6723187 ...erm...

Discussion in 'macOS' started by mkrishnan, Jun 12, 2006.

  1. mkrishnan Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #1
    Okay, this is a bit of a strange one....

    In my ~/library/application support/ I have an executable file called 6723187 with no extension. It's not in a sub-folder. It is dated 5/10/06, is 4kb long, and I have no idea how it got there.

    Anyone know what it is? Google searching "6723187" was non-informative. :(
     
  2. iGary Guest

    iGary

    Joined:
    May 26, 2004
    Location:
    Randy's House
    #2
    Your machine is about to self destruct. That is the destruct code.
     
  3. mkrishnan thread starter Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #3
    See, you're not the only one that can post insane random threads, babe! :)
     
  4. plinden macrumors 68040

    plinden

    Joined:
    Apr 8, 2004
  5. Blue Velvet Moderator emeritus

    Joined:
    Jul 4, 2004
  6. mkrishnan thread starter Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #6
    [​IMG]

    Ermm...I'm not sure I'ma gonna run it. :eek:

    Don't get me wrong... note my miserable failure to start this thread with "OMG I FOUND THE !ST MACOS ViRuS!!!!!111111oneoneoneoneeleveneleven". ;)
     
  7. balamw Moderator

    balamw

    Staff Member

    Joined:
    Aug 16, 2005
    Location:
    New England
    #7
    If you're really curious, open Terminal and run the following

    Code:
    strings ~/library/application support/6723187* | less
    That'll show you any embedded strings longer than a few characters which might help you track it down.

    B
     
  8. UKnjb macrumors 6502a

    UKnjb

    Joined:
    May 23, 2005
    Location:
    London, UK
    #8
    Isn't that the up-dated file that supersedes 6723186?

    Helluva programme and from where did you rip it? US government restricted and all ---- :cool:
     
  9. Mitthrawnuruodo Moderator emeritus

    Mitthrawnuruodo

    Joined:
    Mar 10, 2004
    Location:
    Bergen, Norway
    #9
    You got anything else (especially applications) with that same date?
     
  10. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #10
    Did someone call me? I saw the Oh Snap spotlight against the cloudy night sky!

    For what it's worth..

    Code:
    -rwxrwxrwx    1 yellow  yellow    121 Mar 23 15:32 814379*
    Yours is bigger than mine. :(

    Anyway.. it's just text, at least mine is:

    Code:
    [null:~/Library/Application Support]yellow% file 814379 
    814379: ASCII text
    [null:~/Library/Application Support] yellow% more 814379 
    CIA_USB_MONITOR=/Library/Frameworks/HPServicesInterface.framework/Runtime/hpusbmond
    
    ${CIA_USB_MONITOR} FROM_INSTALLER &
    
    Looks like HyperPieceofshit strikes again? Or is the CIA after us again?
     
  11. mkrishnan thread starter Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #11
    Do you really have a file like that?

    P.S. Thanks for the strings suggestion. I suppose I should've just more'd it. It's a script file!

    So it just looks for the existence of a running browser process, basically.

    I wonder what uses it. I don't see any apps with similar dates. I guess it could be part of FreePOPs. But then I should have been able to find out about it by googling...also it's strange of them to give weird names like this to their files. Hmmm...
     
  12. Mitthrawnuruodo Moderator emeritus

    Mitthrawnuruodo

    Joined:
    Mar 10, 2004
    Location:
    Bergen, Norway
    #12
    Did you install Flash, Shockwave, Flip4Mac or any other plugins about that date?

    Many of those want to quit all browsers as part of the install procedure...
     
  13. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #13
    I do, though apparently our contents are quite different.
     
  14. mkrishnan thread starter Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #14
    That's certainly a possibility. Oh, well, seems innocuous enough. I'll just delete it. :p Unlikely that anything is depending critically on it....It was probably just a temp script that didn't get deleted.

    Thank you everyone for the help! :)
     
  15. Makosuke macrumors 603

    Joined:
    Aug 15, 2001
    Location:
    The Cool Part of CA, USA
    #15
    Note that if it's browser-related, it might intentionally use a random string as its name. I seem to remember that some browser files use random naming schemes to prevent attacks that rely on the specific location of a file from functioning.

    Totally random guess, though, and obviously "security through obscurity" only gets you so far--more of a "just so everybodys' isn't the same", I think.
     
  16. AvSRoCkCO1067 macrumors 65816

    AvSRoCkCO1067

    Joined:
    Sep 6, 2005
    Location:
    CO
    #16
    THAT WAS THE SAME CODE ON THE HATCH IN LOST!!!





    ...just kidding ;) .
     

Share This Page