Files on my desktop are hidden automatically. What can i do?

Dummy folder is newly created and I moved the file Query1.map.png from one the hidden folders into the new folder. The file still remains hidden

The 2nd screenshots shows the actual desktop with created dummy folder and the terminal with the actual and hidden contents of the desktop

Hello Luis Sequeira1,

Also thank you for your time! I checked the extended attributes and but I couldn't find anything suspicious here's an example

All desktop file seem to have the hidden flag, so I removed the hidden flag with your command, but I am very sure it will be hidden after a reboot.

I created a new file and booted up in safe mode. And it was like you said, the file wasn't hidden, but after I booted it without safe mode it hid again. But thanks to you and ChrispyT I am understanding the problem more and more.

Here is the Etrecheck output, but I couldn't find anything suspicious again.

EtreCheck version: 3.4 (420)

Report generated 2017-06-10 23:48:15

Download EtreCheck from https://etrecheck.com

Runtime: 2:17

Performance: Excellent

Click the [Lookup] links for more information from Apple Support Communities.

Click the [Details] links for more information about that line.

Click the [Clean up] link to delete unused files.

Problem: Other problem

Hardware Information: ⓘ

MacBook Pro (15-inch, 2016)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro13,3

1 2,6 GHz Intel Core i7 (i7-6700HQ) CPU: 4-core

16 GB RAM Not upgradeable

BANK 0/DIMM0

8 GB LPDDR3 2133 MHz ok

BANK 1/DIMM0

8 GB LPDDR3 2133 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 182

iCloud Quota: 4.74 GB available

Video Information: ⓘ

Intel HD Graphics 530 - VRAM: 1536 MB

Color LCD 3360 x 2100

AMD Radeon Pro 450 - VRAM: 2048 MB

Disk Information: ⓘ

Disk Information: ⓘ

APPLE SSD SM0256L disk0: (251 GB) (Solid State - TRIM: Yes)

(disk0s1) <not mounted> [EFI]: 315 MB

(disk0s2) <not mounted> [CoreStorage Container]: 161.36 GB

Recovery HD (disk0s3 - Journaled HFS+) <not mounted> [Recovery]: 650 MB

BOOTCAMP (disk0s4 - NTFS) /Volumes/BOOTCAMP : 80.68 GB (17.28 GB free)

USB Information: ⓘ

USB30Bus

Apple Inc. iBridge

USB31Bus

USB31Bus

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus_1

Apple Inc. thunderbolt_bus_0

Virtual disks: ⓘ

Macintosh HD (disk1 - Journaled HFS+) / [Startup]: 161.00 GB (23.33 GB free)

Physical disk: disk0s2 161.36 GB Online

System Software: ⓘ

macOS Sierra 10.12.5 (16F73) - Time since boot: less than an hour

Configuration files: ⓘ

/etc/hosts - Count: 2

Gatekeeper: ⓘ

Mac App Store and identified developers

Clean up: ⓘ

/Library/LaunchAgents/com.cisco.anyconnect.gui.plist

open --wait-apps /Applications/Cisco/Cisco AnyConnect Secure Mobility Client.app

Executable not found!

One orphan file found. [Clean up]

Kernel Extensions: ⓘ

/Applications/MATLAB_R2016b.app

[not loaded] com.mathworks.sldrtkrn (5.3.0 - OS X 10.8) [Lookup]

/Applications/Parallels Access.app

[loaded] com.parallels.virtualhid (1.0.3 - SDK 10.9) [Lookup]

[loaded] com.parallels.virtualsound (1.0.36 - SDK 10.6) [Lookup]

/Applications/Parallels Desktop.app

[not loaded] com.parallels.kext.hypervisor (12.2.0 415** - SDK 10.9) [Lookup]

[not loaded] com.parallels.kext.netbridge (12.2.0 415** - SDK 10.9) [Lookup]

[not loaded] com.parallels.kext.usbconnect (12.2.0 415** - SDK 10.9) [Lookup]

[not loaded] com.parallels.kext.vnic (12.2.0 415** - SDK 10.9) [Lookup]

