2

I'm a little afraid to get bashed since this is super non-specific but this is exactly my problem. I'm finding weird file duplicates on my computer – with the same name as the original file but an added dot at the start plus a six-digit random extension at the end. It looks like this (below the originals, above the duplicates):

892707  24 -rwxr-xr-x@  1 myusername  staff    8704 Oct  4 22:49 .schlussel_02.xls.2DNKl1
934562  24 -rw-r--r--@  1 myusername  staff    8704 Oct  4 22:49 schlussel_02.xls

892704  8 -rwxr-xr-x@  1 myusername  staff    960 Jan 13  2017 .telecolumbus_alias.9b260v
934531  8 -rw-r--r--   1 myusername  staff    960 Jan 13  2017 telecolumbus_alias

At first I thought I had become the victim of a ransomware attack but these files are not encrypted but exact duplicates – if I remove the additional parts of the name they open just fine.

The files are located in a folder which syncs via Resilio between Windows 10 (NTFS) and macOS 10.13.2 (APFS). Because of this, I do not even know whether these files have been created on Windows or macOS.

Virus Tools (on the PC as well as the MacBook) did not find anything.

Do I need to be worried? How do I approach this? Is there any way to find out what created these files? Any leads on what might be happening here?

Kamil Maciorowski
  • 69,815
  • 22
  • 136
  • 202
user3647558
  • 59
  • 1
  • 9
  • 2
    Those files are likely temp copies that your application uses while you open/edit a file, normal in most cases. If you had been a victim of a Ransomware attack you would know it, there wouldn't be a question. Why do you think this is somekind of hack? And the `@` symbol simply means the file has "extended attributes" which is normal. http://scottlab.ucsc.edu/xtal/wiki/index.php/Extended_Attributes – acejavelin Dec 31 '17 at 14:49
  • What you want help with isn’t clear since your files are not encrypted nor are you a victim of randsomware. – Ramhound Dec 31 '17 at 15:23
  • 1
    guys, thank all of you so very much for your help! i was worried since i searched for these weird random extensions and the only thing i found in regards to these were ransomware attacks (and i still think this is an odd choice to name temp files like this). if i do not need to be worried in the first place, all the better! i did post this now in the resilio forums to figure out wether the sync process might be responsible for this and i will report if i get any information. again, thank you so much for relieving me of my paranoia! – user3647558 Dec 31 '17 at 16:03
  • ... so, i asked in the resilio forums but resilio does not seem to be the culprit (https://forum.resilio.com/topic/43900-file-duplicates-with-weird-extensions/). so for now, i just deleted these weird files and will monitor if they appear again... nothing happened much so far though. again, thank all of your for your help and all the best! – user3647558 Jan 09 '18 at 10:54

0 Answers0