3 ms·

I tried the second command. I got a load of open files, but all of them system stuff or fonts, nothing suspicious. TextEdit does store old versions of files it

I tried the second command. I got a load of open files, but all of them system stuff or fonts, nothing suspicious. TextEdit does store old versions of files it is working on, as with Time Machine. I wonder if what you saw was in some way related?

noduerme 3y ago
After quitting and reopening, that's what I see, just fonts and system files. About 10 items total, not the thousands that were there. The files it had open were files that would never have been opened with TextEdit... like, audio scratch files from 10 years ago in deep parts of the hierarchy (and not in Apple-designated folders like Music or Documents), my tax return PDFs (not saying this was targeted, it may have been ...) As I look at the list I captured now, it's funny. It's not alphabetical. It skips around a lot. A few dozen folders from my MP3 collection are listed there, but not in alphabetical order although the files within them are alphabetical. I use Arq for backups, and according to Arq's runs this morning and afternoon, none of those folders were modified or slated for backup today.
- Someone 3y ago
  You could boot in secure mode and check those files and their backups. That, I think, is a way to verify that this isn’t malware encrypting your files. Booting from another disk would be even better.
  - noduerme 3y ago
    This is good advice, I read this out and checked as soon as I got home. I did not boot from another disk, but a random sample of files from the LSOF list are able to open; they're not encrypted. `cat` on some of the .txt files reads out the plain text. The modification dates on the files haven't changed... most of them are years old. I've got a script running now to watch how many files it opens in the /Users dir. Right now, 6. I use it all day every day, so I'll see if anything I do triggers it to start going nuts and reading thousands of files again...
    - Someone 3y ago
      > I did not boot from another disk, but a random sample of files from the LSOF list are able to open; they're not encrypted. `cat` on some of the .txt files reads out the plain text. If you booted from a disk that may be infected those things don’t say much. Smart malware will silently decrypt files it encrypted on read until the moment it decides to make itself known to you.

noduerme 3y ago

After quitting and reopening, that's what I see, just fonts and system files. About 10 items total, not the thousands that were there. The files it had open were files that would never have been opened with TextEdit... like, audio scratch files from 10 years ago in deep parts of the hierarchy (and not in Apple-designated folders like Music or Documents), my tax return PDFs (not saying this was targeted, it may have been ...) As I look at the list I captured now, it's funny. It's not alphabetical. It skips around a lot. A few dozen folders from my MP3 collection are listed there, but not in alphabetical order although the files within them are alphabetical. I use Arq for backups, and according to Arq's runs this morning and afternoon, none of those folders were modified or slated for backup today.

Someone 3y ago
You could boot in secure mode and check those files and their backups. That, I think, is a way to verify that this isn’t malware encrypting your files. Booting from another disk would be even better.
- noduerme 3y ago
  This is good advice, I read this out and checked as soon as I got home. I did not boot from another disk, but a random sample of files from the LSOF list are able to open; they're not encrypted. `cat` on some of the .txt files reads out the plain text. The modification dates on the files haven't changed... most of them are years old. I've got a script running now to watch how many files it opens in the /Users dir. Right now, 6. I use it all day every day, so I'll see if anything I do triggers it to start going nuts and reading thousands of files again...
  - Someone 3y ago
    > I did not boot from another disk, but a random sample of files from the LSOF list are able to open; they're not encrypted. `cat` on some of the .txt files reads out the plain text. If you booted from a disk that may be infected those things don’t say much. Smart malware will silently decrypt files it encrypted on read until the moment it decides to make itself known to you.