MacOS – Trash folder is not emptying because of the P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg file

filemacosSecurityvirus

When I cd ~/.Trash in the terminal, it shows that there is a folder Downloads, and inside the Downloads folder, another folder Reactions, and inside Reactions, there is a file called

virus

Shutting down or restarting the computer does not work to empty the trash. Also, I should say that the file is hidden and is not showing when I open the Trash folder. Is it a virus? If yes, how do I get rid of it?

virus 2

In terminal, using: cd ~/.Trash/Downloads/Reactions and then ls -al, shows the jpg file.

(shown in the screenshot of the file because I could not copy and paste the text here in this question)

virus 3

drwxrwxrwx 3 username staff 102 Jan 19 14:36 .

drwxr-xr-x 3 username staff 102 Jan 19 16:09 ..

Update 1

I moved the Reactions out of the Downloads and emptied the trash. Now there is only Reactions left with the .jpg inside.

virus 4

By running ls -aBeil ~/.Trash/Reactions in terminal, following is the result:

virus 5

36328284 drwxrwxrwx 3 username staff 102 Jan 19 14:36 .

68013143 drwx------ 3 username staff 102 Jan 20 14:55 ..

Update 2

From cd ~/.Trash/Reactions > rm 'P > enter spacetab'return

Result is as follows:

virus 6

Update 3

Below is the result from unset LANG ; ls -aBeil ~/.Trash/Reactions:

virus 7

Update 4

Below is the result from utility disk verification:

virus 8

virus 9

Update 5

I just repaired the disk through Disk Utility using command + R access after system restart. Then, .jpg file is not hidden anymore and can be emptied on trash. Below you can see the screenshots.

virus 10

virus 11

Thank you all for your comments and answers. Special thanks to daniel Azuelos, patrix and klanomath.

Best Answer

This answer may not really answer the question but provide some information what might had happened.

I've downloaded the torrent with 4Chan pictures containing the Pain.jpg and two other pics with hebrew chars. Here is the diabolic culprit ;-)

pain

ls -aBeil shows: 

mymac:Reactions user$ ls -aBeil  
ls: P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg: No such file or directory         
total 528  
581705 drwxrwxrwx  6 user  staff     204 Jan 21 12:08 .  
401304 drwx------+ 6 user  staff     204 Jan 21 11:57 ..  
 0: group:everyone deny delete  
582449 -rw-r--r--@ 1 user  staff    6148 Jan 21 12:08 .DS_Store  
582261 -rw-r--r--  1 user  staff    4792 Jan 21 12:05 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.jpg  
582094 -rw-r--r--  1 user  staff  253804 Jan 21 12:06 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.xcf

lsof -- . * shows:

mymac:Reactions user$ lsof -- . *  
lsof: status error on P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg: No such file or directory    
COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME  
bash    1290 user  cwd    DIR    1,2      204 581705 .  
lsof    1345 user  cwd    DIR    1,2      204 581705 .  
lsof    1346 user  cwd    DIR    1,2      204 581705 .

All files were visible in the Finder except .DS_Store of course. Pain.jpg had a default icon and couldn't be opened. After moving Pain.jpg to the Downloads folder (at ~12:13 - check log below), waiting a few seconds and moving it back into the Reactions folder the preview icon appeared and the file could be opened.

pain

ls -aBeil now shows:

mymac:Reactions user$ ls -aBeil  
total 616  
581705 drwxrwxrwx  6 user  staff     204 Jan 21 12:14 .  
401304 drwx------+ 6 user  staff     204 Jan 21 12:14 ..  
 0: group:everyone deny delete  
582449 -rw-r--r--@ 1 user  staff    6148 Jan 21 12:14 .DS_Store  
581871 -rw-r--r--  1 user  staff   44041 Jan 21 12:01 P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg  
582261 -rw-r--r--  1 user  staff    4792 Jan 21 12:05 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.jpg  
582094 -rw-r--r--  1 user  staff  253804 Jan 21 12:06 ה̌͐͊͒̾͆יͩ́א ͭ̆צ̿̒̃͛ו͋פͯ͆̉ה͑͑ͧ̇ͪ͆.xcf

lsof -- . * shows:

mymac:Reactions user$ lsof -- . *  
COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME  
bash    1290 user  cwd    DIR    1,2      204 581705 .  
lsof    1390 user  cwd    DIR    1,2      204 581705 .  
lsof    1391 user  cwd    DIR    1,2      204 581705 .

