Page 3 - Adware

hector-samuels-computer:~ hectorsamuel$ ls -la /private/
total 0
drwxr-xr-x 6 root wheel 204 May 25 14:04 .
drwxrwxr-t 29 root admin 1088 May 25 15:31 ..
drwxr-xr-x 82 root wheel 2788 May 25 15:32 etc
drwxr-xr-x 3 root wheel 102 Jan 21 01:17 tftpboot
drwxrwxrwt 4 root wheel 136 May 25 15:37 tmp
drwxr-xr-x 23 root wheel 782 May 25 14:04 var
hector-samuels-computer:~ hectorsamuel$ /code]
-bash: /code]: No such file or directory
hector-samuels-computer:~ hectorsamuel$
hector-samuels-computer:~ hectorsamuel$ [code]
-bash: [code]: command not found
hector-samuels-computer:~ hectorsamuel$ ls -la /.info/
ls: /.info/: No such file or directory
hector-samuels-computer:~ hectorsamuel$

hector-samuels-computer:~ hectorsamuel$ cat /etc/hostconfig
AFPSERVER=-NO-
AUTHSERVER=-NO-
AUTOMOUNT=-YES-
CUPS=-AUTOMATIC-
NFSLOCKS=-AUTOMATIC-
NISDOMAIN=-NO-
TIMESYNC=-NO-
QTSSERVER=-NO-
WEBSERVER=-NO-
SMBSERVER=-NO-
SNMPSERVER=-NO-
SPOTLIGHT=-YES-

hector-samuels-computer:~ hectorsamuel$ ls -la /Library/Preferences/
total 136
drwxrwxr-x 22 root admin 748 May 25 15:34 .
drwxrwxr-t 43 root admin 1462 May 23 01:07 ..
-rw-r--r-- 1 root admin 1139 May 23 03:49 .GlobalPreferences.plist
drwxrwxr-x 8 root admin 272 May 23 00:49 DirectoryService
drwxrwxr-x 4 root admin 136 May 23 03:41 Soundtrack
drwxr-xr-x 8 root admin 272 May 25 14:04 SystemConfiguration
-rw-r--r-- 1 root admin 443 May 25 14:03 com.apple.BezelServices.plist
-rw-rw-r-- 1 root admin 418 Jan 13 14:22 com.apple.ByteRangeLocking.plist
-rw-r--r-- 1 root admin 691 May 23 03:44 com.apple.HIToolbox.plist
-rw-r--r-- 1 hectorsa admin 118 May 25 15:34 com.apple.SoftwareUpdate.plist
-rw-r--r-- 1 root admin 3473 May 25 14:03 com.apple.audio.DeviceSettings.plist
-rw-rw-r-- 1 root admin 1340 Jan 14 05:21 com.apple.dockfixup.plist
-rw-r--r-- 1 root admin 80 May 23 03:01 com.apple.driver.AppleIRController.plist
-rw-r--r-- 1 root admin 310 May 23 03:41 com.apple.iDVD.plist
-rw-r--r-- 1 root admin 378 May 23 03:42 com.apple.iLifeMediaBrowser.plist
-rw-r--r-- 1 root admin 311 May 23 03:41 com.apple.iMovie.plist
-rw-r--r-- 1 root admin 162 May 25 14:04 com.apple.loginwindow.plist
-rw-r--r-- 1 root admin 71 May 23 00:49 com.apple.networkConfig.plist
-rw-r--r-- 1 root admin 932 May 23 02:58 com.apple.security.plist
-rw-rw-r-- 1 root admin 856 May 23 00:57 com.apple.sharing.firewall.plist
-rw-rw-r-- 1 root admin 469 Jan 13 20:52 com.apple.xgrid.agent.plist
-rw-rw-r-- 1 root admin 344 Jan 13 20:52 com.apple.xgrid.controller.plist

those are the results of the commands.......
and right now, at this moment i was looking for some stuff in one of the tabs and i just got that "here are your heroic search results"
ive googled that and some other symptoms and everything takes me to the lil damn Netster...
what ive read is that is stores a cookie of whatever site i go, and the page is requested through a web server that supports ASP (thats why the new page that i get with the "heroic results" its URL always end in .asp) then i get that damn page, identically to the one of a search engine.....

http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21303608.html

this is a thread thats very similar to my problem... that netster url was the one i got at the beginning.. now i dont get that exact url, but i get the same page that i got with that url...
not even formating and reinstalling the osx helped...

