command < > $ say -v Whisper "i can see you"

[DeepThought42.0]

Okay.... This is not a virus. It is the execution of a creepy command that magically appeared on my computer. Thank you everyone!

I recently purchased a new mac 10.8.3 and synced my applications from my old mac 10.6.8. I did it wirelessly (mistake) and it got stuck, overheated my old comp... blah blah. I gave my new comp a fresh boot and then synced applications with ethernet cable. Great.... except now my old comp started to say "I CAN SEE YOU" in the whisper voice of ... simple text was it called? Its creeping me out!!! Especially with the potential of some dude watching me... not cool. I mean the green light by my camera does not come on but its still unnerving.

Anyways, I have noticed that opening terminal triggers it. If I keep terminal opened and close a window opening a new window triggers it. I have bootcamp running so maybe its coming over from that side? I typed in netstat -n and... I'm not great with all of this. Did I do that to see if there is an ip address that looks sketchy? Because if so then there is? There is one that looks like my ip address and ends with various 5-digit numbers. Then there is one I do not recognize that looks like "2601::9c00:65:e6" and then .5-digits.

I found this command < > $ say -v Whisper "i can see you" > results in the same voice. Would the person be using this command? Could I search for this particular command in my computer or something to see what its attached to?

I requested a disk to reinstall os x from apple when i told them about this and they are sending me one. Thanks apple! But I also want to figure this out... I have everything backed up just in case. Please help!

 

[Stetrain]

Did you purchase this computer completely new? Or was it used?

If it was used it sounds like some sort of silly script set up by the previous owner.

Even if it was purchased new I guess it could be one that somebody bought and returned.

Definitely do a clean install of OSX. If it's a new machine it should have a restore partition built in (CMD-R on startup), no need to order install disks.

Edit: Your description sounds like somebody set up a command to run every time a terminal window is opened. This thread describes where to go to change that setting: http://forums.macrumors.com/showthread.php?t=999409

I would still recommend a clean install, who knows what the previous owner tinkered with or installed.

 

[GGJstudios]

It's definitely not a virus, since no Mac OS X virus has ever existed in the wild. As Stetrain suggested, a clean install should resolve your issue.

Mac Virus/Malware FAQ​

 

[brand]

Does the sound persist when you log in with a different user account?

 

[dastinger]

Could you record the sound, please? I'm really curious.

 

[DeepThought42.0]

I am going to make a new user account and try that. Thanks.

I checked the way that person from the other thread added the script to make his computer background his screen saver when terminal opens. Thank you. That's a start for sure. It adds the command at the opening of terminal but does not provide a list of the commands that were already set up to do so...

So, this computer has been mine for about 5 years and has never done this before. It only did this after the applications sync with the brand new mac. The new mac does not do this.

In order to hear exactly what it sounds like go into terminal and type

> $ say -v Whisper "i can see you"

Creeptastic!

That's exactly what it sounds like. I was looking for it and found a way to make my own computer do this. Thats why i was wondering if there's a way to search all scripts found on my computer for this particular command.

Is there a way to record your own computer screen? Like screen shot but video with sound? hmm.....

Yes there are mac trojans... sorry. Whatever it is I don't want it. Also, I am running bootcamp. I have windows 7 on a different partition of my computer, which could get a virus virus. Usually, the viruses do not "jump over" to the mac side. But, I think its possible? Not sure.

 

[DeepThought42.0]

Video

Figured out how to record the screen so the file is attached (won't let me upload .mov file so zipped). Also, I created an other user and on the other user terminal does NOT trigger this. What does this mean? Thanks. If you guys want an other file format or something please request.

 

[GGJstudios]

I have windows 7 on a different partition of my computer, which could get a virus virus. Usually, the viruses do not "jump over" to the mac side. But, I think its possible? Not sure.

It's definitely not possible, since no Windows app, including malware, can run in OS X.

 

[Queen6]

Sounds to me like some one is "playing" with you, left your Mac alone recently wouldn't take more than a couple of minutes to set something like this up...

 

[bill-p]

You know you can actually use the "say" command to send a voice to someone on the network, right?

You just need to know their network address. It's not a virus. It's just a message.

So someone on the same network as you can definitely mess with you by sending that command to you. Were you on company's network or school's network when this happened?

 

[DeepThought42.0]

Yeah, I have the say command listed up top of the thread but the thing is no... I was at home and my roomate only knows PCs- as in how to play StarCraft on them. He would have absolutely no clue how to do this. I was on my home network at home and was waiting for about 20 hours for my applications to transfer from this old mac to a brand new mac. I did it wirelessly and it failed because the connection got cut off. I called apple when it was stuck at 3 minutes for 4 hours. I didn't want to disrupt it and loose all of my apps or something but they told me to just shut them both off manually and start the new mac with a fresh boot of mountain lion. When I opened my old mac this started happening. It hasn't done much of anything else that is strange so yes it seems like some small joke played on me... but by whom? Could someone in my neighborhood have gained access to that IP address while the apps were transferring? I don't know anyone in my area. Should I change my internet password or is that not the issue? I want to keep things shady Thanks guys!

 

[fortysomegeek]

You know you can actually use the "say" command to send a voice to someone on the network, right?

You just need to know their network address. It's not a virus. It's just a message.

So someone on the same network as you can definitely mess with you by sending that command to you. Were you on company's network or school's network when this happened?

Yep. I do this all the time. I ssh from my iPad to any of my macs to scare the kids. If they're not doing their homework, the computer talks to them. My son thinks my computer is haunted so he doesn't mess with them. I know I'm cruel but it was funnny.

 

[DeepThought42.0]

So, does anyone know how to search for a single command on your computer? I figure if I search for the "say" command then it should be somewhere on my computer? A disc reader or something?

And to fotysomegeek- Hahahahahahah. That's awesome.

