11

When I cd ~/.Trash in the terminal, it shows that there is a folder Downloads, and inside the Downloads folder, another folder Reactions, and inside Reactions, there is a file called

virus

Shutting down or restarting the computer does not work to empty the trash. Also, I should say that the file is hidden and is not showing when I open the Trash folder. Is it a virus? If yes, how do I get rid of it?

virus 2


In terminal, using: cd ~/.Trash/Downloads/Reactions and then ls -al, shows the jpg file.

(shown in the screenshot of the file because I could not copy and paste the text here in this question)

virus 3

drwxrwxrwx 3 username staff 102 Jan 19 14:36 .

drwxr-xr-x 3 username staff 102 Jan 19 16:09 ..

Update 1

I moved the Reactions out of the Downloads and emptied the trash. Now there is only Reactions left with the .jpg inside.

virus 4

By running ls -aBeil ~/.Trash/Reactions in terminal, following is the result:

virus 5

36328284 drwxrwxrwx 3 username staff 102 Jan 19 14:36 .

68013143 drwx------ 3 username staff 102 Jan 20 14:55 ..

Update 2

From cd ~/.Trash/Reactions > rm 'P > enter spacetab'return

Result is as follows:

virus 6

Update 3

Below is the result from unset LANG ; ls -aBeil ~/.Trash/Reactions:

virus 7

Update 4

Below is the result from utility disk verification:

virus 8

virus 9

Update 5

I just repaired the disk through Disk Utility using command + R access after system restart. Then, .jpg file is not hidden anymore and can be emptied on trash. Below you can see the screenshots.

virus 10

virus 11

Thank you all for your comments and answers. Special thanks to daniel Azuelos, patrix and klanomath.

4
  • Open Disk Utility and run "Check volume" on your main drive. It you get errors requiring a repair, boot into Recovery Mode, run Disk Util from there and use "Repair volume" – nohillside Jan 21 '15 at 20:28
  • 1
    @patrix, pls take a look at update 4 – Sami Jan 21 '15 at 21:11
  • 2
    "Illegal name", I actually like that. Please proceed as explained in the dialog box in the lower window, and then (once you have Disk Utility running in Recovery Mode) select "Repair Disk" (instead of verify). Afterwards reboot as usual and try emptying the trash again. – nohillside Jan 21 '15 at 21:37
  • 1
    @patrix, thank you patrix, it worked. pls take a look at update 5. – Sami Jan 22 '15 at 5:13
9

This answer may not really answer the question but provide some information what might had happened.

I've downloaded the torrent with 4Chan pictures containing the Pain.jpg and two other pics with hebrew chars. Here is the diabolic culprit ;-)

pain

ls -aBeil shows:

mymac:Reactions user$ ls -aBeil  
ls: P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg: No such file or directory         
total 528  
581705 drwxrwxrwx  6 user  staff     204 Jan 21 12:08 .  
401304 drwx------+ 6 user  staff     204 Jan 21 11:57 ..  
 0: group:everyone deny delete  
582449 -rw-r--r--@ 1 user  staff    6148 Jan 21 12:08 .DS_Store  
582261 -rw-r--r--  1 user  staff    4792 Jan 21 12:05 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.jpg  
582094 -rw-r--r--  1 user  staff  253804 Jan 21 12:06 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.xcf  

lsof -- . * shows:

mymac:Reactions user$ lsof -- . *  
lsof: status error on P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg: No such file or directory    
COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME  
bash    1290 user  cwd    DIR    1,2      204 581705 .  
lsof    1345 user  cwd    DIR    1,2      204 581705 .  
lsof    1346 user  cwd    DIR    1,2      204 581705 .  

All files were visible in the Finder except .DS_Store of course. Pain.jpg had a default icon and couldn't be opened. After moving Pain.jpg to the Downloads folder (at ~12:13 - check log below), waiting a few seconds and moving it back into the Reactions folder the preview icon appeared and the file could be opened.

pain

ls -aBeil now shows:

mymac:Reactions user$ ls -aBeil  
total 616  
581705 drwxrwxrwx  6 user  staff     204 Jan 21 12:14 .  
401304 drwx------+ 6 user  staff     204 Jan 21 12:14 ..  
 0: group:everyone deny delete  
582449 -rw-r--r--@ 1 user  staff    6148 Jan 21 12:14 .DS_Store  
581871 -rw-r--r--  1 user  staff   44041 Jan 21 12:01 P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg  
582261 -rw-r--r--  1 user  staff    4792 Jan 21 12:05 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.jpg  
582094 -rw-r--r--  1 user  staff  253804 Jan 21 12:06 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.xcf  

lsof -- . * shows:

mymac:Reactions user$ lsof -- . *  
COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME  
bash    1290 user  cwd    DIR    1,2      204 581705 .  
lsof    1390 user  cwd    DIR    1,2      204 581705 .  
lsof    1391 user  cwd    DIR    1,2      204 581705 .  

