Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

What are these mysterious documents on my hard drive?

I was out of town for the last 3 weeks, so no one was using my home computer, but I left it on anyway. I normally never turn it off, unless I'm rebooting it or moving it. Upon returning home, I woke it up and opened the Finder window, I found 3 mysterious 4kb documents on my hard drive. These were not in my Home folder, but were sitting above the Applications folder in Finder. They weren't there before I left town. All three of them were dated differently. One a month for Sept., Oct., and Nov. Very odd. When I try to open them, I get a message saying, " The document "" could not be opened. You don't have permission. To view or change permissions, select the item in the Finder and choose File>Get Info." So I did this and I got no useful information. I ran a Disk Permission - Repair Permissions and still could not open these documents. I decided to delete them.


Then today, I find there's another one, with the time stated as being Today, 1:36 AM. The others also had early morning hours attached to them too. So it appears to be the exact same sort of thing. What the heck are these documents and why are they suddenly appearing on a monthly basis?

Mac Mini 2 GHz Intel Core 2 Duo, Mac OS X (10.6.8), Logitech mouse, Apple wired keyboard, acer monitor

Posted on Dec 11, 2012 12:37 PM

Reply
27 replies

Jan 24, 2013 7:26 AM in response to John Galt

John, a long time programmer friend helped me with those mystery docs in late-Dec.. He found they were innocuous. He works for Cisco, and formerly for Apple, BT, & Level 3. Since then, I haven't seen anymore showing up. Not sure what he did when he checked out my computer, but he said they were empty documents and my Mac is clean, no infections of any sort.


If they reappear, I'll get back in touch with him as I've known him for 15 years and trust him enough to allow him access to my systems.

Jan 24, 2013 7:51 AM in response to schoodle

Thanks for the update!


I have no doubt the documents are innocuous. Since they appear to be legitimate property list (.plist) files they contain data useful only to whatever it is that created them. It remains a mystery what that was though.


If they reappear have your programmer friend see if he can determine that, and let me know what you find out. In the meantime check your "login items" in System Preferences > Users & Groups. If there is nothing unexpected shown, there are other means of determining what may have generated them as well. I do not believe you have reason to be concerned but I prefer to know what my Macs are doing and why they're doing it.

Feb 27, 2013 6:34 AM in response to schoodle

I've discovered they are being created by certain webpages.

Ah! Then it could be an attempt at a Java attack. Very, very few people need Java enabled in their browsers. With the many current attacks, which includes Macs through Java, you should leave it off at all times.


Open Safari's preferences and click on the Security tab. Turn Java off (leave Javascript on).


See if that cuts these downloads off.

Feb 27, 2013 2:43 PM in response to Kurt Lang

Kurt Lang wrote:


I've discovered they are being created by certain webpages.

Ah! Then it could be an attempt at a Java attack. Very, very few people need Java enabled in their browsers. With the many current attacks, which includes Macs through Java, you should leave it off at all times.


Open Safari's preferences and click on the Security tab. Turn Java off (leave Javascript on).


See if that cuts these downloads off.

Possibly.


I've had Virus Barrier X6 running for over a year now and no Viruses have been detected as yet on my machine. These wierd docs started showing up around Dec. 2012. However, I do need Java to run ScotTrade's Streaming Quotes. I've asked them about this and there's no way around it. I could turn Java off when I don't need to run the Streaming Quotes. Will see if it fixes anything after that.

Feb 27, 2013 6:53 PM in response to schoodle

schoodle wrote:


WZZZ wrote:


And while you're in Safari Preferences, uncheck "Open 'safe' files after downloading".

Done.

WZZZ, I think this fixed it. Will wait a few more days and see if anything happens, but so far, unchecking this seems to have done the trick.

And if so, WOW, was that ever a simple thing no one else thought of.

What are these mysterious documents on my hard drive?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.