Mysterious cfx# preference files (binary plists), Take 2

The other topic on this matter was closed with no resolution.
I seem to recall the files were initially invisible on my system and now are not. More disturbingly they seem to have an enormous amount random data elements in them ranging from email addresses to images. None of data is from any single application. Very suspicious of some kind of key logger or other spyware based upon the key data found in these files (serial numbers of some of my software, email addresses, subjects, photos, full names of database fields from FileMaker Pro, each individually stored in a very structured manner)
I have archived the files off for more analysis. If anyone sees these types of files and wants to see the contents in a structured manner (aka decode the binary plist), download TextWrangler or Apple's property list editor and open with either. I would recommend TextWranger as it is easier to view and search large binary plists (aka resource fork 2.0 LOL)
As a second measure of analysis, I have added a Finder "Folder Action" to alert me when a new file is added to my preferences folder. When another shows up, I should have an idea of what created it I hope. The problem is that there is so much garbage running behind the scenes in Mac OS X (as opposed to Mac OS 9) that unraveling this could be a nightmare.

I found this:
http://tinyurl.com/cfx-mkstemp
Which indicates which UNIX command may be generating these. By most accounts these are generated when a preference file is re-written. The original preference file is left on disk, the new one is created with a bogus name of cfx# + number translated to character form (longint to char). Then the preference file which is being written is discarded and the new file is renamed to take its place.
This very likely is being done by the OS (a Cocoa call). As we see more and more of these collect, it likely means that something is having a serious issue writing its preference file. On the other hand any application can call mkstemp() to create such a randomized named file which will not overlap with any other file. Very handy and also means that a rogue app wishing to insure that it can write to a directory would correctly assume the user, regardless of their rank (admin, managed, guest) has the ability to write to the preferences folder. Just a thought. I personally don't like what I see in the ones I captured. Looks like digital-dumpster-diving to me. It *seems* to contain various snippets of data from multiple applications in my captured files... That is not a legitimate behavior of the preference writing system of the OS.
Oddly enough, when I deleted the files, they stopped being left behind. The folder action AppleScript :
"/Library/Scripts/Folder Action Scripts/add - new item alert.scpt"
alerts me frequently that a new items is in the folder but then when I tell it "Yes" to see it, the script opens the Preferences folder and selects nothing. I suspect this is the cfx# file being created, being detected, then the swap happens and the script cannot find the cfx# file.
So, I am going to modify the add - new item alert.scpt script to display the name of the files in the dialog (silly it doesn't) and re-attach the script to see if they are indeed the cfx# files.
If the OS is indeed doing this by virtue of NSPreferences/NSMutableDictionary (Cocoa calls), then Apple would be nice to have in the application path for the application that made the call in the plist... a trackback?
More later.

Similar Messages

  • CS3 - The preferences file is corrupt and will be reset to default settings

    Honestly, I've been using this program for years now and I'm still amazed at how jack-screwed it continues to be.
    Why is my "preferences file" corrupt all of a sudden, and why pray tell, do I get this message every time I relaunch the program?  How can this be corrected?
    And while I'm frustrated and ranting....why does Illustrator constantly give me a "this program is not responding" error almost everytime I close it down for the last 10 years (literally) no matter what version I've used and no matter whether my PC is new with a new install of AI or on any other configured PC?
    And why does Illustrator take 5 minutes to close when CorelDraw closes in 5 seconds without an error?
    Ok... I'm beginning to ramble, AI does that to me.  How about we tackle the error message on the thread title?  Your help is much appreciated.
    Thanks.

    If resetting the preferences does not work then trashing the Settings folder and the plist file should.
    You first quit Illustrator then;
    Users/Username/Library/Preferences/Adobe Illustrator CS3 Settings (you trash this folder) and then navigate a little further down in the list of preferences to com.adobe.illustrator.plist and trash that as well.
    As far as why this has been happening for the last ten years would suggest one of three things to me, one; you have some corrupt files that are still in use or have been revised over the ten years and you still use them from time to time. They work fine but course you problems and now the systems have been updated to the point that the problems they cause are dramatic, two; you are using fonts that are old and while are not really corrupt in that they are serving their purpose they are causing the font cache or preferences to be corrupt and finally three you may have plug ins that have had problems that may never have been fully resolved and again they work fine except that they cause this problem(s).
    That is what it suggest to me. And of course the fact that Illustrator is extremely sensitive to system problems with bussing and font corruption more so then most programs.

