I'm running OSX 10.11.3 and I keep finding files named /xEy4O all over my file system. I've opened them in a text editor and they are completely empty. So they appear to be a marker file of some sort. If I list directory contents in the console the name is actually :xEy4O. I can run find / -name ':xEy4O' the files only seem to be located in directories I've opened at some point but I don't know which application is putting them there.

Also, the files seem to be confined to my home directory and it's subdirectories. I'm thinking it isn't a virus, but I'm not sure what it actually is.

Here's the output from find:

/Applications/IntelliJ IDEA 15 CE.app/Contents/bin/:xEy4O
find: /dev/fd/3: Not a directory
find: /dev/fd/4: Not a directory
/Users/hammer/Library/Application Support/MobileSync/Backup/e1509ec4913dcca752e7dc0579fc6a1320cab6d2/:xEy4O

I keep deleting the files when I find them but is there someway to determine the process that's creating them? Maybe a way to get a notification when a file is created?

2 Answers 2


Open terminal.app (Applications -> Utilities -> Terminal or via Spotlight) and issue this command: sudo fs_usage | grep [path_to_file]. Path_to_file may be to any of your found 'xEy40' files. See, if it'll show anything.

  • Thanks! I'll run that until I get a hit. It's just the kind of thing I was looking for. Feb 3, 2016 at 16:07
  • 1
    So the issue was a line in my .bash_profile that was setting an environment variable for an Akka application secret. I had added it to my .bash_profile as part of learning Akka. It included an > character which it interpreted as an output redirector - that's what was creating the file. The file was created every time I opened a new terminal window. Feb 3, 2016 at 16:37

If you have Xcode installed, you can use Instruments.app (Apple documentation

You can use this command to launch it

open /Applications/Xcode.app/Contents/Applications/Instruments.app

Once opened, this application can monitor all processes on your machine for file reads, writes, and locks, among other things. There is a template called File Activity that you can use which will allow you to monitor all file activity on the system. You can use filtering to find the creation of your odd file, and the process that created it. Good luck!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .