View Full Version : 2 Guest Users?

11-08-2017, 10:58 AM
My mac is slow, had an error in the system that asked to press any key, when restarted it was like this. What is this? Hacker? Whats happening?*https://imgur.com/a/z0nDF

11-08-2017, 01:56 PM
Can you please provide complete specs about your Mac model and year, and also which version of Mac OS X/OS X/macOS, it is running? Please give as much info/details, as possible. This will help us, to help you.

11-08-2017, 02:56 PM
MacBook Pro (Retina, 15-inch, Late 2013)
macOS High Serra

I identified through TinkerTool a user group called _guest, this "Guest" user had exclusive access to all the folders within him. In the public folder I could see a folder called "DropBox", I could not (even through TinkerTool) change user permissions to have access, but it was possible to identify that "Downloads" had 1 file.

I deactivated through the system preferences the guest user, even so while running the command "dscl .list / users" existed a Guest user. After some time the command started to appear the following error: "Can not open remote host, error: DSOpenDirServiceErr"

So I used the "ls -lha / Users /"

Total 0
drwxr-xr-x 6 root admin 192B Nov 8 14:29.
drwxr-xr-x 30 root wheel 960B Nov 8 13:34 ..
-rw -r-r-- 1 root wheel 0B Jul 15 17:35 .localized
drwxr-xr-x + 12 201 _guest 384B Nov 8 11:38 Guest
drwxrwxrwt 9 root wheel 288B Nov 8 15:24 Shared
drwxr-xr-x + 19 tor staff 608B Nov 8 14:07 tor

Now the command "dscl .list / users" has returned and the user has disappeared, even from the login area.

dscl. List / Users | grep -v '^ _'


dscl . list /Users






































































































11-08-2017, 02:56 PM
The code got too long so I threw it in the pastebin

dscacheutil -q user

dscacheutil -q user |
paste -d " " - - - - - - - - |
sed 's/^name: //;s/ [^[:space:]]*: /:/g'


I used Malwarebytes to scan but nothing was found, the same with MacScan.
Sorry for the bad English, google translate.