0

While cleaning out my folders I found a XML script with ~160K lines of code. Maybe i'm ignorant and this is normal for a version file?

I won't paste snapshots because Im unsure if there is sensitive data, but there is a lot of use of dict and key tags, and bundle/carrierbundle associated URLs.

This kind of screams worm to me, but I just wanted to check with the community because im a bit of a noob.

If this is a malicious script, what is this best way to:

  1. Make sure it's not disrupting other processes.

  2. Report or warn the community of things to look out for?

  • live update. ive isolated the version.xml file on a completely wiped usb key and am figuring out how to safely delete it from my main hard drive. if anyone knows how to detect what other files or processes its corrupted please let me know. – mleafer May 20 at 3:56
  • Welcome to Ask Different :) Try isolating the file by moving it to someplace in your Home directory or a USB key. See if that file gets created again in Applications folder. XML files containing dict and key tags are pretty commonly used for storing metadata across macOS. – Nimesh Neema May 20 at 5:51
  • Generally speaking, there should't be any .XML file directly under Applications folder. Maybe it got there unintentionally. Isolate it and observe if it gets recreated. – Nimesh Neema May 20 at 5:52
  • @mleafer Nothing that you have described is really an indication of a worm, hacking or a virus. XML files are generally not executable. Please include a snippet of the file, or attach the whole file - then it is possible to say something about what it is. – jksoegaard May 20 at 12:45
  • hmm my question is more about about the anomaly of having a version.xml file in my applications folder? its 160k lines of code, so I have no clue what would be a good indicator for what to include as a snapshot. i know that XML files are not executable, but I have heard they've been used to hide viruses @NimeshNeema thank you this is what i did! :) – mleafer May 21 at 4:37

You must log in to answer this question.

Browse other questions tagged .