Files Changing to Exec Spontaneously
- Thread starter davido
- Start date
- Joined
- Sep 17, 2014
- Messages
- 4,836
- Reaction score
- 241
Need to know the following:
1. What exact Mac model do you have?
2. What exact Mac OS are you using?
3. Are you making any backups to an external device?
4. Have you ever done any disk cleanup/maintenance/repairs?
5. Did you do a recent upgrade of any software, and especially Quark Xpress.
6. Do you have a Windows partition on your internal drive?
7. Do you have either MacKeeper or CleanMyMac on your machine? If you do, get rid of them IMMEDIATELY, as they do much more harm than good.
1. What exact Mac model do you have?
2. What exact Mac OS are you using?
3. Are you making any backups to an external device?
4. Have you ever done any disk cleanup/maintenance/repairs?
5. Did you do a recent upgrade of any software, and especially Quark Xpress.
6. Do you have a Windows partition on your internal drive?
7. Do you have either MacKeeper or CleanMyMac on your machine? If you do, get rid of them IMMEDIATELY, as they do much more harm than good.
- Joined
- Sep 17, 2014
- Messages
- 4,836
- Reaction score
- 241
Regarding your statement about backups, "Yes, Seagate portable. Same thing happened there", what kind of backups are you making? That is, what software do you use for that? Typically, there are two ways of doing backups: 1) use Time Machine that comes with the Mac OS (but such a backup is not bootable), or 2) use either SuperDuper! or Carbon Copy Cloner to make a bootable backup.
Also, it is possible to partition a hard drive on a Mac and have Windows installed on that second partition. One can then use some Mac software for "managing" that partition, and can also install and run Windows software on it.
Also, it is possible to partition a hard drive on a Mac and have Windows installed on that second partition. One can then use some Mac software for "managing" that partition, and can also install and run Windows software on it.
- Joined
- Sep 17, 2014
- Messages
- 4,836
- Reaction score
- 241
OK, that's good. But, that does not explain the "same thing happened there" statement, unless one can run software from such a backup. (I use SuperDuper! for my backups, and by booting to that backup, I can run stuff off of it. It is just about the same as having another machine).
Now, what you will need to do is to try and find a Time Machine backup that was made prior to the issues you are having.
Next, boot your iMac to the (hidden) Recovery HD partition. This link describes how to do that, and what its capabilities are:
https://support.apple.com/en-us/HT201314
You would then first select #4, Disk Utility, from that menu. You then have 2 choices:
A. Have Disk Utility Verify and Repair your internal drive (this will also indicate how "healthy" the drive is). If it finds any issues, and fixes them, reboot your iMac normally, and see if the issue goes away.
B. If that does not fix it, or if you want to just start off right away, have Disk Utility Erase and Format your internal drive.
Once that completes, select #2, "Reinstall macOS". What that will do is obtain the latest version of Sierra, OS 10.12.3, from Apple's servers, and proceed to do a fresh, clean, "virgin" installation of OS 10.12.3. This will take some time.
Finally, select #1, and select that "good" Time Machine backup.
One caveat, though, is that it is not known for sure if the "nefarious" issue, although not executed, is on whatever backup you choose.
There is another possible way to proceed. Do you have any critical Quark Xpress files you need? If not, then download and install the excellent freeware program AppCleaner (available from here: https://freemacsoft.net/appcleaner/), drop the Quark Xpress icon (should be in your Applications folder) onto AppCleaner, and you will then be presented a list of all the files associated with Quark Xpress. After all that stuff is deleted, you could then install Quark Xpress, and see if your issue gets solved.
Now, what you will need to do is to try and find a Time Machine backup that was made prior to the issues you are having.
Next, boot your iMac to the (hidden) Recovery HD partition. This link describes how to do that, and what its capabilities are:
https://support.apple.com/en-us/HT201314
You would then first select #4, Disk Utility, from that menu. You then have 2 choices:
A. Have Disk Utility Verify and Repair your internal drive (this will also indicate how "healthy" the drive is). If it finds any issues, and fixes them, reboot your iMac normally, and see if the issue goes away.
B. If that does not fix it, or if you want to just start off right away, have Disk Utility Erase and Format your internal drive.
Once that completes, select #2, "Reinstall macOS". What that will do is obtain the latest version of Sierra, OS 10.12.3, from Apple's servers, and proceed to do a fresh, clean, "virgin" installation of OS 10.12.3. This will take some time.
Finally, select #1, and select that "good" Time Machine backup.
One caveat, though, is that it is not known for sure if the "nefarious" issue, although not executed, is on whatever backup you choose.
There is another possible way to proceed. Do you have any critical Quark Xpress files you need? If not, then download and install the excellent freeware program AppCleaner (available from here: https://freemacsoft.net/appcleaner/), drop the Quark Xpress icon (should be in your Applications folder) onto AppCleaner, and you will then be presented a list of all the files associated with Quark Xpress. After all that stuff is deleted, you could then install Quark Xpress, and see if your issue gets solved.
