0

Sorry to ask such a basic question, but I am remotely helping my parents who have a Mac, and I am not familiar with that system, nor have I it at home.

They received a fake order confirmation email and my father clicked the button to cancel the order. This opened another tab alleging a security issue and it downloaded a number of files. They could not close the tab.

First I told them to restart Safari with the shift key pressed so that tabs were not restored.

Second they inspected the download list and cleared it (unfortunately before taking the picture I requested).

Now I am not sure as to whether the files are still on the computer. It is kind of assumed by a number of sources including https://support.apple.com/en-gb/guide/safari/sfri40598/mac that clearing the download list deletes them, but I am looking for a positive confirmation. Could please someone familiar with OSX/Safari confirm this?

My mother told me she could find no folder named "Downloads" (or its localized version). Could it be that the folder is hidden when empty?

Finally, if there is such a folder: What is safest way to empty the "Downloads" folder without risk of opening one of the files? Keeping in mind I must explain the procedure on the phone.

I do not think anything worse has happened. This looked like a scam to have them call a phone number, where they would have been requested to pay for "technical support".

Thanks in advance.

  • Sorry about that. I deleted the one on superuser. I had not found that SE site although I searched for it at first. – Balzola May 4 at 12:13
  • My mother and my father both have Macs. My mother is a bit more proficient than my father, but the incident occurred on my father's computer. And indeed this morning she could not find the Downloads folder. I sent a picture of the finder to help them locate it. I had no answer for now. If they are stuck I'll ask them to install TeamViewer. I'm worried they do not know how to check if the antivirus is running. – Balzola May 4 at 18:49
  • Open Terminal and type open ~/Downloads then press enter. This should open the Downloads folder. If it doesn't , type find "$HOME" -type d -iname 'Downloads' then press enter. What does it find? – user3439894 May 4 at 22:48
-2

The Downloads folder is still usually visible to the user when empty. Some malware can be difficult to find and it may have even moved out of the Downloads directory. First, in Terminal, try chflags nohidden ~/Downloads and then cd ~/Downloads then ls. You can also try sudo chown Username:Staff ~/Downloads then sudo chmod 755 and then see if the folder and its contents are visible. Do they see any files in there then? If not, then try starting in Safe Mode. This startup mode allows macOS to start with only basic files that are required. To enter Safe Mode, reboot the Mac and hold Shift. You may need to login twice. Once you are in, try looking in Finder and Terminal for the downloads. You can also try applying the above Terminal commands again. Which version of macOS is the affected Mac running? If it is macOS Catalina, then Safari will always ask for confirmation before downloading the files. If none of the above are working, then your best bet is using Malwarebytes to remove malware found on your Mac. Good Luck!

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .