4 ms·
You could boot in secure mode and check those files and their backups. That, I think, is a way to verify that this isn’t malware encrypting your files. Bootin
by Someone 3y ago
You could boot in secure mode and check those files and their backups.
That, I think, is a way to verify that this isn’t malware encrypting your files.
Booting from another disk would be even better.
- noduerme 3y agoThis is good advice, I read this out and checked as soon as I got home. I did not boot from another disk, but a random sample of files from the LSOF list are able to open; they're not encrypted. `cat` on some of the .txt files reads out the plain text. The modification dates on the files haven't changed... most of them are years old. I've got a script running now to watch how many files it opens in the /Users dir. Right now, 6. I use it all day every day, so I'll see if anything I do triggers it to start going nuts and reading thousands of files again...
- Someone 3y ago> I did not boot from another disk, but a random sample of files from the LSOF list are able to open; they're not encrypted. `cat` on some of the .txt files reads out the plain text. If you booted from a disk that may be infected those things don’t say much. Smart malware will silently decrypt files it encrypted on read until the moment it decides to make itself known to you.