Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sophos detected a trojan which it cannot remove on Mac OS 10.4 and it says to remove it manually. Problem is, it gives the file name as xxxxxxxx-xxxxxxxx where the x's are hex digits. No directory path, no nothin—just the digits.

How do I find and delete this file?

share|improve this question
    
Have you tried searching for the given file name? –  Kromey Apr 20 '11 at 0:38
1  
I wouldn't rely on the report from a single scanner to be definitive. When you do locate the file have it checked by one of the on-line scanners, such as virustotal.com, for confirmation. Sophos has a very poor track record for false positives. –  John Gardeniers Apr 20 '11 at 2:13
add comment

migrated from serverfault.com Apr 20 '11 at 2:16

This question came from our site for professional system and network administrators.

3 Answers

There are a variety of ways of searching for a file by name. I'd just open the Terminal and run locate xxxxxxxx-xxxxxxxx, although the locate index is only updated once a week, so if it's a new file it might not be listed. If you want, you can manually force an update with sudo /usr/libexec/locate.updatedb (you'll need to enter your admin password for the sudo).

You can use Spotlight in the Finder, but it leaves out system files by default -- there's a way to change this, but it's a little complicated and may not be the same in 10.4. (EDIT: instructions for doing this in 10.6 are in Apple's KB #HT4355.)

Finally, you could use the find command: sudo find / -name xxxxxxxx-xxxxxxxx -- this will require your admin password for the sudo, and will be slow (it actually looks at all your files to find a match), but should find things the other options might miss.

share|improve this answer
2  
I'm upvoting the 'sudo find' option. –  Scott Warren Apr 20 '11 at 12:23
    
Thanks! I'll try this next time I see this user. I'll let you know what I find. –  some.hacker Apr 20 '11 at 18:33
    
sudo find / -name xxxxxxxx-xxxxxxxx 2> /dev/null is preferable tbh –  XAleXOwnZX Mar 19 at 3:07
add comment

If your mac has spotlight, mdfind is a much better command line too for locating a file.

Next in speed / efficiency would be locate (which uses a typically week old cached version of the find command to index files)

Lastly the slower find to crawl the directory from a root folder you wish to begin the search.

All the tools can fail to find files, mdfind has built-in exclusions (few and mostly system cache and internal files), locate can be out of date and excludes sone files by rule as well, find of course needs permission to traverse directories so it can fail to find files that have restrictive permissions.


You can of course use the finder to search spotlight (which is basically what mdfind does) and ask to include system files assuming your file is squirreled away in some temporary folder and not being found by the default spotlight settings... Command+Option+Space enter image description here

share|improve this answer
add comment

I can recommend EasyFind and Find Any File (of which I'm the author, incidentally). Both search for file names on entire disks. They search even in places where Spotlight never looks (e.g. in the System and Library folders). In case of Find Any File, you can even easily search as root user, so that it even finds files usually not accessible to you.

Both tools are also better than the "locate" command because they search the current disk catalog, while locate only looks inside a database that needs regular updating - so it won't find files that were only just created, e.g. after installing some new software via an installer.

And both are much much faster than using the find command.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.