Today, I noticed a file on my desktop titled "in underwear and a shirt.txt".

I have no idea what it is, or how it got there. The contents of the file is similar to the title: "in underwear and a shirt?".

The modified date for the file is Today at 01:31:08, though my computer was not even turned on at this time.

Does anyone have any sort of idea where this file could have come from? No-one else has access to the computer, the room it is in is locked permanently.

  • I would be REALLY interested to know what is in the file. Please would you post it? – Scooby-2 Nov 5 '14 at 15:56
  • @Scooby-2, as I said in the OP, when opened with gedit, the file just says "in underwear and a shirt?" which is literally the same as the title. The file is 26bytes in size, and so I don't think that opening it with anything else would reveal anything. – user21611060 Nov 5 '14 at 15:59
  • Sorry, I missed that. At 26 bytes there is nothing other than "in underwear and a shirt?" in the file so nothing to worry about there. What about owner and group info? – Scooby-2 Nov 5 '14 at 16:10
  • Owner: Me, Read and Write. // Group: John, Read and Write. // Others: Read Only – user21611060 Nov 5 '14 at 16:11
  • Maybe check your Cron-jobs for something that is supposed to happen at that time. Oh and is SSH enabled? What about wake-on-LAN? – ApolloLV Nov 5 '14 at 16:12

There's a possibility you could've dragged a selected piece of text to your desktop by accident and that's how it ended up there.

|improve this answer|||||
  • I can't see that being it. My computer wasn't on at the time that it was created, and I don't even remember seeing anything similar to that piece of text before. – user21611060 Nov 5 '14 at 16:13

You can get more information by running

stat "in underwear and a shirt.txt"

which will give you something like

  File: ‘in underwear and a shirt.txt’
  Size: 26          Blocks: 8          IO Block: 4096   regular file
Device: 813h/2067d  Inode: 3950049     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/  kenm)   Gid: ( 1000/  kenm)
Access: 2014-11-05 18:29:12.797569514 +0100
Modify: 2014-11-05 18:31:35.921571618 +0100
Change: 2014-11-05 18:31:35.921571618 +0100
 Birth: -

This gives you more information about the file's details as shown above. The date of the file can be meaningless, as it's possible to change it with the touch command.

It's possible something/one set up an at job to copy the file there. cron, as already suggested by ApolloLV, was another possibility.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.