 

[priitv8]

So, does anyone know how to search for a single command on your computer? I figure if I search for the "say" command then it should be somewhere on my computer?

If you issue on command line

which say

you will see the location where this program resides.

/usr/bin/say

You can look around in the same folder and you'll find a huge amount of usable programs (commands).
which requires you to know command name beforehand.
If you want to scan the whole disk, you'd be better off with the find command.

 

[DeepThought42.0]

----- which say -v Whisper "i can see you"

lead me to --- /usr/bin/say

I opened up the say command in text edit and its a bunch of gobbledy gook. Theres an com.apple.say G file in it. would this be something? Thanks.

 

[leman]

Most likely someone played a joke on you and added that command into one of your startup files. Look for the files ".bash_profile", ".bash_login", ".profile" or ".bashrc" in your home directiry (these files are hidden so make sure you use some tool that can show you hidden files)

See also
http://hayne.net/MacDev/Notes/unixFAQ.html#shellStartup

 

[chown33]

I opened up the say command in text edit and its a bunch of gobbledy gook. Theres an com.apple.say G file in it. would this be something? Thanks.

There's no reason to open the say command in Text Edit. Doing so will tell you nothing. It wouldn't even tell me anything, and I've been a programmer for over 20 years.


You should take leman's suggestion and list what's in your home directory. To do this, copy and paste this command into a Terminal window:

ls -la ~

Then select the entire output text, and copy and paste it into a reply post here. We need to see exactly what's in your home directory, and the above command is the simplest and most complete way to do it.

It's important that you copy and paste commands exactly as given. Accuracy is important, and getting some commands even slightly wrong can have large consequences.

Once we know what's in your home directory, we can take the next step. But without knowing exactly what's there, all anyone can do is guess or provide vague generalities. Guessing is almost never a good strategy, and since you're not a programmer, vague generalities are insufficiently specific guidance.

----------

Yep. I do this all the time. I ssh from my iPad to any of my macs to scare the kids. If they're not doing their homework, the computer talks to them. My son thinks my computer is haunted so he doesn't mess with them. I know I'm cruel but it was funnny.

You presumably enabled remote login via ssh on the Macs beforehand. I'm not aware of any way to send messages, especially ones containing shell commands, from a remote system unless specific action is taken on the receiving computer first.

So while I admire your prank, unless something is enabled on the OP's computer that allows remote logins, it's more likely that the 'say' command is in one of the shell startup files. Especially since it only happens when a new Terminal window is opened, which is normally the only time a shell startup script is run.

 

[old-wiz]

you can always rename the say command to something like "realsay"

 

[DeepThought42.0]

Home directory

Here is a list from my home directory using "ls -la ~". Earlier when I wrote text edit I meant to write terminal. Sorry for the confusion. Changing the command to realsay sounds like it would work. I will do this if I can't find the file. Thank you!!!

total 1624
-rw-r--r-- 1 MissDefy staff 13 May 21 14:28 $
drwxr-xr-x+ 33 MissDefy staff 1122 May 21 17:52 .
drwxr-xr-x 6 root admin 204 May 21 00:38 ..
-rw------- 1 MissDefy staff 3 Oct 14 2011 .CFUserTextEncoding
-rw-r--r--@ 1 MissDefy staff 24580 May 22 2013 .DS_Store
drwx------ 2 MissDefy staff 68 May 21 17:53 .Trash
-rw------- 1 MissDefy staff 312 May 21 17:52 .Xauthority
-rw------- 1 MissDefy staff 14281 May 21 17:52 .bash_history
-rw-r--r-- 1 MissDefy staff 90 Aug 24 2012 .cim_install_log
drwx------ 3 MissDefy staff 102 Aug 25 2011 .cups
drwx------ 16 MissDefy staff 544 May 22 2013 .dropbox
drwxr-xr-x 3 MissDefy staff 102 May 21 17:52 .fontconfig
drwxr-xr-x 3 MissDefy staff 102 Aug 21 2012 .matlab
drwxr-xr-x 6 MissDefy staff 204 Oct 24 2012 .network_backups
-rw------- 1 MissDefy staff 135 May 22 2013 .profile
-rw------- 1 MissDefy staff 80 May 21 17:52 .serverauth.1041
drwxr-xr-x 3 MissDefy staff 102 Jul 19 2011 .ssh
drwxr-xr-x@ 4 MissDefy staff 136 Feb 18 05:07 ACUVE_color_files
drwx------+ 30 MissDefy staff 1020 May 21 17:53 Desktop
drwx------+ 10 MissDefy staff 340 Nov 15 2012 Documents
drwx------+ 465 MissDefy staff 15810 May 21 2013 Downloads
drwx------@ 9 MissDefy staff 306 May 22 2013 Dropbox
drwxr-xr-x 5 MissDefy staff 170 May 18 16:44 Gamez
drwx------+ 42 MissDefy staff 1428 May 19 23:33 Library
drwx------+ 35 MissDefy staff 1190 May 21 01:02 Movies
drwx------+ 31 MissDefy staff 1054 May 18 16:06 Music
drwx------+ 28 MissDefy staff 952 May 21 01:38 Pictures
drwxr-xr-x+ 6 MissDefy staff 204 Aug 1 2011 Public
drwxr-xr-x 29 MissDefy staff 986 May 3 13:43 Random
drwxr-xr-x+ 6 MissDefy staff 204 Aug 1 2011 Sites
drwxr-xr-x 14 MissDefy staff 476 May 21 2013 Work
drwxr-xr-x 3 MissDefy staff 102 Apr 26 17:36 matlab
-rw-r--r-- 1 MissDefy staff 758066 May 18 05:26 strings.txt

 

[chown33]

The only shell startup file I see in that listing is ".profile". So do this command:

cat ~/.profile

and copy/paste the complete output into a reply post.

