Level 1

19 points

Documents Folder Suddenly EMPTY!

What would cause the contents of my "documents" folder to suddenly disappear?

I had about twenty large folders in there, and the odds of accidentally highlighting them all and sending them to the trash is unlikely. Of course, anything is possible.

I seriously doubt that I did that ... but I can't imagine how else everything in my documents folder would suddenly disappear. Can anyone suggest?

-John

ps. I did have everything backed up, but I still want to know why it disappeared in the first place.

Posted on Feb 12, 2012 5:31 PM

22 replies

Plenty7 Author

Level 1

19 points

Feb 15, 2012 12:36 PM in response to fane_j

Hi fane_j,

Okay, here are the latest resuts. I hope this stuff means something you.

Last login: Wed Feb 15 12:30:44 on ttys000

John-Neumanns-MacBook-Pro:~ John$ ls -ael ~/Documents

total 16

drwx------+ 5 John staff 170 Feb 15 08:33 .

0: group:everyone deny delete

drwxr-xr-x+ 28 John staff 952 Feb 14 17:49 ..

0: group:everyone deny delete

-rw-------@ 1 John staff 6148 Feb 15 12:32 .DS_Store

drwxr-xr-x 3 John staff 102 Feb 15 12:32 Azureus Downloads

drwxr-xr-x 2 John staff 68 Feb 13 12:28 Roxio Converted Items

John-Neumanns-MacBook-Pro:~ John$

As to your questions ... no sync'ing, no iPhone, no other Mac, no cloud. No one else has access. No network. Nothing shared on a network. Only externals are a hard drive for docs and Time Machine and a DVD burner.

Sure hope you can help.

-JOHN

fane_j

Level 4

3,704 points

Feb 15, 2012 2:34 PM in response to Plenty7

John_Neumann wrote:

I hope this stuff means something you.

It only means there's nothing unusual or unexpected -- unfortunately.

No one else has access. No network. Nothing shared on a network.

Not so fast. Are you saying your Mac is not connected to the Internet? You're posting this from another computer? A common setup is Mac → router+isp interface → Internet. If the router is wireless and not secured with WPA2 encryption, your neighbourhood script kiddie might be in the room with you…

So far, I have no clue what's going on. However, there is one item which stands out. You're using Azureus (now Vuze), a BitTorrent client. Normally, malware is just about the last thing I suspect, especially on a Mac, but, if you're using P2P and you're not too computer-savvy, all bets are off. I don't know of any Mac malware that behaves like this (periodically erase contents of Documents folder), but I don't know much about Mac malware. Have you run any installers or app downloaded with Azureus?

Two more points. First, run in Terminal and post the result of

ps -cx

(this will give a list of current running processes; let's see if anything unusual crops up).

Second, have you restarted at least once between the first time it happened and the second time?

Plenty7 Author

Level 1

19 points

Feb 15, 2012 4:09 PM in response to fane_j

Okay, first those Terminal results you were asking for...

Last login: Wed Feb 15 14:49:23 on console

John-Neumanns-MacBook-Pro:~ John$ ps -cx

PID TTY TIME CMD

102 ?? 0:00.12 launchd

106 ?? 0:01.25 Dock

107 ?? 0:05.56 SystemUIServer

108 ?? 0:06.63 Finder

111 ?? 0:00.00 pboard

112 ?? 0:01.37 fontd

121 ?? 0:00.44 UserEventAgent

128 ?? 0:00.23 AirPort Base Station Agent

129 ?? 0:09.45 VBX6StatusItem

131 ?? 0:00.19 NetUpdateAgent

132 ?? 0:00.11 IntegoStatusItemHelper

135 ?? 0:02.29 CNQL3202_ButtonManager

138 ?? 0:00.05 iTunesHelper

139 ?? 0:00.18 Image Capture Extension

140 ?? 11:55.56 firefox-bin

151 ?? 0:01.54 mdworker

176 ?? 0:05.45 Preview

245 ?? 0:00.10 quicklookd

249 ?? 0:00.19 Terminal

251 ttys000 0:00.03 login

252 ttys000 0:00.01 -bash

255 ttys000 0:00.00 ps

John-Neumanns-MacBook-Pro:~ John$

Re internet ... yes, I overlooked the obvious. I have wireless in the house with a password ... don't know anything about encryption. Re Azureus - yep, I downloaded some items. I suspected that at first when the folder emptied (although I've never heard of malware that repeatedly erases a folder either) so I downloaded and ran VirusBarrier X6. It gave me a clean bill of health after scanning my entire hard drive, ie found nothing.

Re restarting. I can't recall if I restarted between the first and second disappearance. I do fully shut down every few days, but I can't recall if I did it exactly then.

fane_j

Level 4

3,704 points

Feb 15, 2012 5:27 PM in response to Plenty7

John_Neumann wrote:

first those Terminal results

Again, unfortunately I don't see anything unusual. The only things not Apple are Firefox, CNQL… (I assume you are using a Canon scanner), and the Intego items (are you using NetBarrier as well as VirusBarrier?).

I have wireless in the house with a password ... don't know anything about encryption.

You need to check. If it's WPA2, you're fine. If it's WEP, it's bad. Also, you may be using a password to connect to your ISP. Don't confuse that with the passphrase required to connect wirelessly to your router.

I downloaded and ran VirusBarrier X6. It gave me a clean bill of health after scanning my entire hard drive, ie found nothing.

Did you download and install Intego product(s) before or after the deletion?

As to malware, a single app may not catch all.

I can't recall if I restarted between the first and second disappearance.

Restarting would be useful; we have to look in different places if the problem happens on a regular basis.

I've never heard of malware that repeatedly erases a folder either

There was a malicious AppleScript which posed as a Word 2004 installer and deleted the Home folder, or some of its contents, but that's really old.

But, just to eliminate the malware issue, download and run ClamXav

<http://www.clamxav.com/>

Don't install ClamXav Sentry, just ClamXav

<http://www.clamxav.com/documentation.php>

Oct 7, 2012 12:10 AM in response to Plenty7

I have a similar problem. Please help.

<https://discussions.apple.com/thread/4404594>

-Bananana

Plenty7 Author

Level 1

19 points

Oct 30, 2012 3:34 PM in response to Plenty7

I did a bunch of googling about it and found a few posts somewhere about people having this problem when they used Vuze (formerly Azureus). This is a file sharing program.

I deleted Vuze from my Mac and have never had the problem since. (Actually, one time I got bold and installed Vuze again and within a couple days my documents folder was empty again with all the contents lost, so I personally have a high degree of belief that Vuze is the culprit.)

I properly deleted Vuze the second time (this was now months ago) and I've never had a problem with the documents folder since.

Note: The problem was not with any files I downloaded through Vuze. My problem seems to have been with Vuze, the downloading software itself. Once Vuze was off the drive, my problems stopped.

Oct 30, 2012 4:17 PM in response to Plenty7

Thanks for the update, John.

I'm sure that will be very useful for others.

😎

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Documents Folder Suddenly EMPTY!