How to find & delete an obscure file of which I only know the name?

Question

Sophos detected a trojan which it cannot remove on Mac OS 10.4 and it says to remove it manually. Problem is, it gives the file name as xxxxxxxx-xxxxxxxx where the x's are hex digits. No directory path, no nothin—just the digits.

How do I find and delete this file?

Answer 1

There are a variety of ways of searching for a file by name. I'd just open the Terminal and run locate xxxxxxxx-xxxxxxxx, although the locate index is only updated once a week, so if it's a new file it might not be listed. If you want, you can manually force an update with sudo /usr/libexec/locate.updatedb (you'll need to enter your admin password for the sudo).

You can use Spotlight in the Finder, but it leaves out system files by default -- there's a way to change this, but it's a little complicated and may not be the same in 10.4. (EDIT: instructions for doing this in 10.6 are in Apple's KB #HT4355.)

Finally, you could use the find command: sudo find / -name xxxxxxxx-xxxxxxxx -- this will require your admin password for the sudo, and will be slow (it actually looks at all your files to find a match), but should find things the other options might miss.

Answer 2

If your mac has spotlight, mdfind is a much better command line too for locating a file.

Next in speed / efficiency would be locate (which uses a typically week old cached version of the find command to index files)

Lastly the slower find to crawl the directory from a root folder you wish to begin the search.

All the tools can fail to find files, mdfind has built-in exclusions (few and mostly system cache and internal files), locate can be out of date and excludes sone files by rule as well, find of course needs permission to traverse directories so it can fail to find files that have restrictive permissions.

---

You can of course use the finder to search spotlight (which is basically what mdfind does) and ask to include system files assuming your file is squirreled away in some temporary folder and not being found by the default spotlight settings... Command+Option+Space