LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > Other *NIX
User Name
Password
Other *NIX This forum is for the discussion of any UNIX platform that does not have its own forum. Examples would include HP-UX, IRIX, Darwin, Tru64 and OS X.

Notices


Reply
  Search this Thread
Old 06-06-2006, 05:28 PM   #1
sbleecker
LQ Newbie
 
Registered: Oct 2005
Location: Mt. Pleasant, Michigan, USA
Distribution: Mac OS X & Yellow Dog, but I'm open to something new
Posts: 18

Rep: Reputation: 0
Unhappy settings.sxx files, are they dangerous?


Does anyone know what type of file "settings.sxx" is, and what it does?

I keep finding these files on one of my storage hard drives, and it keeps coming back after I delete it. I get the feeling that it is some type of spyware or similar file.

If I leave it on my hard drive with out deleting it, then other .sxx files will also appear over the next few days. If I keep deleting it as soon as I find it, then the other files don't show up.

Is there some way I can use the power of Unix to track this file and find out what it is doing?

I use Mac OS X most of the time, and since it is based on FreeBSD, then I should have some of the tools that could be used to track this file, right?
 
Old 06-06-2006, 08:05 PM   #2
peter_89
Member
 
Registered: Jan 2006
Distribution: Microsoft Windows XP Professional SP2; Slackware Linux 10.2
Posts: 215

Rep: Reputation: 30
There is no spyware or virii for BSD that I know of. Heck, there is hardly any malware for the still obscure Linux, which is exponentially more popular. It's simply too obscure to waste time writing malware for. Anyway, those files are probably harmless.
 
Old 06-06-2006, 08:47 PM   #3
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Moved: This thread is more suitable in the Other *NIX forum and has been moved accordingly to help your thread/question get the exposure it deserves.
 
Old 06-07-2006, 07:46 AM   #4
sbleecker
LQ Newbie
 
Registered: Oct 2005
Location: Mt. Pleasant, Michigan, USA
Distribution: Mac OS X & Yellow Dog, but I'm open to something new
Posts: 18

Original Poster
Rep: Reputation: 0
What ever it is, it is doing something, because if I don't delete it every day then more of the little things start showing up on my storage drive. They all have the same .sxx extension, but different file names.

I have a couple of drives on my Mac running Mac OS X, and one of them is partitioned into three drives, each with a different version of the OS installed. The only drive that gets these things doesn't have an OS installed, it's just for storage. I don't see this file on any of the other drives, unless it is hiding somewhere.

Is there somewhere I can upload one of these things for others to look at? I have opened one with a text editor, and it has a short string in it, only one line of text.
 
Old 06-07-2006, 08:00 AM   #5
sbleecker
LQ Newbie
 
Registered: Oct 2005
Location: Mt. Pleasant, Michigan, USA
Distribution: Mac OS X & Yellow Dog, but I'm open to something new
Posts: 18

Original Poster
Rep: Reputation: 0
Sorry, I thought that someone allready moved it to the right place, and since it got a different response than the other one it was OK to continue to use it.

How does it get moved to or merged or what it needs?
 
Old 06-07-2006, 10:28 AM   #6
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Click the report button in the other thread and ask the moderator of that forum to move the thread and merge it with this one. This is why we ask that you only post a given question once, otherwise it creates a mess that a moderator usually ends up having to fix.
 
Old 06-08-2006, 06:42 AM   #7
sbleecker
LQ Newbie
 
Registered: Oct 2005
Location: Mt. Pleasant, Michigan, USA
Distribution: Mac OS X & Yellow Dog, but I'm open to something new
Posts: 18

Original Poster
Rep: Reputation: 0
If I don't delete it right away, the next day or so I get more .sxx files appearing on my storage drive. In addition to settings.sxx, I get redcarpet2004.sxx, and TestMovie_Config_Info.sxx.

