Easter Egg or Hacker?

Plebb - somebody who is complete crap at everything and cant do anything right, and to be honest is a complete noob at everything. generally used as an insult

I doubt Apple would include that as a log in screen message, thus you've been pwned.

Most commonly used backup methods explained

How to reinstall just OS X or erase/install OS X

How did you upgrade? Was the machine running Snow Leopard, or was this a fresh install with data migrated from somewhere else, and where did you obtain the Lion installer? Was this a used computer? Where precisely are you seeing that welcome message? Is this the sort of prank one of your friends who has physical access to the computer might have played on you? Does the name "Plebb" have any significance to you?

Your Mac has not been "pwned," as ds store suggests.

Your Mac has not been "pwned," as ds store suggests.

If someone had physical access to the machine and changed the log in screen itself, yes.

Some operating systems like Linux allow one to leave a message at the log in screen which appears when the person attempts to log in, this of course is not a hack, but someone had phyical access to your machine and if they knew what they were doing possibly could have time to do something.

Mac's are incredibly easy to crack via physical access to the machine on the default setup.

So in all intensive purposes you had a physical security breach with unauthorized access, thus you were basically pwned unless you can determine the persons responsible are unable to perform simple instructions to crack your Mac.

Mac's are incredibly easy to crack via physical access to the machine on the default setup.

Any computer is incredibly easy to crack when you have direct access to it.

Mac's are incredibly easy to crack via physical access

No easier than any other machine... and harder than some, depending on configuration.

And, of course, a real hacker with physical access and malicious intent wouldn't be so stupid as to announce his presence with a custom welcome message. There's absolutely no reason, based on the information provided, to recommend erasing the entire hard drive.

Like I said, you've been pwned. 🙂

Your options now are to either backup files manually off the computer and erase and install OS X, programs and return vetted files back on the machine or have someone do it for you as well as secure your network.

I have some tips here

WiFi security issues, at home and WiFi hotspots

Select Apple menu > System Preferences > Security & Privacy > General. Is the login message shown in the text box labeled Show a message when the screen is locked?

You have not been hacked. Macs are pretty much impossible to hack remotely with out-of-the-box settings, and even with every setting set as insecurely as possible, it's still just about impossible to hack a Mac remotely through whatever router you have installed to manage your network. It takes a unique combination of settings on the Mac, port forwarding on the router and poor password choices to get access remotely.

And you say nobody has had physical access, by which I assume you mean nobody untrusted. So it's either some kind of prank, where someone you know with physical access set the security setting Linc mentioned, or it was migrated somehow. (I'm a bit unclear on exactly what you migrated, to where and from where.)

As to the malware angle, there is no currently known Mac malware that behaves this way. While it is conceivably possible that you have encountered something brand new, not yet seen by anyone else, that for some reason announces its presence (counter-productive for modern malware, that wants to stay hidden), but that's quite unlikely.

Note that ds store's advice is often overly paranoid and a bit off-the-wall. Don't let him scare you into doing something too drastic unnecessarily. You do NOT need to erase your hard drive!

I can tell you two things about the word 'plebb' -

1. it's a common 'soft' insult for 'stupid' used mainly by the English

2. it would be unlikely to be used by anyone under the age of 35.

Got any 35-plus yr old English friends that have been anywhere near your computer recently??

EDIT:

BTW, 'physical access' means nothing more than 15 minutes at most if you're running Lion without FV2 enabled.. And that's assuming you have firmware password set. Without that, I could break into your system and change your passwords in the time it took you to go to the bathroom and back.

Yes, I'd got the impression that this was a fairly instantaneous thing. Still, it's possible that something was done to your Snow Leopard install before you upgraded. Snow Leopard's hardly more secure than Lion, but again along with others I'm still assuming a physical access intrusion, which doesn't seem to fit what you're saying

Can you still see the pleb message? Can you post a screenshot? Also, can you post a screenshot of your activity monitor processes.

Thomas would be better qualified than I to advise you on tracking tools, but I will say avoid anything like MacKeeper. Download Little Snitch for sniffing out traffic in and out of your compuer and ClamXav for AV ware (both free to download), but await more specialist advice from others on here before doing anything to remove the problem. It's as important to find out how it happened as it is to remove it if you want to ensure your system is safe from any future problem.

BTW, what if anything did you find in the preferences pane that Linc mentioned? Did it contain the 'pleb' message?