  • Where's the keyboard layout preference file?

    I'm having an irritating problem with my preferred keyboard layout (Canadian) mysteriously reverting to other layouts, even though I have disabled all but the Canadian layout. It's only happening in one of my user accounts. So I'm looking for the keyboard layout .plist file to trash, but I can't find it. Can anybody help me locate it?
    Thanks

    Hello,
    Check out this link: http://docs.info.apple.com/article.html?artnum=75066
    When you originally set up your eMac, you would have used the SetUp Assistant... there's information at the link above that might help.
    I've searched high and low for a preference file that might be related. You could trash your com.apple.systempreferences.plist but you would have to reset your System Preferences system wide. If you want to try that go to the user account in question. Go here: /Library/Preferences. Locate the com.apple.systempreferences.plist file and drag it to the Desktop. Open System Preferences and reset the keyboard (Canadian) and see if that helps. If that resolves the problem, then that com.apple.systempreferences.plist file should go to the Trash. The next time you open System Preferences your eMac will create a new pref file for you.
    Carolyn

  • Technical reference about the apple system preferences files

    Hi Community,
    is there a technical reference or at least a short description about apples system preferences files in Snow Leopard available? I don't mean the structure of references files as a whole but the meaning and functionality of a specific plist.
    Thx & Bye Tom

    Dave Sawyer wrote:
    [com.apple.loginitems.plist]
    Yes this was my thought too but it didn't drop the login items after I
    threw > the loginitems.plist.
    Some apps may automatically add themselves to this list, controlled by their
    own preferences. But that is indeed the preference that controls that list.
    I'm confused because after this experience I found a lot of tutorials, documentations and forum discussions which describes the loginwindow.plist as the responsible plist for the login items. My suspicion was that the loginitems.plist rebuild process take notice about the content of loginwindow.plist, which is in the root of the matter the same as in loginitems.plist.
    But I couldn't answer this question competent and that's the reason why I'm searching for detailed informations about this "forgotten" loginitems.plist. Forgotten? Try to search for it. Its unbeleavable, 99% of the hits you get belongs to the loginwindow.plist and the description sounds very similar to the functionality of loginitems.plist. But maybe you're right and the applications try to put themselves back into the startup item list. But this doesn't answer the relation between this two plists.
    Thy & Bye Tom

  • Preference File Accumulation

    What happens to all the preference (plist) files created in Home/Library/Preference/By host? Do they ever get automatically deleated or do they just accumulate? Should I attempt to delete some of the older ones? Some represent changes to changes to changes, etc.... I have been using my computer for less than 2 months and have already accumulated over 70 of these plist files. I know the disk space is rather insignificant, but I can see that a person could create thousands of these files over several years. Don't be too rough on me, I'm new to this. Thanks for any help.

    When you change a preference the system should not create an entire new preference file nor should any applications. It should simply modify the existing file. Some applications have numerous preference files for one reason or another but the mere act of changing a preference should not create an entire new preference file.
    I have never had speech turned on in my iMac so I went ahead and turned it on then turned it off. Then I set my clock to speak every 15 minutes. This action seems to have created three new preference files. I then waited a few minutes and changed the clock setting to a different setting and indeed one of the speech settings was modified, but no new preference files were created by my doing this. The modification time on one of the files changed though, and matched the time that I actually made the change. that is how it should work.
    I then turned the setting back off as I don't want my clock to announce the time but I won't bother deleting the preference files created as they only take up 4k of space each.