The corresponding log entries (sorry for the irritating hebrew chars cluttering the entries - at least editing and viewing them in Google Chrome - it's really difficult to format it at all):

21/01/15 12:07:10,734 QuickLookUIHelper[1231]: CoreAnimation: failed to create OpenGL context  
21/01/15 12:07:32,702 sandboxd[346]: ([1180]) mdworker(1180) deny file-read-xattr /Users/user/Desktop/Reactions ()  
21/01/15 12:08:03,862 QuickLookUIHelper[1248]: CoreAnimation: failed to create OpenGL context  
21/01/15 12:13:41,303 Finder[325]: sandbox extension creation failed: file system representation creation error for path: [/Users/user/Downloads/Reactions/P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg]  
21/01/15 12:13:41,303 Finder[325]: __CFPasteboardCreateSandboxExtensionDataFromCFData : failed to obtain sandbox extension data for url [file:///.file/id=6571367.581871]  
21/01/15 12:13:41,304 Finder[325]: Failed to obtain a valid sandbox extension for item: [789514] of flavor: [public.file-url] from the pasteboard.  Because the sandbox extension failed to be generated..  
21/01/15 12:13:41,304 Finder[325]: Failed to get a sandbox extensions for itemIdentifier (789514).  The data for the sandbox extension was still proxy data  
21/01/15 12:13:47,518 Finder[325]: sandbox extension creation failed: file system representation creation error for path: [/Users/user/Downloads/Reactions/P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg]  
21/01/15 12:13:47,518 Finder[325]: __CFPasteboardCreateSandboxExtensionDataFromCFData : failed to obtain sandbox extension data for url [file:///Users/user/Downloads/Reactions/P%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81A%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81I%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81N%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81.jpg]  

Moving the whole Reactions folder to the trash and deleting it with the pics is no problem. The same applies for copying the folder or moving it around. The Pain.jpg - though really a PITA regarding proper display - doesn't seem to be a virus.

The problems in Finder and sandbox probably occur because of the strange naming of the file: mixed roman and hebrew chars. Hebrew only file names are notated right to left (see second picture). Additionally some filesystem damage may had happened.

My advices are:

  • like others already mentioned: try to repair your main volume with 'Disk Utility' after rebooting to Recovery Mode
  • move the file to another folder, wait some time and move it back to its origin until you see the preview image. Check your logs for the sandbox messages (see above).
  • try to execute find . -inum <inode> -exec rm {} \; after successfully using ls -aBeil to get the inode of 'Pain.jpg'. In my case that would have been: find . -inum 581871 -exec rm {} \;
  • reboot to Recovery Mode and try to execute the last command (find . -inum <inode> -exec rm {} \;) after repairing the filesystem.

  • try to execute rm 'P\ ͎̮͉͍ͨ̈́̾̈́A\ ͎̮͉͍ͨ̈́̾̈́I\ ͎̮͉͍ͨ̈́̾̈́N\ ͎̮͉͍ͨ̈́̾̈́.jpg'

18
  • @danielAzuelos hmmm Bitsnoop is just a torrent site like piratebay or similar. I downloaded about 1400 pics via magnet link with µtorrent. i skipped most of them retaining only those with special chars. there was no *.dmg to download. – klanomath Jan 21 '15 at 15:04
  • @klanomath, thanks for your informative answer ... – Sami Jan 21 '15 at 15:53
  • @danielAzuelos, I also had a collections of photos from torrents and this image perhaps was one of them ... I remember I noticed that there was an exe file inside the folder containing the pain.jpg image and unfortunately it was late because perhaps it was already executed when the folder opened.. I was able to remove the original folder containing the images with such names the day before yesterday with no problem .. – Sami Jan 21 '15 at 16:01
  • find . -inum 581871 -exec rm {} \; note: 581871 is the inode please check the first column of ls -aBeil result – nelson Jan 21 '15 at 16:17
  • 1
    @klanomath: I forget a key point. If your LANG=en_US.UTF-8, then any char is printable and the -B isn't of much help. To use it efficiently one should enter unset LANG ; ls -aBeil. – dan Jan 21 '15 at 19:40
4

In normal use, the rm command is for removing files, and the rmdir command is for removing folders. rm will refuse to remove a folder, and rmdir will refuse to remove a file. And even then, rmdir won't remove a folder that contains anything beyond the artificial links to . and ...

