Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I found a suspicious hidden file on my Mac (a ppc powerbook running 10.4.11) when cleaning house recently. It's an 8 kb Unix executable file named ".nyiyeverc" sitting in my home directory (~/).

I searched its name on google, duckduckgo, even bing, but got nothing. Furthermore, I took a peek at it's contents by opening it in TextEdit (which in retrospect sounds like a foolish move, but I did it). In TextEdit it appears to be a single line that reads "awcnsawcnsawcnsawcnsawoolwascully wa". I plugged that string into search engines too with no results.

It looks like it was created 2/19/12 and last modified two days ago, 9/26/12, which leads me to believe that whatever it is, it's been up to something on a regular basis for the last seven months.

Any ideas what this might be and what I should do about it? For the time being I've moved it into a "quarantined" folder I made elsewhere in my home directory. I'm considering just deleting it, but don't know if that'd solve anything or break something. Help is appreciated!

Thanks

share|improve this question
    
Does the filename reference "new years" i y "eve" rc (.nyiyeverc)? What could "iy" be? –  zero2cx Sep 29 '12 at 6:11
    
There's cn in there, a sure sign of Chinese hackers! (I'm kidding) –  Daniel Beck Sep 29 '12 at 6:15
1  
You could see what processes access it by running sudo opensnoop -f ~/.nyiyeverc in Terminal and keeping the window open for a few days. –  Lri Sep 29 '12 at 6:16
    
@LauriRanta- thanks, I'll give that a try! –  ivan Sep 30 '12 at 2:18
    
@LauriRanta - i got "sudo: opensnoop: command not found" :P I guess I don't have opensnoop on my machine. Sounds like it came with 10.5. Is there a way I could install it? –  ivan Sep 30 '12 at 2:31
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.