2

On my desktop, there is a directory called .CjlqgySsIMk=, and inside it there are two files:

XJ5LTgVvrEk=
and
110E80392142D917

Any idea of what these could be, or how I could figure out their creators?

edit:

Here's some info from similar files in my Documents folder (I deleted the .CjlqgySsIMk one)

drwxrwxrwx@ 3 rob rob 102 Jun 18 2008 .L0RBH0FUANLIHJ4KSMOF3AHG

and inside that directory:
-rw-rw-rw-@ 1 rob rob 242 Aug 11 2008 42CDCED929495D41

and

$ file 42CDCED929495D41
42CDCED929495D41: data

4
  • How old are they? I suspect remnants of a software installer or otherwise temporary files you could just delete.
    – Daniel Beck
    Feb 10, 2011 at 18:39
  • They are very old. 2006.
    – rob
    Feb 10, 2011 at 18:42
  • If you could open up a terminal and run ls -al inside the folder, that will give us some more information.
    – Daisetsu
    Feb 10, 2011 at 18:52
  • Also if you could run "file <filename>" for those files to determine filetypes.
    – Olli
    Feb 10, 2011 at 18:54

1 Answer 1

3

Sometimes hidden files like these (named with a seemingly random set of numbers and letters) are key files used by a third party application to facilitate a copy protection mechanism. They can crop up in a variety unexpected places in an attempt at security through obscurity.

This behaviour goes against the Apple's suggested practise for where an applications support files should be placed.

One downside is that these files may persist long after you have deleted the original application. A possible side affect of removing them is that the associated application may react as though you are attempting to break its copy protection.

Tracking down the related application can be troublesome. The related application may not access the file every time it is used or the related application may no longer exist.

You could try the following:

  • Open the Terminal and enter:
    sudo opensnoop -v -f filepath
  • Type your password when requested
  • run various programs to see if they access the file

You may eventually see some output. This will contain the command name for the process that accessed the file.

  • Use ctrl + C to stop opensnoop running in the terminal

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .