Does my Mac have Spyware?

Check this out:

201005190628

That’s the result of checking my plist files (basically preferences files – basically where Mac apps store things that would go into the registry on Windows) using a tool called OnyX, and finding a number of files that appear to be invalid. But it’s not the format of these files that worries me, it’s their names.

com.Diomgenic.Tupelo.plist
com.QuancesemsInvestments.Cynol.plist
com.Systerste.ZWork.plis
com.interejapan.floccule.plist
com.orangesource.whoso.plist


I found a number of threads with people asking about these files, here and here and here, but no answers.

I have two guesses as to what these files are. The first is that they’re related to malware. I doubt this, for various reasons – not just because it’s a Mac, but because I’ve been pretty careful about what I run, I haven’t seen any malware type behaviour on this computer, and well, it’s a Mac.

So my second guess is that these files are where some applications are storing licensing information. Things like whether a free trial has been started, or how many times you’ve run an application that’s locked to so many tries before it stops working. This would be a clever way to store this information – generate a real-looking filename based on some fingerprint you can get from the computer (like the serial number or MAC address). Generating unique filenames helps keep people from figuring out what they do by Googling for the name – you get very few hits for any particular name – and gives the app a way to find the file where the filename isn’t embedded in the application. And if you move the application to a different computer, you get a different key – different filename – so the app doesn’t work even if you move the plist file over.

Anyway that’s my guess.