Breadcrumbs

i get that also.. as well as a folder called "ImageDebug" containing the file "AutoPosToneMap.txt". this seems to have something to do with HP printer software. there is a game for Windoze called MaglevExpress, but i have never played or installed it so i don't know why these files appear. knowing how terrible HP is at squashing bugs and software vulnerabilities i'm thinking this could easily be a virus or something getting in via the HP software, then giving itself that game name to try and look innocuous. if anyone has any info please post.

What's lying around your Mac?

Well, lots of stuff. Some supplied with the OS distribution like large numbers of languages, fonts, and device drivers, including a huge number of printer and scanner drivers. Some accumulated by the OS during normal --and not-so-normal-- operations: temporary files, logs, crash reports. Application software stores stuff on your disk, too. Many, maybe most users are completely unaware of any of this stuff, and that's fine.

Then there's your stuff. It accumulates. Sometimes it goes in unexpected places. I _never_ use my "home" folder (e.g. Documents) for storing my work files, but I slip up too frequently and every so often I find I've accepted the default app save location and I need to rescue my files from there.

When you say, "on my HD" do you mean at the root (top) level, or buried in the folder heirarchy? If so, where?

One new wrinkle in MacOS 10.7 is the autosave feature. I've noticed more than once opening new window in a standard app, pasting something into it, then completely forgetting about it. After my weekly site maintenance reboot, I'm surprised to find the "untitled" document on the desktop exactly as I left it. It is a bit eerie, but ultimately what I'd hope for... I think.

My first suggestion to you is to observe over time what's happening -- where you might have put stuff and where it turns up later.

Check your apps settings, particularly of browsers. Where do they put temporary files?

Do you locate these unexpected files during Finder searches? I'm not sure, but I think Finder Search looks inside compressed files, which I somehow imagine should be invisible to searches. In some cases, I've copied a very old archive made on a PC to my Mac, expanded it, forgotten about it entirely, and later I get some very unexpected finds, things like dlls.

It is really good to be aware of what should be where on your computer, in terms of security and being able to find important stuff. So I'm glad to see questions like this. But if you look, be prepared to discriminate between "unexpected" and "suspicious". Yeah, that's yet more to do.

Oh, and remember: "Google is your friend." I just searched and found a posting to the effect that "maglevexpress" is part of the Trainz simulator game. Does that ring a bell?

HTH

it's NOT the maglev game. i searched around on the web and other people do have this same problem, and NONE of us have installed that game. it's very suspicious. i have spent a lot of time tracking down files and things like this that pop up some time, so i'm used to the usual mac os x stuff. this is not that. these files definitely come from the HP printer software. and why would HP name them after a game? i contacted HP support and they said the same thing you did - it's from the game. but IT'S NOT FROM THE GAME. probably someone named them like the game to make people think that, but they most likely are something bad that snuck in via a hole in the HP software.

when someone figures out what worm or spyware or whatever these files come from i'd love to see a removal solution.

There are no Mac viruses, and no known Mac malware that behaves in that manner (creating that folder). See my Mac Malware Guide for more info:

http://www.reedcorner.net/guides/macvirus/

(This page has links that promote my services, and should not be taken as endorsement of those services by Apple.)

Are any of these files Mac executables?

Where are you finding them?

Can you see any pattern to the file dates? Compared them to similar drivers that come with the installation?

Have you tried to match the files you are finding with an "official" download of the HP driver? It would be interesting to know if the unexpected files comprise a complete set.

Have you run comprehensive disk diagnostics recently? It is conceivable that you've got some scrambling on your HD which causes some or all of file "B" to appear in file "A". (Full disclosure: I've only seen such things in the dim past on PC's, but I guess it is possible on a Mac.)

I've never heard of a hacking exploit on individual Macs, period, and certainly not one that does something like this, though of course it is conceivable. (I have seen large directories with camouflaged names added to a poorly-secured website I manage <red face>, but the hole would likely be very different.)

Some people strongly recommend monitoring and accounting for all outgoing IP packet traffic from your machine as a security measure. I've heard "Little Snitch" recommended:

http://www.obdev.at/products/littlesnitch/index.html

but I can't say much about it.

It would help if you were to say how you stumbled on this stuff. There are many hidden (and not-so-hidden) files and folders on your Mac. There are cache files that store things like recently visited web sites, OS-level cache files, temporary folders where apps store things that will get moved to the trash on reboot, local backups stored on the boot drive on a laptop with Time Machine turned on, etc. Most likely, all the things you're cursing about are normal.

sorry, i've posted in several places and can't recall where i posted the details.

several other people have posted about this same issue.

the files show up in the trash after a reboot, and after an HP printer was used. i've spoken with HP support and they don't know what they are but they don't think they are virii or anything since it doesn't match anything they've heard of. probably it's just one of those weird things...

Anything that shows up in the trash after a reboot, in a folder called Recovered Items (or something like that), was in the temporary folder before the reboot. What program put it there, I don't know, but it's normal for that stuff to be moved to the trash. If an app had put an auto-saved document in there, for example, you'd want to get it back after a crash.

it's definitely HP printer software putting these empty directories there (files HP doesn't know what they are, and files named after some game i've never heard of or had installed), so it is certainly strange. but no one seems to think it's harmful so, what can i do but live with it.