If I look at the settings.sxx file with a text editor, it see a zero with a slash throught it plus this text "(TCSO\0\0\0\0\0\0settings\0\0\0\0\0gain\0@\0\0\0\0\0\0\0".

Inside redcarpet2004.sxx I find a zero with a slash throught it plus this text"…TCSO\0\0\0\0\0\0
redcarpet2004\0\0\0\0\0closeupdataRoot\0recentlyViewed\0\0\0\00\0 programID\010917\0sourceID\0433\0
channelNumber\042\0 channelName\0AMC\0 starttime\006/07/2006 17:45\0title\0Twins\0\0"
 
Old 02-15-2010, 07:45 PM   #8
alswilling
LQ Newbie
 
Registered: Jan 2010
Posts: 3

Rep: Reputation: 0
RE: "settings.sxx" files - For Those Who Still Want to Know

"Does anyone know what type of file "settings.sxx" is, and what it does?"

First of all, see if, in the same folder that contains the "settings.sxx" file, there is a file named "settings.sol". That is the Local Shared Object (LSO), aka "Flash cookie" or "Persistent Identification Element" (PIE), file that is created and written to the computer by Adobe's Flash Player, or more accurately Adobe's Global Settings Web page, that controls whether or not Web sites are allowed to put Flash cookies (LSOs) on your machine and how much of your hard drive they are allowed to use.

While it is unethical to do so, more and more Web sites try to change the global settings for LSOs by overwriting the Adobe issued "settings.sol" file with a counterfeit that changes the global settings to whatever that Web site wants you to have. If the "settings.sol" file is set as "read only", then it cannot be overwritten; so the file is written with the name, "settings.sxx". You should know that even Web sites that contain no Flash content at all can place LSOs on your machine, and many of them do.

In short it's evidence that a Web site has tried but failed to hack your Flash Player's global settings, because either you or Linux has set the "settings.sol" file to "read only". Adobe does not make the file "read only" by default, though it should.

So, the "settings.sxx" file is a good sign. It means that your Global Settings LSO is protected and has not been overwritten. However, your deleting the files as they appear is also a good thing; because even if the LSO contains no malicious content, it is unethical for any Web site other than Adobe's settings page to overwrite your global settings--and it is unclear whether the offending Web site can still read the file with the ".sxx" extension and apply it to Flash settings. If you can discover which site or sites are writing the "settings.sxx" file to your machine, I would be very interested in knowing which site or sites they are. I have found more than a dozen Web sites that try to overwrite the global settings. On Windows, the "settings.sol" file is not read only by default. I set mine to read only when I discovered why my global settings kept changing.

I am writing a tutorial for controlling LSOs and keeping them off the computer. There is only one successful and comprehensive way to do it, but none of the other articles on Flash cookies has mentioned it at all. My article gives a step by step tutorial for setting up the browser and computer so LSOs are deleted and kept off the hard drive. To complete the tutorial so it is effective for cross-platform use, I need to know where on Linux the "settings.sol" file is stored. I would really appreciate it if someone would post that information. I can have the tutorial online and ready to use within 30 minutes after I receive that information.

I hope this helps you understand the mysterious "settings.sxx" file.

Oh. One more thing: If you open the file with a text reader, you can read the basic settings that the offending Web site was trying to impose upon you and your computer.

Al
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
bought a new computer - moving key settings, files, etc DJOtaku Linux - General 3 09-18-2005 05:08 PM
is this dangerous? Kendo1979 Linux - Security 3 05-17-2005 11:31 PM
Location of Evolution files containing settings and other config options? carlos123 Linux - Software 1 03-13-2005 11:04 PM
Change around files and settings in a initrd file TCPMeta2k1 Slackware 2 10-01-2004 09:28 AM
Startup Files to Configure for personal settings AMH Linux - Newbie 1 06-05-2001 05:42 AM

LinuxQuestions.org > Forums > Other *NIX Forums > Other *NIX

All times are GMT -5. The time now is 06:02 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration