Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.


macrumors regular
Original poster
Jan 21, 2014
Far northern Maine.
This is probably the wrong forum for this question, but since there are no threads I can find about viruses, I have guide as to where it should go.

My anti-virus keeps finding the same virus -- JS_NEMUCOD.SMAA9 -- in my /MobileSync/ folder.

I know it's a Windows virus, but it's irking me no end. Can anyone tell me how it is transferred? The fact that it's in MobileSync is confusing me, I think.

I review websites and blogs for a living, so basically, for 40 hours of every week, I'm going to all manner of websites, hence the anti-virus. And hence, no doubt, the virus. I download pretty much nothing, unless it's from my lawyer or my husband, so I don't understand.


Jan 3, 2014
Mobilesync is where iTunes backups of your mobile devices are kept, I'm not sure they are kept there as openly-readable files so it may be a false positive but you can always copy the backups elsewhere and start again.


macrumors 68030
Sep 24, 2013
That zip is loaded from an Email according to Microsoft "The text of the email will instruct you to open the attachment which it claims is an invoice, passport, or some other official document" So Maybe try a free or trial version of another anti-virus to see if a false positive. If same hit then delete device backups in iTunes then scan again, if clean perform a backup of one device, scan then another if all clean then it's from an old backup. Do you use iCloud backup or just on your desktop? Scary part is even though you can't be infected you could have forwarded it to others with windows machines.
  • Like
Reactions: Laisha


macrumors 65816
Jul 30, 2009
MobileSync is your iTunes device backup location (~/Library/Application Support/MobileSync). This would suggest that the document is on an iPhone or iPad and probably keeps getting written to this directory every time you sync\backup the device. If it is in an email, delete the email on all of your devices, then re-run virus scan.
  • Like
Reactions: Laisha
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.