Earlier when I wrote text edit I meant to write terminal. Sorry for the confusion.

Well, I don't see how opening it in Terminal would give any useful information, either. The 'say' command itself is not the problem. It's completely harmless. The problem is that some other file is running the 'say' command, and we have to find that file with that command invocation. In short, the problem isn't the 'say' command itself, the problem is where the 'say' command is being used.


By the way, what were the results of creating another account, as suggested in post #4, and acknowledged by you in post #6?

If you haven't done that yet, please do and post the results (i.e. whether you get the same voice when opening a Terminal window using that account).

 

[DeepThought42.0]

The results of cat ~/.profile

say -v w i can see you

# FSL Setup
FSLDIR=/usr/local/fsl
PATH=${FSLDIR}/bin:${PATH}
export FSLDIR PATH
. ${FSLDIR}/etc/fslconf/fsl.sh
*******-MacBook-Pro:~ MissDefy$

Yaaaaaay! And the other user account did not result in the same issue. Thank you!!!!!!!!!!!

Okay, I understand what you mean about the say command. Someone told me to write which say in order to find where the file resides and I thought they meant that maybe the "i can see you command" was within that file but it was just the say file for that command. So that file is just for executing the say command. Thank you!!!!!!!!!!!!!!!!!

I am still a bit confused about how this file got there. Could someone have put it there without physically accessing my computer through my ip address?? Thank you chown33. You are a God.

Also, can I give you special credit or something for resolving my issue? _ _ _ <3 <3 <3 <3 <3 <3 _ _ _

 

[chown33]

You might be able to delete it, but first do this:

ls -la /usr/local/fsl/bin

and post the complete output.

Do the same for this command:

ls -ld /usr/local/fsl/etc/fslconf/fsl.sh

(I think that's right, but if you get an error message instead of a listing, post the error message and I'll try again.)

Also please post:
1. Exactly which Mac model this is.
2. Exactly which OS X version it's running.

A command-line for #1 is this:

sysctl hw.model

The OS X version is best obtained from the About This Mac menu-item under the menu.


I'm asking mostly because you referred to it as "my old mac", and it helps to know what it is when evaluating what the command output is. It seems like it might have been customized to some degree, because this command:

say -v w i can see you

doesn't work on any standard OS install of Tiger or later. At a minimum, someone added a voice named "w" that's apparently an alias for the voice named "Whisper".


EDIT
Also post the output of this command:

date

A closer look at the listing of 'ls -la ~' has me puzzling over a few details.

EDIT #2
The strikeout is wrong. A voicename of "w" works on at least 10.6+, but not on 10.4 Tiger.

 

[DeepThought42.0]

Outputs

Here are the outputs.... Ya Its not that old. My bad.

********s-MacBook-Pro:~ MissDefy$ sysctl hw.model
hw.model: MacBookPro8,2

OS X Version 10.6.8

********s-MacBook-Pro:~ MissDefy$ date
Thu May 23 02:19:38 EDT 2013


********s-MacBook-Pro:~ MissDefy$ ls -ld /usr/local/fsl/etc/fslconf/fsl.sh
-rw-r--r-- 1 root wheel 2056 May 10 05:53 /usr/local/fsl/etc/fslconf/fsl.sh