  • Can't find my Photoshop preferences file

    I KNOW this is stupid, but on Windows 7, 64-bit, with all the stuff turned on to show me hidden files and system files and everything, Photoshop CS6 (13.0.1?), and Lightroom 4.3
    I'm trying to follow the advice that everything I do in Photoshop should be backed up somewhere other than as part of Photoshop, I periodically move all the stuff in
    the Users/<me>/AppData/Roaming/Adobe...  folders to a backup drive...  And, by and large, I can find and figure out what stuff is.
    But, I can't find my preferences file.  I went to the Adobe help, and it says:
    General settings
    Adobe Photoshop CS6 Prefs.psp (32-bit version)
    Adobe Photoshop X64 CS6 Prefs.psp (64-bit version)
    Users/[user name]/AppData/Roaming/Adobe/Adobe Photoshop CS6/Adobe Photoshop CS6 Settings
    I don't have ANYTHING called "Prefs.psp" in the Users stuff.  As near as I can tell, I don't have anything called Prefs.psp ANYWHERE on the disk.. 
    Do I get to pick where this file gets put?  Could I have put it somewhere ELSE?  Or, is it actually named something else?
    I wouldn't be much concerned about his, but my latest stupid human trick (we won't go into that please) has convinced me I should do a better job of making sure I can restore Photoshop and Lightroom in the event of a "small error in judgement"

    Thanks Noel.  It's nice to know that at least THIS time, I'm not crazy..........
    As far as backups, I've got a good setup, EXCEPT for the system backup...  I'm using Syncback to back up everything but the O/S, and I've recently added a backup that takes everything from the system except the Windows folder tree...  So, every night at 1 a.m. everything gets backed up to internal backup drives and a large external backup drive. 
    What I'll do is add an (hopefully) automated Windows Backup to the other backups.  Given the appallingly stupid things I periodically do I figure I need suspenders and a belt.

  • Need help. I am running a 27 in imac with 16 gigs of ram. Photoshop runs really fast, except when opening files. It takes 5-10 minutes to open even a small file of 1 meg. I cleaned and validated all the fonts and removed all questionable fonts. Reset pref

    Need help. I am running a 27 in imac with 16 gigs of ram. Photoshop runs really fast, except when opening files. It takes 5-10 minutes to open even a small file of 1 meg. I cleaned and validated all the fonts and removed all questionable fonts. Reset preferences and still have problem. Slow to open and in force quit "Photoshop not responding" At this point should I uninstall and start over.

    What are the performance Preferences?

  • Script to Copy preference file to all users profiles and to the default template

    I have build a package using Apple PackageMaker, this will install an application and a preference (plist) file to the current logged in user. Now I wanted to build a postflight script, which can copy a plist (ex com.test.plist) form an current logged in user to other user account on a machine also to the default user template (/System/Library/user template/...../Library/preferences) so any new user account created will have same preference file copied.

    Hi Mark...here is another script which work well if I have to copy my preference file from an account named as "admin" or some other account. However, it not certain that all Mac machine will have a account named as "admin". This is why I am looking for a way to copy the preference file from /private/var location to all user accounts on a mac.
    #!/bin/sh
    localUsers=$( dscl . list /Users UniqueID | awk '$2 >= 501 {print $1}' | grep -v admin )
    for userName in "$localUsers"; do
         cp /Users/admin/Library/Preferences/org.mypreference.plist /Users/$userName/Library/Preferences/
         chown $userName /Users/$userName/Library/Preferences/org.mypreference.plist
    done
    I tried to update it as suggest in some other forum like this, still no luck
    #!/bin/sh
    UserAccounts=`dscl . list /Users UniqueID | awk '$2 > 500 { print $1 }'`
    for userName in "$UserAccounts"; do
         cp /private/var/org.mypreference.plist /Users/$userName/Library/Preferences/
         chown $userName /Users/$userName/Library/Preferences/org.mypreference.plist
    done
    When I run the above script it comes up with the following error:
    cp [-R [-H | -L | -P]] [-fi | -n] [-apvX] source_file target_file
    cp [-R [-H | -L | -P]] [-fi | -n] [-apvX] source_file ... target_directory
    chown: admin: No such file or directory
    chown: admin/Library/Preferences/org.mypreference.plist: No such file or directory

  • Surgery on corrupt preferences file?

