/EdgeUpdater"

"~/Library/Preferences/com.microsoft.edgemac.plist"

"~/Library/Saved Application State/com.microsoft.edgemac.app.*.savedState/"

"~/Library/Saved Application State/com.microsoft.edgemac.savedState"

"~/Library/WebKit/com.microsoft.edgemac"


Hope those help and restart after cleanup.. and post a new EtreCheck :)

Sep 23, 2024 9:00 AM in response to Grant Bennet-Alder

Your external drive is not showing in the report.
Drives like the MyBook came with software, and the manufacturer suggested you install that software.

What that software does is to "spare you the annoyance of having to re-initialize the drive" from its factory set Windows New Technology File System (NTFS, the W is silent because there are no other Operating Systems) or similar unusual (on a Mac) format. Instead, the software they provided would simulate a MacOS drive inside an NTFS file for your Mac.

The downside of using the manufacturer's software is that if the manufacturer's software is not loaded, the Macintosh Volume may not be readable, or may not be writable. This means that in startup manager, Installer, and in Recovery such as after a data loss, the Macintosh Volume may not be visible.

The standard advice given here to all users, including novice users, is to discard the manufacturers software and NEVER use it. "Best Practice" is to erase the physical device when new, using only MacOS Disk Utility, and create the fundamental data structures needed for consistent, reliable use by MacOS.

Isn't this my external drive here in the report?


disk2 - WD My Passport 2627 5.00 TB
External USB Up to 480 Mb/s USB
disk2s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk2s2 - J*****************B (Journaled HFS+) 5.00 TB (2.79 TB used)



Sep 21, 2024 12:40 PM in response to piratx

system extensions:


NordVPN Threat Protection - version 1.0.54 (Nordvpn S.A. - 2023-06-05)

Application: /Applications/NordVPN.app - version 8.4.1 (Nordvpn S.A. - 2023-06-05)

Description: System extension is used to scan files downloaded from the internet for malware.


it is not content to just provide Virtual Private Network (VPN) service, it has to look at all your files as well.

Applications that do different than what they say are by definition, malware.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Files getting deleted automatically on external drives

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.