/Library/Application Support/VirtualBox

[loaded] org.virtualbox.kext.VBoxDrv (5.1.14) [Lookup]

[loaded] org.virtualbox.kext.VBoxNetAdp (5.1.14) [Lookup]

[loaded] org.virtualbox.kext.VBoxNetFlt (5.1.14) [Lookup]

[loaded] org.virtualbox.kext.VBoxUSB (5.1.14) [Lookup]

System Launch Agents: ⓘ

[not loaded] 6 Apple tasks

[loaded] 178 Apple tasks

[running] 98 Apple tasks

System Launch Daemons: ⓘ

[not loaded] 43 Apple tasks

[loaded] 167 Apple tasks

[running] 107 Apple tasks

Launch Agents: ⓘ

[loaded] com.cisco.anyconnect.gui.plist (? 40bd3462 0 - installed 2015-10-23) [Lookup] - --wait-apps: Executable not found!

[loaded] com.oracle.java.Java-Updater.plist (? db056c14 be93c7fb - installed 2017-01-21) [Lookup]

[loaded] com.parallels.mobile.prl_deskctl_agent.launchagent.plist (Parallels, Inc. - installed 2017-01-21) [Lookup]

Launch Daemons: ⓘ

[running] com.cisco.anyconnect.vpnagentd.plist (? a7cbca7 3c67d750 - installed 2015-10-23) [Lookup]

[running] com.docker.vmnetd.plist (Docker Inc - installed 2017-04-09) [Lookup]

[loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2017-04-13) [Lookup]

[loaded] com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2016-04-11) [Lookup]

[loaded] com.oracle.java.Helper-Tool.plist (Shell Script e3fefdd2 - installed 2017-01-11) [Lookup]

[running] com.parallels.mobile.dispatcher.launchdaemon.plist (Parallels, Inc. - installed 2017-01-21) [Lookup]

[loaded] com.parallels.mobile.kextloader.launchdaemon.plist (Apple, Inc. - installed 2017-04-29)

[not loaded] org.eyebeam.SelfControl.plist (Charlie Stigler - installed 2017-01-17) [Lookup]

[not loaded] org.virtualbox.startup.plist (Shell Script 700b9385 - installed 2017-03-02) [Lookup]

User Launch Agents: ⓘ

[loaded] com.dropbox.DropboxMacUpdate.agent.plist (Dropbox, Inc. - installed 2017-05-31) [Lookup]

[loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2017-03-29) [Lookup]

[loaded] com.parallels.mobile.startgui.launchagent.plist (Parallels, Inc. - installed 2017-03-02) [Lookup]

[loaded] com.skype.skype.shareagent.plist (Skype Communications S.a.r.l - installed 2017-06-10) [Lookup]

[running] com.spotify.webhelper.plist (Spotify - installed 2017-06-10) [Lookup]

[not loaded] org.virtualbox.vboxwebsrv.plist (Oracle America, Inc. - installed 2017-03-02) [Lookup]

User Login Items: ⓘ

Parallels Toolbox Application

(/Applications/Parallels Toolbox.app)

Spotify Application - Hidden

(/Applications/Spotify.app)

Dropbox Application

(/Applications/Dropbox.app)

Cisco AnyConnect Secure Mobility Client Application - Hidden

(/Applications/Cisco/Cisco AnyConnect Secure Mobility Client.app)

Internet Plug-ins: ⓘ

QuickTime Plugin: 7.7.3 (installed 2017-05-24)

JavaAppletPlugin: Java 8 Update 121 build 13 (installed 2017-01-21) Check version

Safari Extensions: ⓘ

[enabled] Open in Internet Explorer - Parallels - http://www.parallels.com (installed 2017-04-05)

3rd Party Preference Panes: ⓘ

Java (installed 2017-01-21) [Lookup]

Time Machine: ⓘ

Time Machine not configured!