Last edited:
I have probably hundreds of Quark files that I need (jobs done over the years that I may need to resurrect at some point). I have tried to find recently created or worked on files that are unaffected and have copied them to another portable disk. I've also gone through the backup and I see that earlier saves do have good copies of Quark files, and so I have removed the backup in order to -- hopefully -- "preserve" them. I say hopefully because I don't know if this problem is only something that affects my iMac, or if it will travel, i.e., if I connect the backup to my laptop, whether the problem will spread there, too. Would you have any idea about that?
- Joined
- Sep 17, 2014
- Messages
- 4,836
- Reaction score
- 241
You sure are doing everything as best as possible. But, what exactly do you mean by "I have removed the backup"? It seems like you have found a recent Time Machine backup that (hopefully) does not contain any problematic files.
By the way, does the issue still occur?
By the way, does the issue still occur?
I found a backup from earlier in January in which the files I need most seem to be OK. But of course that doesn't include all the files I worked on more recently, some of which have gone ape. In any case, I simply disconnected the backup in the hope that nothing else on it will be affected.
When I look at the files in my finder, there are many that are now Exec files. It's hard to tell if the number of these is growing, or if just one random bunch was affected at one time, as they are all over the place. What I'll do it take a screen shot of one section of the finder, and check back later in the day to see if anything has changed.
Have you come across this problem before? Do you have any idea if it's some sort of virus that will affect everything it touches (in which case I should not copy anything onto my laptop) or what else could be causing it?
When I look at the files in my finder, there are many that are now Exec files. It's hard to tell if the number of these is growing, or if just one random bunch was affected at one time, as they are all over the place. What I'll do it take a screen shot of one section of the finder, and check back later in the day to see if anything has changed.
Have you come across this problem before? Do you have any idea if it's some sort of virus that will affect everything it touches (in which case I should not copy anything onto my laptop) or what else could be causing it?
- Joined
- Sep 17, 2014
- Messages
- 4,836
- Reaction score
- 241
I have not encountered such a problem before. The confusing thing is why they are now Exec files, which are only useful on a Windows OS. And that software is available in both Windows and Mac versions.
I guess a virus is a possibility, but how did you get it? That's like finding a needle in the haystack.
If you followed the instructions I gave above and restored that January Time Machine backup, would that be acceptable? If that works, then hopefully things will be fine, your files will be created normally, and you can then start making more backups.
I guess I should have asked a more basic question earlier. Is this behavior happening only with Quark Xpress?
I guess a virus is a possibility, but how did you get it? That's like finding a needle in the haystack.
If you followed the instructions I gave above and restored that January Time Machine backup, would that be acceptable? If that works, then hopefully things will be fine, your files will be created normally, and you can then start making more backups.
I guess I should have asked a more basic question earlier. Is this behavior happening only with Quark Xpress?
Yes, only with Quark. The affected files open with Terminal, but only some text stuff shows up.
The only problem with using the January backup, of course, is that it doesn't give me back the files I worked on during the last few days and which I need most urgently. In any case, I'm a bit hesitant to do what you suggest on my own, so I'm trying to get hold of a local techie whom I have used before to see if he can come today or tomorrow. I'll let you know what happens.
Meanwhile, thanks so much for help so far--it's very reassuring to know there are people out there who know what they're talking about and are willing to give of their time.
The only problem with using the January backup, of course, is that it doesn't give me back the files I worked on during the last few days and which I need most urgently. In any case, I'm a bit hesitant to do what you suggest on my own, so I'm trying to get hold of a local techie whom I have used before to see if he can come today or tomorrow. I'll let you know what happens.
Meanwhile, thanks so much for help so far--it's very reassuring to know there are people out there who know what they're talking about and are willing to give of their time.
- Joined
- Sep 17, 2014
- Messages
- 4,836
- Reaction score
- 241
Cool! I've seen similar posts here about simply changing the extension name, and voila, things are back to normal. As long as this strange event is no longer happening, it would seem to be a one time "quirk". If the Quark software is the culprit, then at least you would know for certainty that it is not some sort of virus.
Going forward, it would be wise if you get on some kind of schedule of doing disk cleanup/maintenance/repairs. Daily disk cleanup should be just about second nature, even something as simple as permanently deleting EMails one no longer needs. More "intense" disk cleanup/maintenance/repairs should be performed periodically, at least once or twice a month. You'll definitely see benefits from doing that. There are both free and commercial products that help you with that. I can recommend some, and I''m sure there are others.
Going forward, it would be wise if you get on some kind of schedule of doing disk cleanup/maintenance/repairs. Daily disk cleanup should be just about second nature, even something as simple as permanently deleting EMails one no longer needs. More "intense" disk cleanup/maintenance/repairs should be performed periodically, at least once or twice a month. You'll definitely see benefits from doing that. There are both free and commercial products that help you with that. I can recommend some, and I''m sure there are others.