    Hello. I used to have speakable items activated but turned it off in the speech pane months ago. However, am still getting a partial spoken warning from time to time (Agnes says only "ALERT...", usually when the battery runs down for example. Needless to say, my wife is not happy to hear a computer-generated female voice in our bedroom at 3 o'clock in the morning.
    I was told that I had a corrupt preferences file that needed fixing. Is there any way to do this without erasing all of my other preferences?
    Thanks again!

    Hi ¿Qué?,
    I think you just need to move these 2 to the Desktop, reboot & set Speech Prefs again if needed, most likely default is OFF though...
    /Users/YourUserName/Library/Preferences/com.apple.speech.recognition.recognizer. prefs.plist
    /Users/YourUserName/Library/Preferences/com.apple.speech.recognition.AppleSpeech Recognition.prefs.plist

  • Restoring preference files in FCP 7.03

    I trashed my preference files in FCP (com.apple.finalcutpro.plist and under Final cut Pro User Data: FCP 7.0 prefs, FCP Pro Obj Cache and FCP Prof Cache)
    I emptied my trash. I then repaired permissions, restarted, and relaunched FCP.
    But.......com.apple.finalcutpro.plist did not reappear. The Pro User Data did reappear. And FCP doesn't recognize my video deck.
    I read the Digital Rebellion info. Is that the best route to go, that is, will it locate a trashed preference final? Or are we talking about some other procedure?
    My reason for doing all the above was to delete previous project files and to get ready for a new FCP project with a clean slate.
    I'm feeling vexed because this is the first time I encountered this situation. And I'd like some step by step guidance, anyone?

    1. The plist doesn't appear until you do something in the applicaton that changes the window arrangement or the state of the application. Otherwise there is no plist. As Jon said it's a very minor part of the preferences.
    2. DV NTSC is the default. If you leave the default preset the application is looking for a DV device.
    So this has nothing to do with plists or prefs but that you can't capture. So let's start ate the beginning:
    Please give your full system specifications, what computer, what drives, what camera or deck, how everything's connected, what settings are on the media, what settings you're using in Final Cut, and finally what version of the software, of the OS, and of QuickTime you are using.

  • Resetting (or 'Trashing') the Lightroom Preferences file

    Hi,
    in an effort to make the edit-in option in LR work, I found instructions that I need to reset the preference file for LR. I followed the following directions, see below.
    However, even with holding the option key down on my iMac, as directed, I cannot find the folder and file. I do not have a Library folder under my username, but only one under hard drive, and in there I can find com.adobe.photoshop files, but no LR file. Can anybody help me?
    Lightroom Help /  
    Preference and other file locations in Lightroom 5
    Adobe Community Help
    Products Affected
    Lightroom 5
    Contact support
    Give feedback 
    What's covered
    Important information for all platforms
    File locations in Mac OS X
    File locations in Windows 7 and 8
    To the top 
    Important information for all platforms
    The files and file locations given here are defaults. Some of these locations can be customized in the Lightroom \Preferences or Catalog Settings dialog boxes.
    While troubleshooting, when possible, rename files instead of deleting them.
    If possible, back up catalogs on a different hard disk or volume from the disk where your catalog is located. For more information on backing up in Lightroom, read Back up a catalog in Lightroom Help and watch Backing up your catalog on Adobe TV. (The video was produced for Lightroom 4 but still applies to Lightroom 5.)
    To the top 
    File locations in Mac OS X
    Note:
    The user Library file is hidden by default on Mac OS X 10.7 and later. For temporary access to the user Library file, press Option and choose Go > Library in the Finder.
    The Lightroom application file
    /Applications/Adobe Photoshop Lightroom 5.app
    Preferences
    /Users/[user name]/Library/Preferences/com.adobe.Lightroom5.plist
    Catalog
    /Users/[user name]/Pictures/Lightroom/Lightroom 5 Catalog.lrcat
    Preview cache
    /Users/[user name]/Pictures/Lightroom/Lightroom 5 Catalog Previews.lrdata
    Smart Preview cache
    /Users/[user name]/Pictures/Lightroom/Lightroom 5 Catalog Smart Previews.lrdata
    Catalog lock file
    /Users/[user name]/Pictures/Lightroom/Lightroom 5 Catalog.lrcat.lock
    Note: The lock file prevents the catalog from being overwritten when in use.
    Catalog journal file
    /Users/[user name]/Pictures/Lightroom/Lightroom 5 Catalog.lrcat-journal
    Note: Open catalogs use the journal file to check for incomplete database records. Do not delete the journal file unless you're deleting its associated catalog, as well.
    Catalog backup
    /Users/[user name]/Pictures/Lightroom/Backups/[date and time of backup]/Lightroom 5 Catalog.lrcat
    Presets and templates
    /Users/[user name]/Library/Application Support/Adobe/Lightroom/[preset or template folder]/[preset or template filename.lrtemplate]
    Serial number
    /Users/[user name]/Library/Application Support/Adobe/Lightroom/Lightroom 5.0 Registration

