I am afraid data is being exfiltrated from my computer. I noticed literally hundreds of emix files, many with attachments, that contain virtually the entire contents of my Documents folder and my Photo Library. The files were all created within minutes of each other on two different days, and are only noticeable when using the Attachments feature of Mail. Any guidance?
MacBook, Mac OS X (10.5.8), Mail v3.6
Hi,
ClamXAV, free Virus scanner...
Free Sophos...
http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-ed ition/features.aspx
http://www.sophos.com/products/enterprise/endpoint/security-and-control/mac/
Little Snitch, stops/alerts outgoing stuff...
http://www.obdev.at/products/littlesnitch/index.html
Did you install anything lately? Maybr MaKeeeer?
Hi,
ClamXAV, free Virus scanner...
Free Sophos...
http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-ed ition/features.aspx
http://www.sophos.com/products/enterprise/endpoint/security-and-control/mac/
Little Snitch, stops/alerts outgoing stuff...
http://www.obdev.at/products/littlesnitch/index.html
Did you install anything lately? Maybr MaKeeeer?
There's no Mac malware known to behave this way. Of course, I can't rule out that a back door installed by some piece of known malware isn't being used to do this. However, in my experience, things like this often have a more mundane cause.
First, what exactly are you seeing? I'm unclear on what you mean when you say that this is "only noticeable when using the Attachments feature of Mail." Can you clarify that?
It's important to understand that very few e-mail systems would be able or willing to transmit something the size of an iPhoto Library or Documents folder. Or are you saying that all the items contained have been attached to separate e-mail messages?
Thomas, thanks for the quick response.
Your point on email service and amount of data is well-taken -- it would be virtually unthinkable that files totaling the quantity and size of these .emlx files (and I apologize for their misrepresentation as ".emic" files in my original post) and their attachments would be able to be transmitted, especially in the several minutes on each of the three days they were created, March 7, 8, and 14.
What I'm seeing are hundreds, perhaps thousands (there are over one hundred screens of dialog window to scroll through) of .emlx files in two folders titled Messages and Attachments that are viewable by me when I select the Attachment button in my Mail application. I don't know the path to these two folders, or why the system made them available to me -- normally I attach files from my Documents folder.
Upon looking at representative files, I saw the several that are my sent messages for that particular day, then there are hundreds of additional files containing attachments that are all the files from my Documents folder and my iPhoto Library. The hundreds were created over several minutes each of the days in question, at different times.
I agree that there is likely a more mundane explanation. I did not install any new software, Apple or otherwise but I did reset my Mail password recently -- I can't say if it was exactly March 7 or 8 but it was close -- in order to overcome a sending connectivity issue I had been experiencing.
I appreciate your insight and any additional thoughts you might have. Many thanks.
David
BD, thanks for the quick response, I'll look into these.
I haven't installed any software recently, but did reset my Mail password -- maybe that caused the erratic mail behavior?
By the way, my mistake on the initial post -- the files are ".emlx" not ".emic."
Take care.
David
I think that you are misunderstanding something very significant. I assume that the Attachment button you are referring to is the paper clip icon button in a new message that allows you to select files to attach to that message. If that is correct, the window that opens gives you a way to browse the entire contents of your hard drive, so that you can choose a file to attach. The fact that you see your Documents folder in this file selection window, for example, does not mean that your Documents folder has been attached to a message. It simply means that you can go into your Documents folder and select a file (or multiple files) to be attached to the message.
Regarding the Messages and Attachments folders, those are simply places that Mail stores things, and the files ending in .emlx are e-mail messages.
Thomas, thanks again. You're right, I'm referring to the paper clip button that permits one to attach files to a new message in Mail.
I understand the distinction between the Documents folder and the many other folders available to me on my computer; what's interesting about this time is that these other folders have never, that I can recall, popped-up initially when I selected this option, as I have almost always done. Further, the fact that these many files exist at all as .emlx files, or partial emlx files, and show a "Date Modified" of the days and times in questions, is alarming.
Why would the Mail, or any other application, have created these files? If so, are they hogging disk space that I need to clean-up?
David
Those files are all normal files, and if you were to delete them, you would be destroying your e-mail messages and corrupt your mailbox indices. Don't poke around in there. If you want to delete e-mail messages, do so from within Mail.
As to why they showed up as the default when you tried to attach something, I don't know. Perhaps the settings file that keeps track of that is messed up. Simply navigate out of those folders and select something in another folder when you want to attach something. That choice should be remembered next time, but perhaps won't be if something has gotten corrupt.
Thomas, again, thanks.
I appreciate that there's much to lose if I try to delete these files and will continue to try to figure out why they got created.
I have to say that I'm keeping my eye on these particular folder and subfolders because I want to monitor their behavior. The Documents folder is gratefully always available to me through the navigation pane on the left side of the attachments dialog window that opens when I select the attachments button.
Thanks again.
David
Data Exfiltration?
