Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Malware found in .MobileBackups/ folder on MacBook Pro

Hi, I ran a virus scan and Malware found in .MobileBackups/ folder as well as Time Machine Backups. I partitioned the backup drive and deleted all the previous backups, then re-ran the scan. Now the same virus (Trojan.Script.171700) is showing in the Mobile Backups folder.


I was able to reveal the hidden files through a script change in terminal. But after I tried to open the hidden MobileBackups folder, got an error saying I did not have permission to open.


So how do I delete these infected files?

MacBook Pro, 10.9.1

Posted on Jan 5, 2015 9:34 PM

Reply
6 replies

Jan 6, 2015 4:09 AM in response to mac-newbie

mac-newbie wrote:


So how do I delete these infected files?


You don't. That's not Mac malware, and it's not affecting your Mac in any way. If you dig around in the .MobileBackups folder and start deleting stuff, you'll corrupt those backups. On the other hand, everything in there will be cleared out automatically and replaced with newer backups within 7 days. Just ignore it and it'll go away on its own. Deleting all of your Time Machine backups was also serious overkill, and could have caused you serious problems if your drive had chosen that moment to die.


What anti-virus software are you using? Many Mac anti-virus programs are not much good, and should not be used. See my Mac Malware Guide for more information on protecting yourself from malware the right way.


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Jan 6, 2015 2:48 PM in response to thomas_r.

Hi, I use Bitdefender for Mac. I get spams that go in my spam box, but apparently have malware attached. Then it gets backed on my hard drive, then on my external drive.


Do you know what the path is to these mobilbackups so that I can avoid backing them up and having the malware spread to my external drive and my online backup?


Thanks.

Patrice

Jan 7, 2015 3:46 AM in response to mac-newbie

mac-newbie wrote:


Do you know what the path is to these mobilbackups so that I can avoid backing them up and having the malware spread to my external drive and my online backup?


Time Machine doesn't back up the .MobileBackups folder. That is simply another set of backups maintained by Time Machine. See:


What are Local Snapshots?


Further, you are still worrying about these things too much. These are Windows malware, not Mac malware, and even if they were Mac malware, they couldn't affect your Mac unless you opened them. If you insist on removing every piece of malware attached to every spam e-mail from your backups, that will become a tedious daily task that cannot be automated by anti-virus software without corrupting your mailboxes and your backups.


Ignore them. They are not a threat. Even if you have to restore your system from backups, are you then going to go into your restored junk mail folder and start opening things? No.


As to BitDefender, that's not much good on the Mac. When I tested it last year against over 180 malware samples, it only caught about 76% of them. That's a pretty poor detection rate when there really hasn't ever been very much Mac malware.

Jan 7, 2015 12:15 PM in response to thomas_r.

I do have to worry as I have had strange things happening on my Mac such as a window opening, asking me to allow someone to log on. Of course I said no, then adjusted the share computer/files settings.


Had issues with emails as well. That is why I have decided to do something more about it. Bitdefender not only found the files in the mobilebackups folder, but so many places that I decided to wipe my backups and start fresh. That was easier than trying to figure out how to delete the over 50 files.

Jan 7, 2015 2:47 PM in response to mac-newbie

mac-newbie wrote:


I do have to worry as I have had strange things happening on my Mac such as a window opening, asking me to allow someone to log on. Of course I said no, then adjusted the share computer/files settings.


That is not related to the files BitDefender is finding. Those are not affecting your Mac in any way (other than taking up a little disk space).


Without a clearer description of what was going on, I'd guess that someone on the same network as you tried to send you something via AirDrop or tried to connect somehow through a service that was open in System Preferences -> Sharing. This is not the work of malware. If someone had somehow gotten malware onto your system, you would never see any kind of prompt... they would simply have access and you'd never know.

Malware found in .MobileBackups/ folder on MacBook Pro

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.