    Try making hidden folders and files visible temporarily following the steps described here Quickly Show/Hide Hidden Files on Mac OS X Mavericks & Yosemite | Ian Lunn - Front End Developer, it applies to Mavericks but I think is also valid for Yosemite (but not 100% sure). Please don't use a external drive when hidden folders and files are visible as there might be a bug with LR5.7.1 on Yosemite when they are visible (not fully sure).
    When you are done with the preferences, make hidden folders and files invisible again.

  • Cant find Safari preference file in Mavericks

    I upgraded to Mavericks and Safari isnt behaving right.  It won't even launch at all now and just make my MBPR system fan scream like a banchee.  I figured I could delete the preferences file and disable the exstensions for a start.  Problem is I can't launch Safari to disable the exstension.  I also can't find the pref file either.  Looked all over....
    Plz help.
    Thanks
    Greg

    Open a Finder window. From the Finder menu bar click Go > Go to Folder
    Type or copy paste the following:
    ~/Library/Preferences/com.apple.Safari.plist
    Click Go  then move the com.apple.Safari.plist file to the trash.
    For extensions. From your Safari menu bar click Safari > Preferences > Extensions
    Turn that OFF, quit and relaunch Safari to test. If that helped, turn one extension on then quit and relaunch Safari to test until you find the incompatible extension then click uninstall.

  • Freeze on start - damaged preferences file

    For the past several weeks I repeatedly can't start Lightroom 5.6 and now 5.7 without first deleting the preferences file, which apparently is repeatedly damaged. Once this is done I can restart Lightroom and reset my preferences. This occurs on two computers, one running Windows 8.1, the other Windows 7 - with two different Lightroom catalogs. I have found no information about this strange and sudden problem. Is anybody else experiencing this?
    Adobe has blocked any support contact on systems not running on the monthly paying CC subscription model (I use CS6, which I have licensed through an art college where I have a teaching position), leaving professional users such as myself to solve mysterious problems alone. This is time consuming, which I find this unacceptable. What other industry ignores the needs of its users, especially those who help maintain its image through professional use and teaching? Has Adobe stopped listening?

    Hi, spenzmatik
    1. I suggest you begin troubleshooting using the procedure specified in my "Resolving Disk, Permission, and Cache Corruption" FAQ. Perform the steps therein in the order specified.
    2. An errant Startup or Login Item maybe the cause. My "Troubleshooting Startup and Login Items" FAQ can help you pin that down if such an item is causing the problem.
    Good luck!
    Dr. Smoke
    Author: Troubleshooting Mac® OS X
    Note: The information provided in the link(s) above is freely available. However, because I own The X Lab™, a commercial Web site to which some of these links point, the Apple Discussions Terms of Use require I include the following disclosure statement with this post:
    I may receive some form of compensation, financial or otherwise, from my recommendation or link.