What? Reinstalling didn't fix it? WTF? It's not an OSX virus then...

well, how did you re-install the os?

are you the admin on that computer?
os x works with permissions ... for operating at root level you gotta have the right permission e.g. the admin password for screwing around.

if you havea clean install of os x (no archive&install or sth. like that) and don't use a backup and are disconnected from the web, then that thing shouldn't be there, because they don't ship os x with it.

what i would do (actually i always do that) is:
- another clean install (goes fairly quick and painless)
- create a second user account - this one NOT with admin rights
- always use this account.

if sth. wants to install in the background it has to ask you for your password - your system gets much more secure through that.

now the wuestion is, how the spy/adware made it on the fresh system?
- from the outside - then turn on the firewall (have it always on anyways)
- use firefox instead of safari ... it claims to be fairly secure, set cookies to be accepted only on demand
- when you pull data from a backup, be suspicious and monitor any activity, a little program like 'Little Snitch' is very helpful (it monitors all traffic going FROM your mac)
- netbarrier is a good idea, i do not use it anymore though (i never had sth. like that netster thing)

now in theory, if your newly created account acts up - say after you pulled some old data from a backup, you can always delete the entire account, while being logged on as admin. anything 'alive' on the other account will not be able to change your root system.

it must be really aggrevating .... and i am sorry that the mac wasn't a good experience for you. i have had a million spyware on win machines and none yet on the mac.

other than these basic things, i wouldn't be able to help you out more ....
- frequent data backup
- firewall
- little snitch

thats all that worked for me ....

good luck and keep us posted

The default OSX account has root priveleges? o_O

yes... reinstalling the osx didnt help.. im not saying its from the osx tho... like i said, ive been looking around, and have dont TONS of research by now.. when i reinstalled the osx, i opened up safari to download firefox... i was online for a few minutes, maybe ten, and then i got that page again... for all the stuff ive read, i dont know how netster gets a cookie to your comnputer, like for example, if im in myspace, thru the image sierver or from werever you get a cookie like from myspace but with netster information and when you go to whatever page that uses that cookie, it requestes an ASP and then changes your page to the one with the "heroic results"
im not a pro in this stuff, but it makes sense to me because first of all i went to the cookines folder and found one from myspace that said that the name was netster.... before that in other ocasions, when i get that problem, i clear the cookies, clear the cache, and it goes away for a few minutes.... ive tried blocking cookies and whatnot but when i do, the internet is almos useless, and only by demand is difficult catching it cause it enters as part of whatever site your browsing......
*sigh* its so frustrating... i dont even use the computer as much anymore haha... i dont know what else to do... and to reinstall the osx again, first of all im out of dvds so atm i cant do backups, and to be honest, i think it wont help... just did it 2 days ago and 10 minutes after it it occured.....

if there were like an extension for firefox that you right a keyword and blocks the cookies with that word, it would be awsome... or maybe a program that doesnt relate with firefox but does the same thing

ok people ive made a backup of only firefox and its extensions.. im going to reinstall again the osx (damn an hour and a half ) and without conecting to the internet installing firefox and whatever and ill post here to see what happened.....

damn a friend of mine bought the new black macbook and its working perfectly with safari... grrr why it has to be me? hahaha

Make sure to do a full, clean install, not just a recovery.

And like kaskudoo said, create a normal account for day-to-day use.

yes i just did a clean install, not recovery...
the other user thing, a lil too late now... i just read the thread now.. and the reason why i was coming over here was that, i did as i said, i installed firefox, and i was downloading updates and whatever, and again, this time entering a macromedia site, BUM, i got the heroic results again...... i guess i have to live with that, till others get that too and the problem grows so much that something can be done lol....
i dont know how to do screenshots here, but im taking some pictures of the heroic results and the cookie that sa the netster thing, so you guys have a clear view of what im talking about......

just curiosity.... Does an ISP can be infected? like, whoever the company that provides internet in this complex, can be infecting the computers?
i ask that cause ive being thinking on it, and i dont remember getting that when im connected on Full Sail (school) or maybe there network is protected.. i dont know...
ill just post the pics in a minute

this is the page i get "Here Are your Heroic Search Results"

and this is the cookie

First of all, STOP GOING THERE.

Thank you.

Now, The moment you've reinstalled, I want you to do these things

In this order:

1. Log in
2. Create another account. This will not have admin priveleges
3. Log out
4. Log into the new account
5. Make sure the OSX firewall is strictly on
6. Install firefox
7. Connect to the internet
8. Goto some site that uses flash, not the macromedia site.
9. When the info bar pops up asking to install plugins, use that to install flash.
10. Save firefox config. It's now in a clean state.

I will contact macromedia and find out what the hell is going on.