******s-MacBook-Pro:~ MissDefy$ ls -la /usr/local/fsl/bin
total 1359088
drwxr-xr-x 289 root wheel 9826 May 9 13:02 .
drwxr-xr-x 17 root wheel 578 May 9 12:18 ..
-rwxrwxr-x 1 root wheel 6222 Dec 3 18:39 AnatomicalAverage
lrwxr-xr-x 1 root wheel 6 May 9 12:38 ApplyXFM_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:56 Asl_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:32 Bet_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:38 ConcatXFM_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:33 Fast_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:53 Fdt_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:35 Feat_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:35 Featquery_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:38 Flirt_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:49 Fsl_prepare_fieldmap_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:35 Glm_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:38 InvertXFM_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:37 Make_flobs_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:44 Melodic_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:38 Nudge_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:35 Pnm_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:55 Possum_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:35 Renderhighres_gui -> Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:45 Renderstats_gui -> Runtcl
-rwxrwxr-x 1 root wheel 1075 Feb 16 2009 Runtcl
lrwxr-xr-x 1 root wheel 6 May 9 12:46 Susan_gui -> Runtcl
-rwxrwxr-x 1 root wheel 3692 May 9 12:04 Text2Vest
-rwxrwxr-x 1 root wheel 3498 May 9 12:04 Vest2Text
-rwxrwxr-x 1 root wheel 5245 May 9 12:03 aff2rigid
-rwxrwxr-x 1 root wheel 6708024 May 9 12:58 applytopup
-rwxrwxr-x 1 root wheel 6464312 May 9 12:49 applywarp
-rwxrwxr-x 1 root wheel 5160304 May 9 12:38 applyxfm4D
-rwxrwxr-x 1 root wheel 23394 May 9 12:04 asl_calib
-rwxrwxr-x 1 root wheel 5293872 May 9 12:56 asl_file
-rwxrwxr-x 1 root wheel 5286152 May 9 12:50 asl_mfree
-rwxrwxr-x 1 root wheel 8076 May 9 12:04 asl_reg
drwxr-xr-x 3 root wheel 102 May 9 13:02 assistant.app
-rwxr-xr-x 1 root wheel 415 May 9 13:02 atlasquery
-rwxr-xr-x 1 root wheel 2543624 May 9 13:02 atlasquery_bin
-rwxrwxr-x 1 root wheel 5104616 May 9 12:37 avscale
-rwxrwxr-x 1 root wheel 7128 May 9 12:02 avw2fsl
-rwxrwxr-x 1 root wheel 5304592 May 9 12:55 b0calc
-rwxrwxr-x 1 root wheel 20532 May 9 12:02 basil
-rwxrwxr-x 1 root wheel 4686 May 9 12:02 basil_var
-rwxrwxr-x 1 root wheel 4835 May 9 12:02 baycest
-rwxrwxr-x 1 root wheel 3554 May 9 12:03 bedpost
-rwxrwxr-x 1 root wheel 10196 May 9 12:03 bedpostx
-rwxrwxr-x 1 root wheel 5306 May 9 12:03 bedpostx_datacheck
-rwxrwxr-x 1 root wheel 7235 May 9 12:03 bedpostx_postproc.sh
-rwxrwxr-x 1 root wheel 3913 May 9 12:03 bedpostx_preproc.sh
-rwxrwxr-x 1 root wheel 3743 May 9 12:03 bedpostx_single_slice.sh
-rwxrwxr-x 1 root wheel 13711 May 9 12:02 bet
-rwxrwxr-x 1 root wheel 5460664 May 9 12:32 bet2
-rwxrwxr-x 1 root wheel 5551672 May 9 12:32 betsurf
-rwxrwxr-x 1 root wheel 5291880 May 9 12:50 ccops
-rwxrwxr-x 1 root wheel 3833 May 9 12:03 checkFEAT
-rwxrwxr-x 1 root wheel 6923224 May 9 12:33 cluster
-rwxrwxr-x 1 root wheel 5776 May 9 12:02 cluster2html
-rwxrwxr-x 1 root wheel 4507 May 9 12:03 concat_bvars
-rwxrwxr-x 1 root wheel 5101368 May 9 12:33 connectedcomp
-rwxrwxr-x 1 root wheel 5451152 May 9 12:36 contrast_mgr
-rwxrwxr-x 1 root wheel 4467296 May 9 12:37 convert_xfm
-rwxrwxr-x 1 root wheel 6320304 May 9 12:49 convertwarp
-rwxrwxr-x 1 root wheel 41800 May 9 12:44 create_lut
-rwxrwxr-x 1 root wheel 4580800 May 9 12:34 cutoffcalc
-rwxrwxr-x 1 root wheel 4288 May 9 12:04 design_ttest2
-rwxrwxr-x 1 root wheel 5279016 May 9 12:46 distancemap
-rwxrwxr-x 1 root wheel 5317848 May 9 12:23 drawmesh
-rwxrwxr-x 1 root wheel 6305864 May 9 12:50 dtifit
-rwxrwxr-x 1 root wheel 5191400 May 9 12:53 dtigen
