26

Deleting this file will break the whole internets, for the sake of our children don't do it!.

The above quotation is the content of a text file called STR8369805638PUB6932583035105 that I found today browsing the ~/Library/Application Support using a terminal.

I've found a thread on the Apple forums of somebody having exactly the same issue. It is also discussed on a german forum.

The file is not visible using the Finder, I discovered it because I've done an ls while in ~/Library/Application Support.

This is how the file look in a binary editor, the only odd thing may be that the file ends with a CR (0D) although it's quite recent (it's been created in October):

Binary editor view

Does anybody have any idea where this file may come from ?

9
  • 5
    I'd delete it if I were you.
    – Emil
    Commented Feb 28, 2013 at 15:54
  • 4
    Did you install or run for the first time any particular application in October? One theory: the file may be a sentry file for a program you use. For instance, if you have a time-limited demo of some software, programmers of such tools often need a place (and one well hidden!) to store the date you first ran the program, to know when the evaluation period runs out, when to nag you to register, when to disable functionality if you didn't register, etc. The date on this file may be the important piece of datum, and the contents a joke. Commented Feb 28, 2013 at 16:11
  • Hee hee - hopefully it's some developer having a sense of humor.
    – bmike
    Commented Feb 28, 2013 at 16:11
  • @bmike yeah I expect so, still I'd like to know if somebody has the same file. Commented Feb 28, 2013 at 16:18
  • 4
    If you're a developer then you can use dtrace to find out who is accessing that file. If you don't know dtrace it is an awesome tool for finding out what is going on at the system level.
    – Ɱark Ƭ
    Commented Feb 28, 2013 at 16:42

2 Answers 2

20

I found the culprit !

Thanks to the suggestion of @Mark Thalkman I made a DTrace script to monitor applications accessing that file.

The application that creates the file is called AppWrapper. The way I discovered it was to look at the folders created in October in /Library/Application Support. There were only two, appWrapper and eSellerate. So I downloaded AppWrapper again and after launching it the script detected that it was accessing the file.

I'm sure the developer made a mistake and instead of saving the file inside the appWrapper folder he saved it in ~/Library/Application Support.

For those interested, here's the script:

#!/usr/sbin/dtrace -s

\#pragma D option quiet

BEGIN
{
  printf("\n   Timestamp           gid   uid   pid  ppid execname     function           current directory file name\n\n");
}

syscall::open:entry,   
syscall::unlink:entry,  
syscall::rename:entry
/strstr(stringof(copyinstr(arg0)), $1) != NULL/
{
      printf("%Y %5d %5d %5d %5d %-12s %-10s %25s %s\n", walltimestamp, gid, uid, pid, ppid, execname, probefunc, cwd, stringof(copyinstr(arg0)));
}
4
  • 5
    .. and the question for the more curious now is: what does it need that file for? Commented Feb 28, 2013 at 17:17
  • 1
    I was curious about this so I emailed them to see if they might shed any light onto this file. They were very vague:
    – Tony
    Commented Mar 2, 2013 at 18:37
  • Dear Tony, My name is Sam Rowlands and I’m one of the developers here at Ohanaware, thank you for your e-mail. I apologize for the delayed response to your e-mail. The file in question is part of our registration system, deleting it may cause issues with the registration of App Wrapper. Thanks for supporting Ohanaware and our software. Sam Rowlands
    – Tony
    Commented Mar 2, 2013 at 18:38
  • 1
    Ironically, part of App Wrapper's functionality is to simplify sandboxing applications for the MAS!
    – Tuesday
    Commented Mar 5, 2013 at 23:23
9

You might not be able to track the process that wrote that file, but why not try.

Grab a copy of fseventer or search for that filename in the Time Machine spotlight field to see if you can narrow down when it arrived on your Mac.

1
  • 1
    Time Machine is a good suggestion, unfortunately it's not setup on the machine where I found this file. Commented Feb 28, 2013 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .