Does anyone know what type of file "settings.sxx" is, and what it does?

I keep finding these files on one of my storage hard drives, and it keeps coming back after I delete it. I get the feeling that it is some type of spyware or similar file.

If I leave it on my hard drive with out deleting it, then other .sxx files will also appear over the next few days. If I keep deleting it as soon as I find it, then the other files don't show up.

Is there some way I can use the power of Unix to track this file and find out what it is doing?

I use Mac OS X most of the time, and since it is based on FreeBSD, then I should have some of the tools that could be used to track this file, right?

There is no spyware or virii for BSD that I know of. Heck, there is hardly any malware for the still obscure Linux, which is exponentially more popular. It's simply too obscure to waste time writing malware for. Anyway, those files are probably harmless.

Moved: This thread is more suitable in the Other *NIX forum and has been moved accordingly to help your thread/question get the exposure it deserves.

What ever it is, it is doing something, because if I don't delete it every day then more of the little things start showing up on my storage drive. They all have the same .sxx extension, but different file names.

I have a couple of drives on my Mac running Mac OS X, and one of them is partitioned into three drives, each with a different version of the OS installed. The only drive that gets these things doesn't have an OS installed, it's just for storage. I don't see this file on any of the other drives, unless it is hiding somewhere.

Is there somewhere I can upload one of these things for others to look at? I have opened one with a text editor, and it has a short string in it, only one line of text.

Sorry, I thought that someone allready moved it to the right place, and since it got a different response than the other one it was OK to continue to use it.

How does it get moved to or merged or what it needs?

Click the report button in the other thread and ask the moderator of that forum to move the thread and merge it with this one. This is why we ask that you only post a given question once, otherwise it creates a mess that a moderator usually ends up having to fix.

If I don't delete it right away, the next day or so I get more .sxx files appearing on my storage drive. In addition to settings.sxx, I get redcarpet2004.sxx, and TestMovie_Config_Info.sxx.

If I look at the settings.sxx file with a text editor, it see a zero with a slash throught it plus this text "(TCSO\0\0\0\0\0\0settings\0\0\0\0\0gain\0@\0\0\0\0\0\0\0".

Inside redcarpet2004.sxx I find a zero with a slash throught it plus this text"…TCSO\0\0\0\0\0\0
redcarpet2004\0\0\0\0\0closeupdataRoot\0recentlyViewed\0\0\0
\0
0\0 programID\010917\0sourceID\0433\0
channelNumber\042\0channelName\0AMC\0 starttime\006/07/2006 17:45\0title\0Twins\0\0"

"Does anyone know what type of file "settings.sxx" is, and what it does?"

First of all, see if, in the same folder that contains the "settings.sxx" file, there is a file named "settings.sol". That is the Local Shared Object (LSO), aka "Flash cookie" or "Persistent Identification Element" (PIE), file that is created and written to the computer by Adobe's Flash Player, or more accurately Adobe's Global Settings Web page, that controls whether or not Web sites are allowed to put Flash cookies (LSOs) on your machine and how much of your hard drive they are allowed to use.

While it is unethical to do so, more and more Web sites try to change the global settings for LSOs by overwriting the Adobe issued "settings.sol" file with a counterfeit that changes the global settings to whatever that Web site wants you to have. If the "settings.sol" file is set as "read only", then it cannot be overwritten; so the file is written with the name, "settings.sxx". You should know that even Web sites that contain no Flash content at all can place LSOs on your machine, and many of them do.

In short it's evidence that a Web site has tried but failed to hack your Flash Player's global settings, because either you or Linux has set the "settings.sol" file to "read only". Adobe does not make the file "read only" by default, though it should.

So, the "settings.sxx" file is a good sign. It means that your Global Settings LSO is protected and has not been overwritten. However, your deleting the files as they appear is also a good thing; because even if the LSO contains no malicious content, it is unethical for any Web site other than Adobe's settings page to overwrite your global settings--and it is unclear whether the offending Web site can still read the file with the ".sxx" extension and apply it to Flash settings. If you can discover which site or sites are writing the "settings.sxx" file to your machine, I would be very interested in knowing which site or sites they are. I have found more than a dozen Web sites that try to overwrite the global settings. On Windows, the "settings.sol" file is not read only by default. I set mine to read only when I discovered why my global settings kept changing.

I am writing a tutorial for controlling LSOs and keeping them off the computer. There is only one successful and comprehensive way to do it, but none of the other articles on Flash cookies has mentioned it at all. My article gives a step by step tutorial for setting up the browser and computer so LSOs are deleted and kept off the hard drive. To complete the tutorial so it is effective for cross-platform use, I need to know where on Linux the "settings.sol" file is stored. I would really appreciate it if someone would post that information. I can have the tutorial online and ready to use within 30 minutes after I receive that information.

I hope this helps you understand the mysterious "settings.sxx" file.

Oh. One more thing: If you open the file with a text reader, you can read the basic settings that the offending Web site was trying to impose upon you and your computer.

Al