Bad synergy

Mac OS X has some great features, among which are Time Machine (which allows recovery of deleted or overwritten files) and Mail.app. Junk mail filtering means I rarely see spam in my inbox, but I keep “junk” mail in the spam folder for a while in case a real message gets mis-classified as spam. I also have Mail.app set up to cache all messages and attachments locally, so I have super-fast access to my received email, even when I’m not on the Internet. But I recently discovered a dark side to this combination (Time Machine+cached email): Old Windows viruses that were transmitted as spam are stored in my TM backups, where Sophos (free version, at least) is unable to automatically clean them up. Nuts!

Until recently I hadn’t bothered with anti-virus software for my Mac, (mistake #1). I occasionally saw some Windows viruses show up in email, but I just tagged the messages as “junk” and let the system delete them later, (mistake #2). And I was blithely comforted seeing TM backups occurring every hour or so. (Not a mistake per se, but failing to consider that some things really don’t belong in my backups was mistake #3.)

So when I finally did install Sophos and had it scan my system (including my Time Machine disk), it found a bunch of viruses and other malware in backups of my “Junk Mail” folder. I found a discussion of how to delete all backups of a file in TM, but it’s still a lot more difficult than having the anti-virus software clean up automatically. I’ve spent over an hour manually cleaning viruses out of TM, but at last I think I’m finished. Rescanning the whole system again, and hopefully this time no malware will be detected!

Lessons learned:

1. If you don’t have anti-virus software on your Mac, get it now! I wish I’d installed Sophos before I started using Time Machine.
2. If you were already running TM, don’t set your anti-virus software to automatically clean up infections, just log the infected files. If the infected files were backed up by TM, you can locate them at their original location in Finder, then go into TM, right-click on the file and select “Delete All Backups”.
3. Turn down the dial on Junk mail retention in Mail.app. If you haven’t pulled it out of the junk folder within one day, you probably aren’t going to.