  • Accidentally changed format of preference files

    Hi all,
    I was trying to resolve a problem in a programme I was having so I dragged and dropped its preference file along with another onto the desktop. I accidentally dropped one onto the other and now all preference files (mac apps not plists) have been converted to excel files which can't be read. Now new files which I open from my hard drive open as .exec files!!
    How do I can I right my wrongs??

    OK, firstly thanks for getting back to me and sorry my post was confusing. I am a little confused! The problem really comes in two parts:
    1) I use a brainwave analysis programme called Netstation, its a programme in which you can edit raw acquisition data. I was having trouble with it and had been advised that pulling the preference file (from HD/User/Username/Library/Preferences) onto the desktop would help. I cant remember exactly but when I did this it said something about Adobe Device Central so I then tried to pull that onto the desktop too - which I then accidentally dropped onto the Netstation prefs file. Neither of these were .plist, the .plist file are fine. But now all of the prefs file which weren't .plist have changed to excel file formats. The thumbnail of these even reads "Can you read this? I don't think so".
    2) With regards to the general functioning of the computer and programmes it seemed to be fine, until I tried to open some raw Netstation data files from my external hard drive (transfered from the acquisition computer). It is these raw data files which now show as .exec files on my computer and will not open. I believe this to be due to the fact that I have changed the preference files format, but cannot be 100% sure.
    Does that help? Any assistance would be GREATLY received!

  • Corrupted Mail preferences file

    Dear all,
    My com.apple.mail.plist file got corrupted somehow. My Home/Library/Mail folder looks fine though. What do I have to do to restore everything back to normal? Bear that I don't have a preference file backup. I would <never> think a simple, tiny file could ruin all my e-mail capabilities... For one moment it reminded me of my Windows days...
    Anyway, I'd appreciate your help in this matter.
    Cheers,
    Leonardo

    The Mail.app preference file stores all account information and general Mail.app preferences.
    With the Mail.app quit and using the Finder, go to Home > Library > Mail. Copy the Mail folder and place the copy on the Desktop for backup purposes.
    Using the Finder, go to Home > Library > Preferences > com.apple.mail.plist. Delete the com.apple.mail.plist file and empty the Trash.
    Note: Moving or deleting the com.apple.mail.plist from the Preferences folder will require re-entering all email account information when re-launching Mail.
    The only exception to this is if you have a .Mac account which will be recreated automatically.
    Launch Mail and decline any prompt to import mailboxes. After re-entering all email account information the same as before, the Mail.app should rediscover the existing account named folders and mailboxes at Home > Library > Mail.
    After confirming all mailboxes were successfully rediscovered, you can delete the copy of the Mail folder from the Desktop.

Maybe you are looking for

  • Migrating from Linux Mail to Exchange 2013

    Is there any official documents of the Best Practices of migrating Linux Mail (Exim) to Exchange 2013? I appreciate any help that I can receive. Thanks in advance. My best regards.

  • Issues with Outlook 2011 since upgrading to Yosemite

    Hi, I have reached out to Microsoft for this issue and they are saying it's an issue with Apple, so I don't really know who to reach out to.  I am running Yosemite 10.10.1 on my Macbook Pro.  I have had Microsoft Outlook 2011 for Mac installed on thi

  • ALBPM and ALUI ?

    hi, i have a task to work on integrating ALBPM and ALUI. i have a modeled process developed in ALBPM and that particular process' workflow has to be surfaced in portal. i know that the process can be converted into a web service and the portal can cr

  • Blinking Dialog box?

    Every so often a little accept/deny box pops up but it goes away so fast that i cant read a single word it says and its always at random times so i have no idea what it is asking me to do. I was wondering if there was a way to look at what it wants m

  • Frequent Invalid Credential login Error to Essbase Server

    We have noticed frequently invalid credentials error with  Essbase Server login via Smart View or Classic Add-In. Some interesting facts, on invalid credential error: 1)  We can login using native Essbase Security as Admin. 2)  Can login into Shared