How do you find out what application is generating a plist file in your preference folder?

Question

Level 1

0 points

How do you find out what application is generating a plist file in your preference folder?

I have had two similar warnings come up in Drive Genius 3, a program that I use to manage my drives. The warnings occur during a daily verification of preferences on my main drive, a 256GB SSD.

They state:

"The preference file at '/Users/me/Library/Preferences/com.analogsolutions.Football.plist' may be corrupted."

"The preference file at '/Users/me/Library/Preferences/org.machinedevelop.National.plist' may be corrupted."

Per Drive Genius' advisement, "Corrupted files can cause appplication crashes and should be moved to the Trash." I delete the files, however they are regenerated each day.

Q: How do you figure out what application is generating a preference file? And is there a way to tell if this is a OS generated preference file?

I have searched online and cannot find any information about either Analog Solutions or Machine Develop nor am I able to discern what these particular .plist files are for...

Q: Are these two .plist files truly potentially harmful?

Thanks for the Help!

iMac

model iMac12,2

3.4 GHz Intel Core i7

8 GB 1333 MHz DDR3

iMac, Mac OS X (10.6.8)

Posted on Aug 1, 2011 2:07 AM

Reply

Answer 1

Aug 1, 2011 4:42 AM in response to oiran

They're not going to harm anything other than the apps they belong to.

If they're being regenerated, the apps must still be on your Mac. One is fairly obviously a Football game, though a search for analog solutions doesn't bring up any games developers.

No idea what the other could be, but a search of your applications folder should give you some clue. Presumably they're apps you've downloaded (certainly not Apple apps), so you should have some clue as to what they are?

Either way, I wouldn't worry about them, as they're unlikely to cause you any problems.

Reply

Answer 2

oiran Author

Level 1

0 points

Aug 1, 2011 5:37 AM in response to noondaywitch

Thanks for the response.

However, I don't have any games installed on my machine, other than the Apple pre-installed Chess. Certainly not any Football games...

Any other ideas? Or ways to figure out what program is generating these files?

Thx.

Reply

Answer 3

X423424X

Level 6

14,265 points

Aug 1, 2011 12:11 PM in response to oiran

I delete the files, however they are regenerated each day.

Look in your Accounts preferences' login items and see if there's something being launched that might account for your problem.

If there's nothing there look in the following directories:

~/LibraryLaunchAgents (~ is your home directory)

/LibraryLaunchAgents

/Library/ User uploaded file StartupItems

You might also take a look at your Activity Monitor to see if anything in there "rings a bell".

Reply

Answer 4

oiran Author

Level 1

0 points

Aug 1, 2011 8:31 PM in response to X423424X

X423424X wrote:

Look in your Accounts preferences' login items and see if there's something being launched that might account for your problem.

If there's nothing there look in the following directories:

~/LibraryLaunchAgents (~ is your home directory)

/LibraryLaunchAgents

/Library/StartupItems

You might also take a look at your Activity Monitor to see if anything in there "rings a bell".

Thank you X423424X

I went through all the steps you sugested, but still no luck 😟

Nothing was out of line with my array of apps or seemed to be the potential mystery app culprit...

I am "watching" my Preferences folder in hopes of identifying something that I do, or open that causes the plist to generate.

I heard back from ProSoft (makers of Drive Genius 3) support today, they said, "Technically, the file may not be 'corrupt', but Drive Genius is simply reporting that it found a .plist file that is not 'well-formed'." Still, it bothers me all the same that I cannot figure out what application or process is causing this because their "warning signal" goes off every day and I cannot tell if it is this or something else so I have to go check it.

Reply

Answer 5

X423424X

Level 6

14,265 points

Aug 1, 2011 8:44 PM in response to oiran

Ok, can you double click the .plist file? If so it should attempt to launch the Property List Editor (in your Utilities folder). That way you can look at stuff in the plist. Maybe (hopefully) there's something in there that can shed some light on who is creating it.

If Property List Editor cannot open the file (some apps create files that have the .plist extension but don't actually create the proper XML format -- probably what ProSoft was alluding to) then try opening it with a text editor.

Reply

Answer 6

Linc Davis

Level 10

209,547 points

Aug 1, 2011 9:12 PM in response to oiran

Those files have been given obfuscated names so you won't know what created them. They must contain encrypted registration data for some third-party commercial software that you use.

It should be fairly easy to find out what application is creating them, if you really care. Move the files to the Desktop, then log out. Log back in while holding the shift key as you click the "Log In" button. That will prevent your login items from loading, among other things. Open your account preferences and launch the login items one at a time by double-clicking them in the list. After each one, check to see whether the files have been recreated.

