Ticket Options

Question Details

TICKET ARCHIVE -> Strange File Keeps Being Recreated At Login

helpme@me - Jul 11, 2005 - 2:03 pm

This is a strange one... Every time I restart my computer two files are 're-created' in the Macintosh HD. One is an alias file called "OS 9 Desktop". It includes the second file, "shins.exp". I don't have an OS 9 system on my computer, running 10.4.1. I have searched every log I can think of, but can't see what is creating the file or why it keeps being created - I delete it every time it reappears. I have been unable to find anything searching for invisible files, or searching for files modified today. Looking on the web has turned up absolutely nothing for the file ending ".exp".

I thought this might be the result of a hack, but as far as I can tell the Mac firewall has worked correctly. Looking through the logs, I can see where there have been attempts to ssh into the machine, but none appear to have worked. I haven't installed anything unusual (I have the same software installed on my work Mac, but no "shins.exp"). I am the only person with access to my computer, and root is not enabled.

Thanks for any insight you might have.
- Dave

DeltaMac - Jul 11, 2005 - 3:15 pm

After a little Googling. found some info that could be relevant for you...
The .exp extension is used by Melco embroidery software, also by ICQ chat software, also by QuickBooks. Any of those familiar to you?

The only way that I am aware that an OS 9 Desktop folder will be created, is running a program in Classic that saves a file to the desktop, which will, of course, be the OS 9 desktop. So, if you see that file appear after a reboot, you must be starting Classic to run some software that you have installed.

You say that you don't have OS 9 installed - Do you have a System Folder on your drive? You can easily find out by clicking on the Classic pane in your System Preferences. A set System Folder will show up there....

If you do not see the Classic pref pane in your System Preferences, then I don't have a clue.

Hope this helps, and thanks for using MacOSX.com
- Dale

helpme@me - Jul 11, 2005 - 3:22 pm

Thanks! Yeah, it's strange. I don't have OS 9 / Classic. Never had it installed ever on this Mac. I do have Quickbooks installed, but OS X version only. ICQ ... I wonder if someone has found a way to hack in using ICQ. I found a bunch of Unix executable files in the Application helper/iChat folder that were named like personalities. At the moment I'm completely disconnected from the web at home. I'll take a look tonight to see if the file rebuilds. I'm convinced Unix is doing it, I just don't know where to look to see what process runs at startup to rebuild this file. Sounds a bit like one of the old worms...

maxe01 - Jul 13, 2005 - 8:00 am

Dave,

I'll throw this out there for some things to check. I would check the Keychain to see what is in there an being allowed. You might also check your Login Items under Accounts to see if there is anything in there that might give us a clue. Another wild one would be fonts. If you have recently connected to another system and activated a font from it instead of saving it to your system, it will reconnect every time because your system is looking for that font.

Thanks
maxe01