Working backwards...
At any rate, I checked the plist with Get Info and found that both the Creation and Modified dates were the same and they corresponded with a day this user got one of those internet greeting cards.
This user would not install anything so I'm assuming it's from the card.
Still would be nice to view the contents (to be sure). Did you look at it with TextEdit? (or better yet, a hex-editor such as
0xED).
stat (type path here)
and
cat (type path here) | xxd -c 32 | head -n 20
-bash: syntax error near unexpected token
If I did the same without brackets I got:
No such file or directory While the output is nice to hear about, copying the
full session from the terminal screen (especially including the commands *you* had entered) is the way to go, if we are to properly discuss what really happened. [brackets?? where??]
find / -name ".a23t.mk4e.plist"
Yup. I almost always include the
-x option with
find (to prevent it from diving deep down inside the /Volumes folder. It will also search networked shares in such cases). Obviously the permissions stuff was due to not prefixing with
sudo. [ryck, those last 2 sentences were for primarily for Virtual1's consumption.
]
find ~ -name ".a23t.mk4e.plist"
find: /Users/Username/.fseventsd: Permission denied
find: /Users/Username/File Transfer Folder\003\r: Permission denied
find: /Users/Username/Temporary Items/0: Permission denied Odd/curious. You (or some user) seem to have strange junk in the home folder which is not accessible by the (home) owner. If interested, we could pursue that here (mods/admins willing) or in another thread.
--
A little marker for tacit: Generated in 47.425 seconds in which 21.796 seconds were spent on a total of 12 queries. Zlib compression disabled. 