Reply

Answer 7

X423424X

Level 6

14,265 points

Aug 1, 2011 10:07 PM in response to Linc Davis

They must contain encrypted registration data

You don't know that until he actually looks at the stuff which is what I asked him to do.

Reply

Answer 8

X423424X

Level 6

14,265 points

Aug 1, 2011 10:12 PM in response to X423424X

Another thought, lock the plists on the hope that whatever is using them will "choke" and complain about it (no guarantee that will work but worth a try).

Also, I don't recall if I asked this but if those plists are deleted while logged in will they be recreated during that same login session. Or do they only appear after you deleted them and then and then logged out and back in? Or do you have to reboot to recreate them?

Reply

Answer 9

Pondini

Level 8

38,863 points

Aug 2, 2011 4:59 PM in response to oiran

You may want to find out what apps they'e connected with, but don't worry about the message.

Apple has defined a couple of recommended formats for plists; all Apple apps are supposed to use them, and most 3rd-party apps do, but it's not a requirement. If the app (whatever it is) works properly, but uses a different format, it's not a problem.

Reply

Answer 10

X423424X

Level 6

14,265 points

Aug 2, 2011 5:14 PM in response to Pondini

His problem is not with the plists themselves but who is creating them.

Reply

Answer 11

Pondini

Level 8

38,863 points

Aug 2, 2011 5:21 PM in response to X423424X

As posted, finding out where they come from is one thing, but the warnings (mentioned twice in the first paragraph) are not necessarily a problem.

Reply

Answer 12

oiran Author

Level 1

0 points

Aug 9, 2011 11:25 AM in response to X423424X

Hi Everyone, sorry for the late response. I have been monitoring my Preferences Folder; every moment I am on my computer trying to catch what application/process generates these files. I was hoping to try your suggestions, but oddly enough the offensive .plist files have not returned since the last time I deleted them about a week ago.... strange...

In any case, I have responded to some of your suggestions and questions that I have information on:

X423424X wrote:

Ok, can you double click the .plist file? If so it should attempt to launch the Property List Editor (in your Utilities folder). That way you can look at stuff in the plist. Maybe (hopefully) there's something in there that can shed some light on who is creating it.

If Property List Editor cannot open the file (some apps create files that have the .plist extension but don't actually create the proper XML format -- probably what ProSoft was alluding to) then try opening it with a text editor.

The .plist file when opened in text editor contains a string of (what to me seems to be) an arbitrary list of numbers.

Linc Davis wrote:

Those files have been given obfuscated names so you won't know what created them. They must contain encrypted registration data for some third-party commercial software that you use.

Yes, seems likely...

Linc Davis wrote:

It should be fairly easy to find out what application is creating them, if you really care. Move the files to the Desktop, then log out. Log back in while holding the shift key as you click the "Log In" button. That will prevent your login items from loading, among other things. Open your account preferences and launch the login items one at a time by double-clicking them in the list. After each one, check to see whether the files have been recreated.

Ran through login, one by one, no luck in identifying the application(s).

X423424X wrote:

Another thought, lock the plists on the hope that whatever is using them will "choke" and complain about it (no guarantee that will work but worth a try).

Thanks, the lock idea is the one I will try next if they ever reappear...

X423424X wrote:

Also, I don't recall if I asked this but if those plists are deleted while logged in will they be recreated during that same login session. Or do they only appear after you deleted them and then and then logged out and back in? Or do you have to reboot to recreate them?

Unfortunately I do not know for certain. Though from all my login/startup/reboot tests I believe that they are not directly linked to starting up the machine or loging in either.

I'm not really certain why the .plist have not returned. I haven't uninstalled any programs, though I did run a couple updates for some widgets within the last week; however that was about 3 days after I deleted the last set of .plist files and usually they reappered everyday. In any case, given that they have not been regenerated I guess my problem is solved per se, at least I am no longer getting that annoying warning everyday. Still, it's a bit of a mystery 😉

Thanks again for all the help!

Reply

Answer 13

Jan 4, 2014 12:54 PM in response to oiran

Any resolution on this? I'm having the exact same thing: Drive Genius 3 is telling me about corrupted plist files that have obfuscated names. I have deleted them once, but they've returned two days ago. Plist editors haven't been a help. I simply wish to know what is creating these files. I'll try some of the above suggestions, but I was hoping there was a way to see some cache or log of their creation. Console has a big blackout gap of about 6-7 hours during the time some of my offending plists were created.

Reply