-rwxrwxr-x 1 root wheel 7749 May 9 12:04 dual_regression
-rwxrwxr-x 1 root wheel 4893 May 9 12:03 easythresh
-rwxrwxr-x 1 root wheel 6843656 May 9 13:01 eddy
-rwxrwxr-x 1 root wheel 4124 May 9 12:03 eddy_correct
-rwxrwxr-x 1 root wheel 14482 May 9 12:03 epi_reg
-rwxrwxr-x 1 root wheel 4673 May 9 12:03 estnoise
-rwxrwxr-x 1 root wheel 5047 May 9 12:03 extractfidparams
-rwxrwxr-x 1 root wheel 4034 May 9 12:03 extracttxt
-rwxrwxr-x 1 root wheel 8675944 May 9 12:40 fabber
-rwxrwxr-x 1 root wheel 4512 May 9 12:02 fabber_var
-rwxrwxr-x 1 root wheel 5638048 May 9 12:33 fast
-rwxrwxr-x 1 root wheel 5218568 May 9 12:46 fdr
-rwxrwxr-x 1 root wheel 2159 Nov 9 2012 fdt_rotate_bvecs
-rwxrwxr-x 1 root wheel 31607 May 9 12:03 feat
-rwxrwxr-x 1 root wheel 6142 May 9 12:03 feat_gm_prepare
-rwxrwxr-x 1 root wheel 5450656 May 9 12:34 feat_model
-rwxrwxr-x 1 root wheel 16552 May 9 12:03 featquery
-rwxrwxr-x 1 root wheel 8308 May 9 12:03 featregapply
-rwxrwxr-x 1 root wheel 5493136 May 9 12:36 film_gls
-rwxrwxr-x 1 root wheel 6640576 May 9 12:37 filmbabe
-rwxrwxr-x 1 root wheel 5499 May 9 12:03 filmbabescript
-rwxrwxr-x 1 root wheel 6092512 May 9 13:00 find_the_biggest
-rwxrwxr-x 1 root wheel 5814816 May 9 12:54 first
-rwxrwxr-x 1 root wheel 9398 May 9 12:03 first_boundary_corr
-rwxrwxr-x 1 root wheel 6568 May 9 12:03 first_flirt
-rwxrwxr-x 1 root wheel 5200080 May 9 12:54 first_mult_bcorr
-rwxrwxr-x 1 root wheel 5440 May 9 12:03 first_roi_slicesdir
-rwxrwxr-x 1 root wheel 5939360 May 9 12:54 first_utils
-rwxrwxr-x 1 root wheel 5883336 May 9 12:56 flameo
-rwxrwxr-x 1 root wheel 5924144 May 9 12:37 flirt
-rwxrwxr-x 1 root wheel 4752 May 9 12:03 flirt_average
-rwxrwxr-x 1 root wheel 7744808 May 9 12:48 fnirt
-rwxrwxr-x 1 root wheel 6383392 May 9 12:49 fnirtfileutils
lrwxr-xr-x 1 root wheel 6 May 9 12:24 fsl -> Runtcl
-rwxrwxr-x 1 root wheel 5121352 May 9 12:28 fsl2ascii
-rwxrwxr-x 1 root wheel 3546 May 9 12:04 fsl_abspath
-rwxrwxr-x 1 root wheel 26685 May 9 12:04 fsl_anat
-rwxrwxr-x 1 root wheel 2688072 May 9 12:44 fsl_boxplot
-rwxrwxr-x 1 root wheel 5527656 May 9 12:42 fsl_glm
lrwxr-xr-x 1 root wheel 6 May 9 12:24 fsl_gui -> Runtcl
-rwxrwxr-x 1 root wheel 6264832 May 9 12:44 fsl_histogram
-rwxrwxr-x 1 root wheel 15991 May 9 12:03 fsl_motion_outliers
-rwxrwxr-x 1 root wheel 5513984 May 9 12:43 fsl_mvlm
-rwxrwxr-x 1 root wheel 13278 May 9 12:03 fsl_prepare_fieldmap
-rwxrwxr-x 1 root wheel 5490 May 9 12:04 fsl_reg
-rwxrwxr-x 1 root wheel 5525040 May 9 12:41 fsl_regfilt
-rwxrwxr-x 1 root wheel 5515520 May 9 12:43 fsl_sbca
-rwxrwxr-x 1 root wheel 5459720 May 9 12:44 fsl_schurprod
-rwxrwxr-x 1 root wheel 15978 May 9 12:04 fsl_sub
-rwxrwxr-x 1 root wheel 2718800 May 9 12:44 fsl_tsplot
-rwxrwxr-x 1 root wheel 5379 May 9 12:02 fslanimate
-rwxrwxr-x 1 root wheel 5096312 May 9 12:28 fslascii2img
-rwxrwxr-x 1 root wheel 5203304 May 9 12:28 fslcc
-rwxrwxr-x 1 root wheel 4518 May 9 12:02 fslchfiletype
-rwxrwxr-x 1 root wheel 5248288 May 9 12:31 fslchfiletype_exe
-rwxrwxr-x 1 root wheel 4578 May 9 12:02 fslchpixdim
-rwxrwxr-x 1 root wheel 5133800 May 9 12:30 fslcomplex
-rwxrwxr-x 1 root wheel 594208 May 9 12:29 fslcorrecthd
-rwxrwxr-x 1 root wheel 587464 May 9 12:28 fslcpgeom
-rwxrwxr-x 1 root wheel 598296 May 9 12:28 fslcreatehd
-rwxrwxr-x 1 root wheel 3414 May 9 12:04 fslecho
-rwxrwxr-x 1 root wheel 6023 May 9 12:02 fsledithd
-rwxrwxr-x 1 root wheel 9414 May 9 12:03 fslerrorreport
-rwxrwxr-x 1 root wheel 5148704 May 9 12:30 fslfft
-rwxrwxr-x 1 root wheel 604408 May 9 12:28 fslhd
-rwxrwxr-x 1 root wheel 3628 May 9 12:02 fslinfo
-rwxrwxr-x 1 root wheel 5117968 May 9 12:28 fslinterleave
-rwxrwxr-x 1 root wheel 6733432 May 9 12:30 fslmaths
-rwxrwxr-x 1 root wheel 5231776 May 9 12:30 fslmeants
-rwxrwxr-x 1 root wheel 5146696 May 9 12:28 fslmerge
-rwxrwxr-x 1 root wheel 4878 May 9 12:02 fslmodhd
-rwxrwxr-x 1 root wheel 5100680 May 9 12:28 fslnvols
-rwxrwxr-x 1 root wheel 5155416 May 9 12:27 fslorient
