Safely deleting files downloaded by Safari

Question

Sorry to ask such a basic question, but I am remotely helping my parents who have a Mac, and I am not familiar with that system, nor have I it at home.

They received a fake order confirmation email and my father clicked the button to cancel the order. This opened another tab alleging a security issue and it downloaded a number of files. They could not close the tab.

First I told them to restart Safari with the shift key pressed so that tabs were not restored.

Second they inspected the download list and cleared it (unfortunately before taking the picture I requested).

Now I am not sure as to whether the files are still on the computer. It is kind of assumed by a number of sources including https://support.apple.com/en-gb/guide/safari/sfri40598/mac that clearing the download list deletes them, but I am looking for a positive confirmation. Could please someone familiar with OSX/Safari confirm this?

My mother told me she could find no folder named "Downloads" (or its localized version). Could it be that the folder is hidden when empty?

Finally, if there is such a folder: What is safest way to empty the "Downloads" folder without risk of opening one of the files? Keeping in mind I must explain the procedure on the phone.

I do not think anything worse has happened. This looked like a scam to have them call a phone number, where they would have been requested to pay for "technical support".

Thanks in advance.

Answer 1

The Downloads folder is still usually visible to the user when empty. Some malware can be difficult to find and it may have even moved out of the Downloads directory. First, in Terminal, try chflags nohidden ~/Downloads and then cd ~/Downloads then ls. You can also try sudo chown Username:Staff ~/Downloads then sudo chmod 755 and then see if the folder and its contents are visible. Do they see any files in there then? If not, then try starting in Safe Mode. This startup mode allows macOS to start with only basic files that are required. To enter Safe Mode, reboot the Mac and hold Shift. You may need to login twice. Once you are in, try looking in Finder and Terminal for the downloads. You can also try applying the above Terminal commands again. Which version of macOS is the affected Mac running? If it is macOS Catalina, then Safari will always ask for confirmation before downloading the files. If none of the above are working, then your best bet is using Malwarebytes to remove malware found on your Mac. Good Luck!