Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am saving some files because I need to reinstall OS X, and noticed oddly high numbers of files in some folders. Is it possible for malware to hide files from ls?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Hidden files are hidden from ls unless you use the -a or -A flag:

-A   List all entries except for . and ...  Always set for the super-user.
-a   Include directory entries whose names begin with a dot (.).

Source: ls man page

Therefore, files can be hidden by starting the filename with a . but ls will still show the file if it is run with -a or -A.

Note that not all files that are hidden with a . are malware-related. The system creates many files like this for a variety of reasons in various places on the disk that can cause problems if removed or modified.

share|improve this answer
6  
one additional note: there are many legitimate files the OS hides in this manner. Finding files using ls -a does not indicate the presence of malware. –  dwightk Apr 10 at 12:56
    
@dwightk I know, but maybe other people reading this don't. (grgarside: maybe include it in the answer, as some people - including me - do not always read all the comments.) –  11684 Apr 10 at 14:29

ls is not a command that opens the directory file itself and show it's contents. It uses dirent (Directory Entries) from the C library which is used by a lot of software like stat but also bash's parameter expansion.

So the real question is then: Is it possible for malware to hide files from BSD/Darwin? No, you can't hide files from it's own system because it will turn into waste (read:free to overwrite) very soon.

share|improve this answer
    
Thank you, this was very helpful as well. (Hence +1.) –  11684 Apr 10 at 14:30
    
What is this command "Ls"? :) –  Almo Apr 10 at 14:45
    
It list all the directories and files in the current directory. (Including hidden files if you add the -a flag.) For more information, click on the man page link in grgarside's answer. –  11684 Apr 10 at 17:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.