How did this ominous file end up in my Application Support folder?

Question

Deleting this file will break the whole internets, for the sake of our children don't do it!.

The above quotation is the content of a text file called STR8369805638PUB6932583035105 that I found today browsing the ~/Library/Application Support using a terminal.

I've found a thread on the Apple forums of somebody having exactly the same issue. It is also discussed on a german forum.

The file is not visible using the Finder, I discovered it because I've done an ls while in ~/Library/Application Support.

This is how the file look in a binary editor, the only odd thing may be that the file ends with a CR (0D) although it's quite recent (it's been created in October):

Does anybody have any idea where this file may come from ?

Answer 1

I found the culprit !

Thanks to the suggestion of @Mark Thalkman I made a DTrace script to monitor applications accessing that file.

The application that creates the file is called AppWrapper. The way I discovered it was to look at the folders created in October in /Library/Application Support. There were only two, appWrapper and eSellerate. So I downloaded AppWrapper again and after launching it the script detected that it was accessing the file.

I'm sure the developer made a mistake and instead of saving the file inside the appWrapper folder he saved it in ~/Library/Application Support.

For those interested, here's the script:

#!/usr/sbin/dtrace -s

\#pragma D option quiet

BEGIN
{
  printf("\n   Timestamp           gid   uid   pid  ppid execname     function           current directory file name\n\n");
}

syscall::open:entry,   
syscall::unlink:entry,  
syscall::rename:entry
/strstr(stringof(copyinstr(arg0)), $1) != NULL/
{
      printf("%Y %5d %5d %5d %5d %-12s %-10s %25s %s\n", walltimestamp, gid, uid, pid, ppid, execname, probefunc, cwd, stringof(copyinstr(arg0)));
}

Answer 2

You might not be able to track the process that wrote that file, but why not try.

Grab a copy of fseventer or search for that filename in the Time Machine spotlight field to see if you can narrow down when it arrived on your Mac.