Top Processes by CPU: ⓘ

16% Mail

9% WindowServer

9% com.apple.WebKit.WebContent

6% kernel_task

5% Safari

Top Processes by Memory: ⓘ

1015 MB kernel_task

564 MB com.apple.WebKit.WebContent

219 MB Spotify Helper

181 MB Dropbox

177 MB WindowServer

Top Processes by Network Use: ⓘ

Input Output Process name

8 MB 1 MB com.apple.WebKit.Networking

120 KB 60 KB Spotify

68 KB 107 KB Dropbox

104 KB 38 KB Mail

17 KB 118 KB biometrickitd

Top Processes by Energy Use: ⓘ

3.50 WindowServer

2.94 iTerm2

2.68 com.apple.WebKit.WebContent

2.02 com.docker.hyperkit

Virtual Memory Information: ⓘ

10.20 GB Available RAM

6.77 GB Free RAM

5.80 GB Used RAM

3.44 GB Cached files

0 B Swap Used

Software installs: ⓘ

Microsoft Office 2016 for Mac: (installed 2017-05-19)

Knuddels: (installed 2017-06-02)

Install information may not be complete.

Diagnostics Information: ⓘ

2017-06-09 20:11:57 storedownloadd High CPU use [Open] [Details]

2017-06-09 09:04:53 Microsoft Word.app High CPU use [Open] [Details]

But now I am going to rest and continue tomorrow, it's very late here in Germany. Have a nice day

Thank you for the time & help!

Hi Eric Root,

Thanks for your help!

I re-installed the macOS Sierra 10.12.5 Combo update, but the files are still hidden. Unhiding the files with chflags -R nohidden ~/Desktop/ works until I restart or login again.

On my desktop I have an shared folder to an Virtual Box VM and a link to a folder, but I don't think this is causing the behavior.

Since the problem seems to be user-based I checked the applications launched by launchd, if there would be something suspicious which is causing the behavior, but the processes launched by systemd for the user seem to be ok

Maybe I can check the file access of process with lsof from a dummy file to gain more information. Let's see...

When I create a new folder it will be visible until I restart my macOS. The created folder will be hidden after a reboot, too.

When I move a file from one of the hidden folders into the newly created visible folder. The file will still remain hidden.

I am going to upload two screenshots of my desktop and the contents listed in the terminal.

Thank you so much for your time ChrispyT !

Yes, I deleted com.apple.finder.plist file the other one didn't exist.

So i ran the Disk Util to run an first aid on my drive. Here is everything fine (phew!).

About the permissions, I have two users,

rbi with Read & Write permissions, thats the on I am logging in with

and everyone with No Access, which I think is okay

Afterwards I created a dummy account, to see if this one will behave the same way and it didn't. Created files or folders on the desktop weren't hidden after a log out or reboot. I think it's maybe like Luis Sequeira1 wrote, that maybe something is running in the beginning of the user session. In Germany it's very late, I am going to rest a bit and continue tomorrow.

Thank you for your help & time!

Hello!

First of all, thank you for your efforts especially ChrispyT, Eric Root, Luis Sequeira1 and CT.

So I deleted Docker, VirtualBox and turned off Dropbox the files were still hidden again. Afterwards I was a little bit lost and deleted the Preferences Folder after backing it up and creating a dummy admin user, if a re-login will fail. It seems that Mac OS want to configure your account when it can't find the Preferences folder. I think it has overwritten a file which was modified by something and executed during the startup.

As a result, after unhiding the desktop objects with the command from Luis Sequeira1, they don't hide again after a reboot, but sadly (now) it's not possible recreate this scenario for me. Even when I backup my old preferences, the files will show up again (which is good 🙂). Like some of you said before, it must be some kind of script or anything, which is not directly added in the auto start, but must be called from somewhere else.

I think it wasn't good to delete the Preferences Folder (even when I backed it up). Maybe it will have some drawback in the future. Even after copying my old one back, it doesn't recognise my old desktop settings, dockbar options, etc.. But at least I can see the files on my desktop again!

Thank you guys for your time!

Hi ChrispyT,

Thank you for thehelp! I entered the command into the terminal, but the files on the desktop didn't appear 😟