-rwxrwxr-x 1 root wheel 5113872 May 9 12:28 fslpspec
-rwxrwxr-x 1 root wheel 5284 May 9 12:02 fslreorient2std
-rwxrwxr-x 1 root wheel 5134464 May 9 12:28 fslroi
-rwxrwxr-x 1 root wheel 3905 May 9 12:02 fslsize
-rwxrwxr-x 1 root wheel 5118048 May 9 12:30 fslslice
-rwxrwxr-x 1 root wheel 5243600 May 9 12:31 fslsmoothfill
-rwxrwxr-x 1 root wheel 5126224 May 9 12:28 fslsplit
-rwxrwxr-x 1 root wheel 5158792 May 9 12:27 fslstats
-rwxrwxr-x 1 root wheel 6555416 May 9 12:26 fslsurfacemaths
-rwxrwxr-x 1 root wheel 6597 May 9 12:02 fslswapdim
-rwxrwxr-x 1 root wheel 5117472 May 9 12:31 fslswapdim_exe
-rwxrwxr-x 1 root wheel 446 Jul 19 2007 fsltclsh
-rwxrwxr-x 1 root wheel 3833 May 9 12:02 fslval
-rwxrwxr-x 1 root wheel 4578 May 9 12:03 fslvbm_1_bet
-rwxrwxr-x 1 root wheel 7594 May 9 12:03 fslvbm_2_template
-rwxrwxr-x 1 root wheel 5195 May 9 12:03 fslvbm_3_proc
-rwxr-xr-x 1 root wheel 348 May 9 13:02 fslview
drwxr-xr-x 3 root wheel 102 May 9 13:02 fslview.app
-rwxrwxr-x 1 root wheel 446 Jul 19 2007 fslwish
-rwxrwxr-x 1 root wheel 5451400 May 9 12:36 ftoz
-rwxrwxr-x 1 root wheel 5481776 May 9 12:49 fugue
-rwxrwxr-x 1 root wheel 5109712 May 9 12:34 generateConfounds
-rwxrwxr-x 1 root wheel 5424 May 9 12:04 generate_b0
-rwxrwxr-x 1 root wheel 4548 May 9 12:04 generate_brain
-rwxrwxr-x 1 root wheel 2776872 May 9 12:37 halfcosbasis
-rwxrwxr-x 1 root wheel 25400 May 9 12:44 hist2prob
-rwxrwxr-x 1 root wheel 5323 May 9 12:03 imcp
-rwxrwxr-x 1 root wheel 6245360 May 9 12:38 img2imgcoord
-rwxrwxr-x 1 root wheel 6241256 May 9 12:38 img2stdcoord
-rwxrwxr-x 1 root wheel 5589 May 9 12:03 imglob
-rwxrwxr-x 1 root wheel 4274 May 9 12:03 imln
-rwxrwxr-x 1 root wheel 5269 May 9 12:03 immv
-rwxrwxr-x 1 root wheel 3805 May 9 12:03 imrm
-rwxrwxr-x 1 root wheel 4380 May 9 12:03 imtest
-rwxrwxr-x 1 root wheel 3909 May 9 12:03 invfeatreg
-rwxrwxr-x 1 root wheel 13535 May 9 12:03 invwarp
-rwxrwxr-x 1 root wheel 6569400 May 9 12:49 invwarp_exe
-rwxrwxr-x 1 root wheel 2603304 May 9 13:00 label2surf
-rwxrwxr-x 1 root wheel 5243088 May 9 13:00 lesion_filling
-rwxrwxr-x 1 root wheel 32669 May 9 12:03 mainfeatreg
-rwxrwxr-x 1 root wheel 5121208 May 9 12:51 make_dyadic_vectors
-rwxrwxr-x 1 root wheel 5211352 May 9 12:38 makerot
-rwxrwxr-x 1 root wheel 3732 May 9 12:03 maskdyads
-rwxrwxr-x 1 root wheel 5872 May 9 12:03 match_smoothing
-rwxrwxr-x 1 root wheel 3594 May 9 12:03 mccutup
-rwxrwxr-x 1 root wheel 5593464 May 9 12:41 mcflirt
-rwxrwxr-x 1 root wheel 5556488 May 9 12:25 mean
-rwxrwxr-x 1 root wheel 5092048 May 9 12:51 medianfilter
-rwxrwxr-x 1 root wheel 7608424 May 9 12:43 melodic
-rwxrwxr-x 1 root wheel 5233608 May 9 12:38 midtrans
-rwxrwxr-x 1 root wheel 6983120 May 9 12:45 mm
-rwxrwxr-x 1 root wheel 8880 May 9 12:44 morph_kernel
-rwxrwxr-x 1 root wheel 4484 May 9 12:03 mp_diffpow.sh
-rwxrwxr-x 1 root wheel 8681544 May 9 12:40 mvntool
-rwxrwxr-x 1 root wheel 6390168 May 9 12:48 new_invwarp
-rwxrwxr-x 1 root wheel 4266 May 9 12:02 old_betall
-rwxrwxr-x 1 root wheel 5798800 May 9 12:44 overlay
-rwxrwxr-x 1 root wheel 30225 May 9 12:04 oxford_asl
-rwxrwxr-x 1 root wheel 4358 May 9 12:03 pairreg
-rwxrwxr-x 1 root wheel 5846 May 9 12:03 perfusion_subtract
-rwxrwxr-x 1 root wheel 2005008 May 9 12:45 pngappend
-rwxrwxr-x 1 root wheel 5291488 May 9 12:35 pnm_evs
-rwxrwxr-x 1 root wheel 5471 May 9 12:03 pnm_stage1
-rwxrwxr-x 1 root wheel 5199784 May 9 12:38 pointflirt
-rwxrwxr-x 1 root wheel 1768288 May 9 12:34 popp
-rwxrwxr-x 1 root wheel 5635520 May 9 12:55 possum
-rwxrwxr-x 1 root wheel 8253 May 9 12:04 possumX
-rwxrwxr-x 1 root wheel 5741 May 9 12:04 possumX_postproc.sh
-rwxrwxr-x 1 root wheel 1619616 May 9 12:55 possum_sum
-rwxrwxr-x 1 root wheel 5376656 May 9 12:48 prelude
-rwxrwxr-x 1 root wheel 5118976 May 9 12:34 prewhiten
-rwxrwxr-x 1 root wheel 3520 May 9 12:03 probtrack
-rwxrwxr-x 1 root wheel 6887816 May 9 12:52 probtrackx
-rwxrwxr-x 1 root wheel 8011656 May 9 12:59 probtrackx2
