Strange .plist Files Appearing in Preferences

Question

Level 1

14 points

Strange .plist Files Appearing in Preferences

Hi. I've posted this on the Waves forum as well as Digidesign, but just in case anyone here has seen something similar happen, I thought I would ask here as well...

When I start up Pro Tools 7.4.2 and select any of the Waves plug-ins, the following 12 .plist files appear in my User/Library/Preferences folder:

com.AdatemsDesign.NewQuality.plist
com.AltenearTechnology.DynaOnline.plist
com.AltenearTechnology.Infinisys.plist
com.AtenetsCorporation.Exocarp.plist
com.IncorPartners.Decompose.plist
com.LtrumIncorporated.Exocarp.plist
com.micrologyasia.cytoplasm.plist
com.Orangesource.Bibliographer.plist
com.REFTechnology.Enterprisedigital.plist
com.syspartners.achlorhydria.plist
com.systel.transmit.plist
com.Utilineau.Remove.plist

These files only appear when Waves plug-ins are used. I was unable to do any online search for these .plist files or even the odd "corporation-like" naming; and this is what has me concerned. The Digidesign people say "contact Waves", the Waves people say "those aren't our files", but still they appear -- even after two complete wipes and re-installs.

Has anyone encountered anything like this before? Regardless of the software used?

Thanks!

Rob

MacBook Pro Core 2 Duo, Mac OS X (10.5.4)

Posted on Aug 13, 2008 12:32 PM

Reply

Answer 1

nerowolfe

Level 6

13,090 points

Aug 13, 2008 12:57 PM in response to JoePrairies

I would look inside the files and see if there is any information there that might be of help
You might also create a new desktop folder and drag them into it and reboot.
See if they come back.
It's possible that someone hacked a plug-in or something like that.
Very peculiar, indeed.

Reply

Answer 2

JoePrairies Author

Level 1

14 points

Aug 13, 2008 1:52 PM in response to nerowolfe

Thanks for responding. That's a good idea... I haven't installed the plug-in bundle on this third re-install, but I think I will try and open the files to see what's there. The strangest thing is that none of those "company names" even registers in Google.

A hacked plug-in was my first thought, but this is a brand new, bought-and-paid-for Waves Musician II bundle. I even re-downloaded it just to be sure.

It hasn't done anything malicious to my system, but it has the effect of being an itch I just can't even figure out where to scratch.

I'll keep you posted! Thanks again,

Rob

Reply

Answer 3

nerowolfe

Level 6

13,090 points

Aug 13, 2008 2:19 PM in response to JoePrairies

JoePrairies wrote:
Thanks for responding. That's a good idea... I haven't installed the plug-in bundle on this third re-install, but I think I will try and open the files to see what's there. The strangest thing is that none of those "company names" even registers in Google.

A hacked plug-in was my first thought, but this is a brand new, bought-and-paid-for Waves Musician II bundle. I even re-downloaded it just to be sure.

It hasn't done anything malicious to my system, but it has the effect of being an itch I just can't even figure out where to scratch.

I'll keep you posted! Thanks again,

Rob

Many years ago I was testing a version of Word for MS and then mailed me a floppy on which to store my answers, keystrokes, etc. While MS had nothing to do with it, somehow the duplicator managed to get a virus onto the floppies. My AV caught it immediately, but my point is that you really have to be careful. Downloads can also be tampered with; this is why even Apple gives checksums and re-verifies all their own DLs. The internet is simply a very big LAN and stuff can always happen 🙂

Reply

Answer 4

JoePrairies Author

Level 1

14 points

Aug 13, 2008 3:38 PM in response to nerowolfe

That's interesting, and from what you describe, likely more common than might be expected. I can imagine particularly when you're redirected to some of those public access download hubs.

In this particular case, it's even more puzzling, because this has happened on the original Waves V5.9.7 bundle as well as the new V6. One other factor that might have some relevence is that Waves requires a dongle called an iLok key in order to be authenticated. That would be the one common factor that bridges the two versions (and two separate downloads). I'll try contacting the people at ilok.com to see what they have to say.

Curiouser and curiouser...

R

Reply

Answer 5

JoePrairies Author

Level 1

14 points

Aug 14, 2008 8:12 PM in response to nerowolfe

Update on things:

I reinstalled a different download file from Waves than before. The same unidentified .plist files showed up. I delete them and they show up again upon starting up Pro Tools and scanning the plug-ins. I had a look at them, but when I tried to open the file, they only read this:

Reply

Answer 6

nerowolfe

Level 6

13,090 points

Aug 14, 2008 9:50 PM in response to JoePrairies

JoePrairies wrote:
Update on things:

I reinstalled a different download file from Waves than before. The same unidentified .plist files showed up. I delete them and they show up again upon starting up Pro Tools and scanning the plug-ins. I had a look at them, but when I tried to open the file, they only read this:

I don't see anything. Maybe you left out something?
Be sure to use a .plist editor to read the file.

Reply

Answer 7

JoePrairies Author

Level 1

14 points

Aug 15, 2008 7:24 AM in response to nerowolfe

That's funny -- I copy/pasted the .plist from TextEdit into the message; it was just a couple of upward arrow symbols. It seems I can't place them without it disappearing after posting the message. Here's a couple of links to the messages I get when I tried to open one of the .plist files in Plist Edit Pro:

http://web.me.com/robertmichaelperry/Site/Picture1.png
http://web.me.com/robertmichaelperry/Site/Picture2.png

You can see on the second one that's all that shows on the raw text of the file.

Reply

Answer 8

nerowolfe

Level 6

13,090 points

Aug 15, 2008 8:14 AM in response to JoePrairies

JoePrairies wrote:
That's funny -- I copy/pasted the .plist from TextEdit into the message; it was just a couple of upward arrow symbols. It seems I can't place them without it disappearing after posting the message. Here's a couple of links to the messages I get when I tried to open one of the .plist files in Plist Edit Pro:

http://web.me.com/robertmichaelperry/Site/Picture1.png
http://web.me.com/robertmichaelperry/Site/Picture2.png

You can see on the second one that's all that shows on the raw text of the file.

I wonder if it's not some kind of placeholder or security thing. Still I am surprised that it did not turn up in an internet search.
If you wanted to, you could delete one of them and then create a plain empty text file with the identical name but change the permissions so that only you can read/write it - not even the system and see what happens. Does it still get replaced by the other one, or does something "complain" about not being able to write a file etc.
It is indeed a very curious thing.

Reply

Answer 9

JoePrairies Author

Level 1

14 points

Aug 15, 2008 8:41 AM in response to nerowolfe

Thanks for the suggestion. I tried creating one from TextEdit and replacing the name, then giving only myself read/write access (incidentally, there was no "system" access on these files, just Me/Staff/Everyone -- I assume because they are appearing in my Preferences folder and not the main system Library's folder). When I started up Pro Tools & instantiated a Waves plug-in they did appear again; however, the one I created didn't overwrite it. It looks like it just left it alone, because when I opened it in Plist Editor Pro the two little ^^ arrows were gone -- it was just blank.

Something else curious: the plist files' icons are now showing a little what-looks-to-be a Phillips-head screw top in the lower right corner:

http://web.me.com/robertmichaelperry/Site/Picture3.png

That's new. Not sure if it has something to do with the PlistPro app, but it doesn't appear to be so. Do you know what that indicates?

... thanks again for the assistance.

Reply