"Model" file created in HD - Avast

system · 2017-06-06T20:38:36.000Z

Dear colleagues
I have found that a new file has been created in the HD Macintosh directory, named “model”. It is a textedit file, just 9kb. The problem (and my concern) is that I am asked to type my password if I want to remove it.
I think that it must be related with Avast, since the last time I scanned my Mac with Avast was on May 27, beginning at 7:51, and the file was created that same day at 7:53 (Avast found no viruses on that analysis, and when I have scanned specifically that file, Avast says that there is no infection). I have found that other user has had the same problem (https://discussions.apple.com/thread/7939670?start=0&tstart=0). I do not understand quite well what he says about losing all his information, but it sounds worrying.
My Mac runs El Capitan 10.11.6.
Does anybody knows what this may be? Should I try to remove it, typing my password? (I have tried to move it to another folder, but it does not disappear from the HD directory).
Thanks in advance
Tahl

Pondus · 2017-06-06T20:45:54.000Z

are you able to upload and scan the file here www.virustotal.com
If scanned before (it will ask show last report) click rescan button for a fresh result

post link to scan result here

system · 2017-06-07T09:57:47.000Z

Thanks for your comment Pondus
I have scanned the file with virustotal as you recommended and it found no infection. Here is the link:
https://www.virustotal.com/es/file/a360c4b965d76f4597bf3d991241414d2b752ca3b84ac08ad5794f36a0d2a5cc/analysis/1496828957/

It’s strange. I was allowed to copy and pasted to another folder, and from that one I can delete it without any problem. However, when I try to delete it from the root HD Macintosh directory, finder asks me the password (which, as far as I know, it is only required for applications, and not for a textedit file) (?) (which I am reluctant to do until I know better what is this and why this has happened).
What can this be? Should I be worried?
Thanks

Eddy · 2017-06-07T10:59:46.000Z

Run a new scan with avast (same scan type as you did previously) and check if the data/time of that file have changed.

system · 2017-06-07T20:22:13.000Z

Dear Eddy
Thanks for the idea. I have scanned again the whole system, but the file did not change its properties. Avast did not find any infection neither this time (48 files could not be scanned, but this is as usual). Anyway, I still think that it is too much coincidence that the file was created just two minutes after I began that previous analysis that I mentioned, and there is another user who relates this with Avast and claims that the file was back when he scanned again his computer with Avast (link in my first post).
Any idea of what this may be and any suggestions of what should I do?
Thanks for the support
Tahl

Eddy · 2017-06-07T20:25:18.000Z

I don’t know much about MAC’s, but the time/date should have changed if it is related to avast scanning I would say.
As it is just a text file as you say, my guess here it is some sort of security from the MAC that is asking for the password.
I say delete it.

Mac · 2017-06-14T10:58:27.000Z

You can be asked for the password to make changes to files at the base of the file system, or with files with certain privileges set.

I would copy it to another location and delete the original file. That way if something does need the file you have a backup.

system · 2017-06-19T14:51:57.000Z

Thaks Mac
Your recommendation seems quite sensible. I’ll do that.
Thank you

Announcements