-rwxrwxr-x 1 root wheel 6096784 May 9 13:00 proj_thresh
-rwxrwxr-x 1 root wheel 34680 May 9 12:44 ptoz
-rwxrwxr-x 1 root wheel 5290336 May 9 12:55 pulse
-rwxrwxr-x 1 root wheel 6309224 May 9 12:53 pvmfit
-rwxrwxr-x 1 root wheel 6247256 May 9 12:57 qboot
-rwxrwxr-x 1 root wheel 6383 May 9 12:04 qboot_parallel
-rwxrwxr-x 1 root wheel 5564 May 9 12:04 qboot_postproc.sh
-rwxrwxr-x 1 root wheel 3815 May 9 12:04 qboot_preproc.sh
-rwxrwxr-x 1 root wheel 15463 May 9 12:04 quasil
-rwxrwxr-x 1 root wheel 5630960 May 9 12:45 randomise
-rwxrwxr-x 1 root wheel 8028 May 9 12:04 randomise_parallel
-rwxrwxr-x 1 root wheel 4137 May 9 12:03 remove_ext
-rwxrwxr-x 1 root wheel 5937 May 9 12:03 renderhighres
-rwxrwxr-x 1 root wheel 5100376 May 9 12:38 rmsdiff
-rwxrwxr-x 1 root wheel 5217736 May 9 12:32 robustfov
-rwxrwxr-x 1 root wheel 5920 May 9 12:03 run_first
-rwxrwxr-x 1 root wheel 10011 May 9 12:03 run_first_all
-rwxrwxr-x 1 root wheel 7617952 May 9 12:27 run_mesh_utils
-rwxrwxr-x 1 root wheel 242000 May 9 12:23 selfintersection
-rwxrwxr-x 1 root wheel 25333 May 9 12:03 setFEAT
-rwxrwxr-x 1 root wheel 5930 May 9 12:04 setup_masks
-rwxrwxr-x 1 root wheel 21937 May 9 12:04 siena
-rwxrwxr-x 1 root wheel 5936 May 9 12:04 siena_cal
-rwxrwxr-x 1 root wheel 5208552 May 9 12:46 siena_diff
-rwxrwxr-x 1 root wheel 6509 May 9 12:04 siena_flirt
-rwxrwxr-x 1 root wheel 6166 May 9 12:04 siena_flow2std
-rwxrwxr-x 1 root wheel 18872 May 9 12:04 sienax
-rwxrwxr-x 1 root wheel 5343520 May 9 12:49 sigloss
-rwxrwxr-x 1 root wheel 5286088 May 9 12:55 signal2image
-rwxrwxr-x 1 root wheel 4267 May 9 12:02 sliceanimate
-rwxrwxr-x 1 root wheel 5768952 May 9 12:44 slicer
-rwxrwxr-x 1 root wheel 6688 May 9 12:04 slices
-rwxrwxr-x 1 root wheel 7756 May 9 12:04 slices_summary
-rwxrwxr-x 1 root wheel 5824 May 9 12:04 slicesdir
-rwxrwxr-x 1 root wheel 4325 May 9 12:04 slicesmask
-rwxrwxr-x 1 root wheel 5211184 May 9 12:46 slicetimer
-rwxrwxr-x 1 root wheel 5230872 May 9 12:32 smoothest
-rwxrwxr-x 1 root wheel 5209672 May 9 12:55 spharm_rm
-rwxrwxr-x 1 root wheel 8513 May 9 12:03 standard_space_roi
-rwxrwxr-x 1 root wheel 6245176 May 9 12:38 std2imgcoord
-rwxrwxr-x 1 root wheel 7489208 May 9 13:00 surf2surf
-rwxrwxr-x 1 root wheel 6301832 May 9 13:00 surf2volume
-rwxrwxr-x 1 root wheel 7529848 May 9 13:00 surf_proj
-rwxrwxr-x 1 root wheel 5229 May 9 12:03 surface_fdr
-rwxrwxr-x 1 root wheel 2533552 May 9 12:59 surfmaths
-rwxrwxr-x 1 root wheel 5217624 May 9 12:46 susan
-rwxrwxr-x 1 root wheel 5301920 May 9 12:47 swap_subjectwise
-rwxrwxr-x 1 root wheel 5326000 May 9 12:46 swap_voxelwise
-rwxrwxr-x 1 root wheel 1669672 May 9 12:55 systemnoise
-rwxrwxr-x 1 root wheel 4517 May 9 12:04 tbss_1_preproc
-rwxrwxr-x 1 root wheel 4680 May 9 12:04 tbss_2_reg
-rwxrwxr-x 1 root wheel 7514 May 9 12:04 tbss_3_postreg
-rwxrwxr-x 1 root wheel 4549 May 9 12:04 tbss_4_prestats
-rwxrwxr-x 1 root wheel 6478 May 9 12:04 tbss_deproject
-rwxrwxr-x 1 root wheel 4995 May 9 12:04 tbss_fill
-rwxrwxr-x 1 root wheel 4942 May 9 12:04 tbss_non_FA
-rwxrwxr-x 1 root wheel 5237688 May 9 12:46 tbss_skeleton
-rwxrwxr-x 1 root wheel 5615 May 9 12:04 tbss_sym
-rwxrwxr-x 1 root wheel 11059 May 9 12:04 tbss_x
-rwxrwxr-x 1 root wheel 25328 May 9 12:44 tmpnam
-rwxrwxr-x 1 root wheel 6997632 May 9 12:57 topup
-rwxrwxr-x 1 root wheel 6287840 May 9 12:34 tsplot
-rwxrwxr-x 1 root wheel 5447304 May 9 12:36 ttologp
-rwxrwxr-x 1 root wheel 5451400 May 9 12:36 ttoz
-rwxrwxr-x 1 root wheel 5096136 May 9 12:46 unconfound
-rwxrwxr-x 1 root wheel 6523 May 9 12:03 updatefeatreg
-rwxrwxr-x 1 root wheel 6418792 May 9 12:51 vecreg
-rwxrwxr-x 1 root wheel 3072 Sep 3 2012 viena_createpng
-rwxrwxr-x 1 root wheel 13943 Nov 30 09:41 viena_quant
-rwxrwxr-x 1 root wheel 74368 May 9 12:44 whirlgif
-rwxrwxr-x 1 root wheel 369824 May 9 12:44 wpng
-rwxrwxr-x 1 root wheel 6528976 May 9 12:51 xfibres
-rwxrwxr-x 1 root wheel 3776 May 9 12:03 zeropad
-rwxrwxr-x 1 root wheel 34784 May 9 12:44 ztop