Both of these limitations can be overcome by providing the -r switch (short for recursive) to rm as in rm -r list_of_files_or_folders. If asked to remove a folder, it will first remove everything inside, and then invoke rmdir internally to get rid of the folder. Subfolders are removed the same way, to any depth.

rm will complain if asked to remove something that can't be removed. However, adding the -f switch (short for force) tells it to make a best effort to overcome any obstacles that may come up. If it can't delete something either because it's locked or because its permissions say it can't be deleted, and you own the file, then as file owner you could unlock the file and/or change its permissions. With -f, the rm command will do these things silently without pestering you about it.

Short version:

cd ~/.Trash
rm -rf Downloads
1
  • I got the same errors rm: Downloads/Reactions: Directory not empty and rm: Downloads: Directory not empty – Sami Jan 20 '15 at 15:16
4

Right click on the trash can, while holding down the Command key. An option 'Secure Empty Trash' will appear. Select this. Hopefully it will empty the trash folder for you.

2
  • It says The operation can’t be completed because the item “Reactions” is in use. – Sami Jan 20 '15 at 19:06
  • Run cd ~/.Trash/Downloads/Reactions ; lsof -- . * – dan Jan 20 '15 at 22:55
4

First, cd into the Reactions folder:

cd ~/.Trash/Reactions

Then, type rm, a space, then the tab key.

This should autocomplete the first file in the directory.

If it does, you should be able to press return to delete the offending file.

1
  • The autocomplete works but I get the No such file or directory message – Sami Jan 20 '15 at 20:23
4

Sounds like it could be an illegal file name.

  • Boot into single user mode, try running fsck -f
  • Boot into Recovery Mode, run Disk Utility from there and select "Repair Disk"
0
3

Boot the system into Single User mode by powering off and holding Command+S. Then when you see bash3.2# type in /sbin/mount -uw / to mount the filesystem as readwrite.

Then,

  1. cd /Users/<your username>/ to move to your home directory
  2. rm -rf .Trash to force delete the trash directory
  3. mkdir .Trash to recreate the trash directory
  4. chmod 700 .Trash to set the proper permissions on the folder
  5. chown <your username> .Trash to set your user as the folders owner
  6. reboot to reboot and exit single user mode
2
  • I got the same errors rm: .Trash/Downloads: Directory not empty and rm: .Trash: Directory not empty – Sami Jan 20 '15 at 15:15
  • This answer is risky. The .Trash doesn't get the default ACL it has by default. Moreover on a corrupted FS it won't work. It's easier to say this now that we know the FS is damaged :). – dan Jan 22 '15 at 11:46
3

Try and move the folder Downloads out of the trash

Then run in terminal:

defaults write com.apple.finder AppleShowAllFiles -bool yes;osascript -e "tell application \"finder\" to quit";osascript -e "tell application \"finder\" to activate"

This will allow you to see hidden files in the Finder GUI file system.

If you can see the ...jeg file in the downloads or Reactions folders. Can you rename it. If so do so. and the try and delete it.

run in terminal:

defaults write com.apple.finder AppleShowAllFiles -bool no;osascript -e "tell application \"finder\" to quit";osascript -e "tell application \"finder\" to activate"

To reset the system to hidden.


You can run just the defaults write com.apple.finder AppleShowAllFiles -bool yes

in terminal.app and the manually Relaunch the finder. Using it's dock icon.

Hold down the alt key and then click the finders dock icon.

enter image description here

6
  • I moved the Downloads into desktop and followed your method. When I run the first command in terminal, everything hides on my desktop, then running your second command, desktop files appears again. – Sami Jan 20 '15 at 16:55
  • I also moved Reactions folder out of Downloads, and again deleted the files and emptied trash. Now, only Reactions with the hidden file inside left in the trash. – Sami Jan 20 '15 at 16:56
  • My system is always with defaults write com.apple.finder AppleShowAllFiles TRUE;killall Finder, but the file inside Reactions is not showing up – Sami Jan 20 '15 at 17:08
  • But if you ls -a on the folder you see it? – markhunte Jan 20 '15 at 17:18
  • Yes I can see that. It doesnt rename the file and says mv: rename ... to hi.jpg: No such file or directory. Note that I can not copy paste the filename here. – Sami Jan 20 '15 at 17:25
2

Try following the steps outlined in Apple's support document on this subject.Many of the items in the document are included in the suggestions here, but they offer some items to try for severe cases such as yours. Rather than repeat them all here, its best to simply refer to this well written document on the subject.

http://support.apple.com/en-us/HT201583

If all else fails, you might try creating a small boot thumbdrive using PuppyLinux or other such distro, then boot from that thumnbdrive. Mount the Mac harddrive, then navigate to the folder and delete the file.

1
  • Alternative to Linux booting: target disk mode and mount as a dumb drive on another Mac? – osxconor Jan 21 '15 at 2:38
-1

Perhaps it is not possible because you file is in an folder that is located in the download folder? Place back the files on your desktop, open the folder 'downloads' and delete what's in that folder. Try to empty your trash can now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .