Member Avatar for cuivenion

Yes it was a very dumb thing to do, I realised about a second after I did it. In my defence I was actually waiting for a UPS shipment, which was the subject of the phishing mail. The attached file was zipped and I didn't open it, I immediately deleted it.

I'm in the process of running a full ClamXav scan. If it turns nothing up am I in the clear, or do I have to do further checking for infection?

  • 5 Contributors
  • 8 Replies
  • 249 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by cuivenion

Dani AI

Generated

Short summary and practical follow-ups for the thread: deleted the zipped phishing attachment and reported a negative on-demand scan. That combination makes an active compromise unlikely, but deletion alone does not guarantee the file’s bytes are unrecoverable (as pointed out). , and correctly flagged secure-overwrite options as ways to reduce recoverability; those steps help erase leftover data but do not replace checks for actual compromise.

Recommended checklist (easy-to-hard, for forensic peace of mind):

  • Confirm no copies remain in Downloads, Desktop, Mail attachments, or Trash and review the mail/download history for any accidental opens.
  • Check for macOS quarantine metadata and for obvious persistence points (login items, browser extensions, configuration profiles).
  • Run a reputable modern on-demand scanner and a system diagnostic/report utility that inventories installed LaunchAgents/Daemons and kernel extensions.
  • Inspect these common persistence locations for unfamiliar items: ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons, and the Login Items list in Users & Groups. If comfortable with Terminal, list those directories to review names.

Example Terminal checks (optional, for someone comfortable with the command line):

xattr -l ~/Downloads/suspect.zip
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

If any suspicious items are found or if the archive was opened/executed: isolate the Mac from networks, back up important personal files to external media (do not copy unknown executables), change passwords for accounts used on the machine and enable two-factor authentication, and consider a clean reinstall of macOS if evidence of persistence or strange behavior appears. If nothing suspicious is found and the file was never opened, ongoing monitoring and keeping macOS and apps up to date is a reasonable course.

Recommended Answers

All 8 Replies

Member Avatar for james.lu.75491856

When You delete something, the data IS STILL THERE! It will be replaced, but the only way to 100% sure to get rid of it, is to fill up your hard drive.

Member Avatar for rubberman

There is a Linux application call shred which will erase a file after filling it with random bytes and finally with zeros. Since this is an open source program, I expect it is also available for the Mac.

Member Avatar for cuivenion

I understand but I've already deleted it. ClamXav didn't turn up anything. I'm open to suggestions.

Member Avatar for Assembly Guy

I understand but I've already deleted it.

You could undelete it, then shred it. OR you could use dd if=/dev/urandom of=filler to fill up the empty space on your disk with random data. Just to be sure that the file's data still isnt there

Edited by Assembly Guy
Member Avatar for cuivenion

Well I ran Remo Recover and I couldn't see the file anywhere, so I can only assume it's been overwritten. "dd if=/dev/urandom of=filler" I would run this script but I'm afraid I don't know what it is.

Member Avatar for Assembly Guy

Oops sorry - I assumed you were using Linux.

Member Avatar for Danarchy

Usually, if you delete a zip file that hasn't been opened, you're good to go. Use Secure Delete (and that can be adjusted to more secure levels) and you're even better off. Takes longer because it over writes more than standard Delete.

Member Avatar for cuivenion

Nice One! Thanks. I've since upgraded to mavericks, so I imagine I'm fine.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.