 

[subsonix]

The results of cat ~/.profile

say -v w i can see you

# FSL Setup
FSLDIR=/usr/local/fsl
PATH=${FSLDIR}/bin:${PATH}
export FSLDIR PATH
. ${FSLDIR}/etc/fslconf/fsl.sh
*******-MacBook-Pro:~ MissDefy$

You should know if you ever installed fsl I guess, but it seems pretty safe to assume that some joker added the say line to your .profile.

I would just open it in a text editor and remove that one line, not anything below and including #FSL if you use it.

I had a look into fsl here:
http://fsl.fmrib.ox.ac.uk/fsl/fslwiki/

And the associated setup for it:
http://fsl.fmrib.ox.ac.uk/fsl/fsl-4.1.9/fsl/downloading.html

 

[chown33]

I suggest NOT deleting the ".profile" file. Instead, we'll just rename it, and put a new shell startup in a different file. My reasons for using a different file are given below, after the command lines.

You should be able to copy and paste each hilited "Code" section below. The second one is intended as a multi-line copy/paste, so be sure to do it that way.

First, rename the existing ".profile" file:

mv ~/.profile ~/was-profile

Second, create a new shell startup file with only the setup for FSL in it:

cat >~/.bash_profile  <<- '--EOF--'
# FSL Setup
FSLDIR=/usr/local/fsl
PATH=${FSLDIR}/bin:${PATH}
export FSLDIR PATH
. ${FSLDIR}/etc/fslconf/fsl.sh
--EOF--

Third, confirm the contents of ".bash_profile":

cat ~/.bash_profile

Fourth, list the directory contents and post it:

ls -la ~

You will have a Finder-visible file in your home folder named "was-profile". Don't delete it yet, keep it around for a few days.

At this point, you can test whether the change works or not. You should be able to open a new Terminal window, and it should not say anything.

If you quit Terminal and relaunch it, the first window opened should do the same: nothing said. This demonstrates that the change persists between launches of Terminal.

A further test would be to log out and login again, or do a Restart of the computer. Running Terminal.app should say nothing.


-- Explanation --

I used the shell startup file named ".bash_profile" instead of ".profile" because the shell looks for that file first. If it sees it, it runs the commands therein, and then doesn't even look for a ".profile" file.

The reason I did it this way is because of a puzzling thing I saw in the listing of ~, which I reproduce here:

-rw-r--r--    1 MissDefy  staff      13 May 21 14:28 $
drwxr-xr-x+  33 MissDefy  staff    1122 May 21 17:52 .
drwxr-xr-x    6 root      admin     204 May 21 00:38 ..
-rw-------    1 MissDefy  staff       3 Oct 14  2011 .CFUserTextEncoding
-rw-r--r--@   1 MissDefy  staff   24580 May 22  2013 .DS_Store
drwx------    2 MissDefy  staff      68 May 21 17:53 .Trash
-rw-------    1 MissDefy  staff     312 May 21 17:52 .Xauthority
-rw-------    1 MissDefy  staff   14281 May 21 17:52 .bash_history
-rw-r--r--    1 MissDefy  staff      90 Aug 24  2012 .cim_install_log
drwx------    3 MissDefy  staff     102 Aug 25  2011 .cups
drwx------   16 MissDefy  staff     544 May 22  2013 .dropbox
drwxr-xr-x    3 MissDefy  staff     102 May 21 17:52 .fontconfig
drwxr-xr-x    3 MissDefy  staff     102 Aug 21  2012 .matlab
drwxr-xr-x    6 MissDefy  staff     204 Oct 24  2012 .network_backups
[COLOR="Red"]-rw-------    1 MissDefy  staff     135 May 22  2013 .profile
[/COLOR]-rw-------    1 MissDefy  staff      80 May 21 17:52 .serverauth.1041
drwxr-xr-x    3 MissDefy  staff     102 Jul 19  2011 .ssh
drwxr-xr-x@   4 MissDefy  staff     136 Feb 18 05:07 ACUVE_color_files
drwx------+  30 MissDefy  staff    1020 May 21 17:53 Desktop
drwx------+  10 MissDefy  staff     340 Nov 15  2012 Documents
drwx------+ 465 MissDefy  staff   15810 May 21  2013 Downloads
drwx------@   9 MissDefy  staff     306 May 22  2013 Dropbox
drwxr-xr-x    5 MissDefy  staff     170 May 18 16:44 Gamez
drwx------+  42 MissDefy  staff    1428 May 19 23:33 Library
drwx------+  35 MissDefy  staff    1190 May 21 01:02 Movies
drwx------+  31 MissDefy  staff    1054 May 18 16:06 Music
drwx------+  28 MissDefy  staff     952 May 21 01:38 Pictures
drwxr-xr-x+   6 MissDefy  staff     204 Aug  1  2011 Public
drwxr-xr-x   29 MissDefy  staff     986 May  3 13:43 Random
drwxr-xr-x+   6 MissDefy  staff     204 Aug  1  2011 Sites
drwxr-xr-x   14 MissDefy  staff     476 May 21  2013 Work
drwxr-xr-x    3 MissDefy  staff     102 Apr 26 17:36 matlab
-rw-r--r--    1 MissDefy  staff  758066 May 18 05:26 strings.txt

I've hilited the info for ".profile" in red.

The puzzling thing is the modification-date shown for ".profile". It's around the same day as when you posted this listing. Which means that something either changed the ".profile" around the same time you made the listing, or something used the 'touch' command to change the modification-date of that file.

Normal shell startup doesn't change the mod-dates of ".profile" files, although something in the secondary FSL shell startup might. Without seeing the contents of the FSL shell startup file, it's just a guess. I don't need to see it now, but if the whispering "I see you" problem isn't solved, or it comes back, I may ask you to attach it. If that happens, I'll give specific instructions.


The other thing to notice is that the ".dropbox" and "Dropbox" folders have a similar modification date to that of the ".profile" file. So maybe the ".profile" file is getting written due to Dropbox. That's just a wild guess at this point, based on nothing more than the similar mod-dates.

So, if the ".profile" file is somehow being changed via Dropbox, then using ".bash_profile" will cause the shell to ignore any ".profile" file that happens to show up.


Anyway, if this solves the problem, and it doesn't reappear after Dropbox gets used, then it should continue to work, without breaking FSL. If the problem reappears, then post again and we can take another look.


This still doesn't give a definite answer to the question of how the whispering ".profile" file got there in the first place. Unfortunately, that's nearly impossible to figure out without a detailed examination of the entire disk, along with a bunch of answers to questions like what websites are visited, what web services are used (e.g. Dropbox), what matlab modules are used, and so on. That's a time-consuming and expensive process, at best. And it may not even come up with an answer.