Apple Event: May 7th at 7 am PT
when i plug a hard external to my mac some kind of virus turns all files on the hard to another program(exec) that doesn't work on macs. How do i remove this virus and turn back files on hard?
MacBook Pro, OS X Yosemite (10.10.3)
Your Mac does not have a virus.
I'm unclear on exactly what's going on from your description of the problem. You may have connected that hard drive to a Windows machine infected with ransomware, which has encrypted or hidden those files and replaced them with .exe files. Do you have backups of the data on that drive?
I think these are simply Windows generated links (it's got nothing to do with malware). The Unix that powers the Mac also uses links but their format is entirely different. Furthermore, the targets that the links point to somewhere deep down into the filesystem of the foreign machine is very likely not accessible by the Mac the external drive has been attached to. According to the screenshot all *.lnk objects are symbolic links to folders containing the actual data/media files. On a Windows machine that knows how to deal with the links, double clicking these objects would simply open the associated folders - pretty much as one would expect. Since the Mac doesn't know what it's looking at it assumes a general (executable/binary/whatever...) content (which is bogus in this case, of course) and just marks them 'exec'.
Thanks,
M.
Mickey S. wrote:
I think these are simply Windows generated links (it's got nothing to do with malware).
On the contrary, there is known Windows malware that replaces all files on external drives with .lnk files. The symptoms being described here are the exact symptoms of that malware.
Well, okay. In this case hopefully he's got a backup.
Thanks,
M.
Mickey S. wrote:
On a Windows machine that knows how to deal with the links, double clicking these objects would simply open the associated folders - pretty much as one would expect.
they do open normally on a Windows machine. If i copy all files on my hard drive into a windows machine then recopy them into my hard drive, would they open normally on my mac?
akitii wrote:
they do open normally on a Windows machine.
When you open those .lnk files on a Windows machine, you're infecting that Windows machine with the malware payload hidden on the drive. Then the malware opens the file you wanted so you don't catch on. Don't do that anymore!
If i copy all files on my hard drive into a windows machine then recopy them into my hard drive, would they open normally on my mac?
No. As mentioned, you need to find the original files.
virus on mac changes program of files on external device