The corresponding log entries (sorry for the irritating hebrew chars cluttering the entries - at least editing and viewing them in Google Chrome - it's really difficult to format it at all): 

21/01/15 12:07:10,734 QuickLookUIHelper[1231]: CoreAnimation: failed to create OpenGL context  
21/01/15 12:07:32,702 sandboxd[346]: ([1180]) mdworker(1180) deny file-read-xattr /Users/user/Desktop/Reactions ()  
21/01/15 12:08:03,862 QuickLookUIHelper[1248]: CoreAnimation: failed to create OpenGL context  
21/01/15 12:13:41,303 Finder[325]: sandbox extension creation failed: file system representation creation error for path: [/Users/user/Downloads/Reactions/P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg]  
21/01/15 12:13:41,303 Finder[325]: __CFPasteboardCreateSandboxExtensionDataFromCFData : failed to obtain sandbox extension data for url [file:///.file/id=6571367.581871]  
21/01/15 12:13:41,304 Finder[325]: Failed to obtain a valid sandbox extension for item: [789514] of flavor: [public.file-url] from the pasteboard.  Because the sandbox extension failed to be generated..  
21/01/15 12:13:41,304 Finder[325]: Failed to get a sandbox extensions for itemIdentifier (789514).  The data for the sandbox extension was still proxy data  
21/01/15 12:13:47,518 Finder[325]: sandbox extension creation failed: file system representation creation error for path: [/Users/user/Downloads/Reactions/P ͎̮͉͍ͨ̈́̾̈́A ͎̮͉͍ͨ̈́̾̈́I ͎̮͉͍ͨ̈́̾̈́N ͎̮͉͍ͨ̈́̾̈́.jpg]  
21/01/15 12:13:47,518 Finder[325]: __CFPasteboardCreateSandboxExtensionDataFromCFData : failed to obtain sandbox extension data for url [file:///Users/user/Downloads/Reactions/P%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81A%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81I%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81N%20%CD%8E%CC%AE%CD%89%CD%8D%CD%A8%CC%88%CC%81%CC%BE%CC%88%CC%81.jpg]

Moving the whole Reactions folder to the trash and deleting it with the pics is no problem. The same applies for copying the folder or moving it around. The Pain.jpg - though really a PITA regarding proper display - doesn't seem to be a virus.

The problems in Finder and sandbox probably occur because of the strange naming of the file: mixed roman and hebrew chars. Hebrew only file names are notated right to left (see second picture). Additionally some filesystem damage may had happened.

My advices are:

  • like others already mentioned: try to repair your main volume with 'Disk Utility' after rebooting to Recovery Mode
  • move the file to another folder, wait some time and move it back to its origin until you see the preview image. Check your logs for the sandbox messages (see above).
  • try to execute find . -inum <inode> -exec rm {} \; after successfully using ls -aBeil to get the inode of 'Pain.jpg'. In my case that would have been: find . -inum 581871 -exec rm {} \;

  • reboot to Recovery Mode and try to execute the last command (find . -inum <inode> -exec rm {} \;) after repairing the filesystem.

  • try to execute rm 'P\ ͎̮͉͍ͨ̈́̾̈́A\ ͎̮͉͍ͨ̈́̾̈́I\ ͎̮͉͍ͨ̈́̾̈́N\ ͎̮͉͍ͨ̈́̾̈́.jpg'

Related Question