Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On my desktop, there is a directory called .CjlqgySsIMk=, and inside it there are two files:

XJ5LTgVvrEk=
and
110E80392142D917

Any idea of what these could be, or how I could figure out their creators?

edit:

Here's some info from similar files in my Documents folder (I deleted the .CjlqgySsIMk one)

drwxrwxrwx@ 3 rob rob 102 Jun 18 2008 .L0RBH0FUANLIHJ4KSMOF3AHG

and inside that directory:
-rw-rw-rw-@ 1 rob rob 242 Aug 11 2008 42CDCED929495D41

and

$ file 42CDCED929495D41
42CDCED929495D41: data

share|improve this question
    
How old are they? I suspect remnants of a software installer or otherwise temporary files you could just delete. –  Daniel Beck Feb 10 '11 at 18:39
    
They are very old. 2006. –  rob Feb 10 '11 at 18:42
    
If you could open up a terminal and run ls -al inside the folder, that will give us some more information. –  Daisetsu Feb 10 '11 at 18:52
    
Also if you could run "file <filename>" for those files to determine filetypes. –  Olli Feb 10 '11 at 18:54

1 Answer 1

up vote 3 down vote accepted

Sometimes hidden files like these (named with a seemingly random set of numbers and letters) are key files used by a third party application to facilitate a copy protection mechanism. They can crop up in a variety unexpected places in an attempt at security through obscurity.

This behaviour goes against the Apple's suggested practise for where an applications support files should be placed.

One downside is that these files may persist long after you have deleted the original application. A possible side affect of removing them is that the associated application may react as though you are attempting to break its copy protection.

Tracking down the related application can be troublesome. The related application may not access the file every time it is used or the related application may no longer exist.

You could try the following:

  • Open the Terminal and enter:
    sudo opensnoop -v -f filepath
  • Type your password when requested
  • run various programs to see if they access the file

You may eventually see some output. This will contain the command name for the process that accessed the file.

  • Use ctrl + C to stop opensnoop running in the terminal
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.