Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found a suspicious hidden file on my Mac (a ppc powerbook running 10.4.11) when cleaning house recently. It's an 8 kb Unix executable file named ".nyiyeverc" sitting in my home directory (~/).

I searched its name on google, duckduckgo, even bing, but got nothing. Furthermore, I took a peek at it's contents by opening it in TextEdit (which in retrospect sounds like a foolish move, but I did it). In TextEdit it appears to be a single line that reads "awcnsawcnsawcnsawcnsawoolwascully wa". I plugged that string into search engines too with no results.

It looks like it was created 2/19/12 and last modified two days ago, 9/26/12, which leads me to believe that whatever it is, it's been up to something on a regular basis for the last seven months.

Any ideas what this might be and what I should do about it? For the time being I've moved it into a "quarantined" folder I made elsewhere in my home directory. I'm considering just deleting it, but don't know if that'd solve anything or break something. Help is appreciated!


share|improve this question
Does the filename reference "new years" i y "eve" rc (.nyiyeverc)? What could "iy" be? – zero2cx Sep 29 '12 at 6:11
There's cn in there, a sure sign of Chinese hackers! (I'm kidding) – Daniel Beck Sep 29 '12 at 6:15
You could see what processes access it by running sudo opensnoop -f ~/.nyiyeverc in Terminal and keeping the window open for a few days. – user495470 Sep 29 '12 at 6:16
@LauriRanta- thanks, I'll give that a try! – ivan Sep 30 '12 at 2:18
@LauriRanta - i got "sudo: opensnoop: command not found" :P I guess I don't have opensnoop on my machine. Sounds like it came with 10.5. Is there a way I could install it? – ivan Sep 30 '12 at 2:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.