Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Deleting this file will break the whole internets, for the sake of our children don't do it!.

The above quotation is the content of a text file called STR8369805638PUB6932583035105 that I found today browsing the ~/Library/Application Support using a terminal.

I've found a thread on the Apple forums of somebody having exactly the same issue. It is also discussed on a german forum.

The file is not visible using the Finder, I discovered it because I've done an ls while in ~/Library/Application Support.

This is how the file look in a binary editor, the only odd thing may be that the file ends with a CR (0D) although it's quite recent (it's been created in October):

Binary editor view

Does anybody have any idea where this file may come from ?

share|improve this question
4  
I'd delete it if I were you. –  Emil Feb 28 '13 at 15:54
4  
Did you install or run for the first time any particular application in October? One theory: the file may be a sentry file for a program you use. For instance, if you have a time-limited demo of some software, programmers of such tools often need a place (and one well hidden!) to store the date you first ran the program, to know when the evaluation period runs out, when to nag you to register, when to disable functionality if you didn't register, etc. The date on this file may be the important piece of datum, and the contents a joke. –  Chris W. Rea Feb 28 '13 at 16:11
    
Hee hee - hopefully it's some developer having a sense of humor. –  bmike Feb 28 '13 at 16:11
    
@bmike yeah I expect so, still I'd like to know if somebody has the same file. –  Pastronio Faruglio Feb 28 '13 at 16:18
4  
If you're a developer then you can use dtrace to find out who is accessing that file. If you don't know dtrace it is an awesome tool for finding out what is going on at the system level. –  Mark Feb 28 '13 at 16:42
show 4 more comments

2 Answers

up vote 20 down vote accepted

I found the culprit !

Thanks to the suggestion of @Mark Thalkman I made a DTrace script to monitor applications accessing that file.

The application that creates the file is called AppWrapper. The way I discovered it was to look at the folders created in October in /Library/Application Support. There were only two, appWrapper and eSellerate. So I downloaded AppWrapper again and after launching it the script detected that it was accessing the file.

I'm sure the developer made a mistake and instead of saving the file inside the appWrapper folder he saved it in ~/Library/Application Support.

For those interested, here's the script:

#!/usr/sbin/dtrace -s

\#pragma D option quiet

BEGIN
{
  printf("\n   Timestamp           gid   uid   pid  ppid execname     function           current directory file name\n\n");
}

syscall::open:entry,   
syscall::unlink:entry,  
syscall::rename:entry
/strstr(stringof(copyinstr(arg0)), $1) != NULL/
{
      printf("%Y %5d %5d %5d %5d %-12s %-10s %25s %s\n", walltimestamp, gid, uid, pid, ppid, execname, probefunc, cwd, stringof(copyinstr(arg0)));
}
share|improve this answer
5  
.. and the question for the more curious now is: what does it need that file for? –  Chris W. Rea Feb 28 '13 at 17:17
1  
I was curious about this so I emailed them to see if they might shed any light onto this file. They were very vague: –  Tony Mar 2 '13 at 18:37
    
Dear Tony, My name is Sam Rowlands and I’m one of the developers here at Ohanaware, thank you for your e-mail. I apologize for the delayed response to your e-mail. The file in question is part of our registration system, deleting it may cause issues with the registration of App Wrapper. Thanks for supporting Ohanaware and our software. Sam Rowlands –  Tony Mar 2 '13 at 18:38
1  
Ironically, part of App Wrapper's functionality is to simplify sandboxing applications for the MAS! –  timothymh Mar 5 '13 at 23:23
add comment

You might not be able to track the process that wrote that file, but why not try.

Grab a copy of fseventer or search for that filename in the Time Machine spotlight field to see if you can narrow down when it arrived on your Mac.

share|improve this answer
1  
Time Machine is a good suggestion, unfortunately it's not setup on the machine where I found this file. –  Pastronio Faruglio Feb 28 '13 at 16:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.