Please visit the new Mac-Forums Facebook page:
https://www.facebook.com/macforums1




Results 1 to 11 of 11
  1. #1
    Guest User account logged in by itself and switched the camera on
    Hi
    I'm a bit nervous about what happened this morning with my MBP. First of all I have noticed a noise of the spinning cooler, which was pretty unusual and when I opened a lid I saw to my great surprise the Guest User session open. I have never used the Guest account myself and I'm absolutely sure that no one had physical access to my computer last night. I noticed that the built-in camera green light was on! When I started the resources monitor to find out why the cooler is on - I saw no process actively using CPU apart from the monitor itself. However the cooler was still spinning at a very high speed which I can recognize by the noise it was producing. I have downloaded and run a number of anti-malware and anti-virus apps including Avast, Malwarebytes, KnockKnock; but they didn't find anything. Could someone please shed a light on what could have caused this weird behavior of the MBP or what I could check to get more information about the incident.
    Cheers,

  2. #2
    Guest User account logged in by itself and switched the camera on
    Raz0rEdge's Avatar
    Member Since
    Jul 17, 2009
    Location
    MA
    Posts
    11,896
    Rep Power
    22
    There is no reason to have the Guest account enabled. So go into System Preferences->User Accounts and disable the Guest Account. Ensure that you have a password set for your account and that it is required to login after boot up or wake up.

    Once you've made that change, reboot the machine.

    If you haven't installed anything recently from any suspicious places, it is unlikely that your machine is affected by any malware and since there are no virus that affect the Mac, you should really remove things like Avast or anything else. Malwarebytes is fine.
    --
    Regards
    ...Ashwin


  3. #3
    Thanks for the reply. I have already disabled the Guest Account, which by the way might not work under High Sierra as explained in this article:
    https://www.techradar.com/how-to/mac...ow-to-fix-them

    I did not install any suspicious programs recently apart from the latest High Sierra update which I have applied 2 days ago :-)
    But still the circumstances look troubling to me:
    • spontaneous Guest login
    • camera light is on
    • high spinning speed of the CPU cooler with no apparent reason


    I'm just trying to find an innocent reason for all that to make myself confident that my computer was not compromised.

    Quote Originally Posted by Raz0rEdge View Post
    There is no reason to have the Guest account enabled. So go into System Preferences->User Accounts and disable the Guest Account. Ensure that you have a password set for your account and that it is required to login after boot up or wake up.

    Once you've made that change, reboot the machine.

    If you haven't installed anything recently from any suspicious places, it is unlikely that your machine is affected by any malware and since there are no virus that affect the Mac, you should really remove things like Avast or anything else. Malwarebytes is fine.

  4. #4
    Guest User account logged in by itself and switched the camera on
    Raz0rEdge's Avatar
    Member Since
    Jul 17, 2009
    Location
    MA
    Posts
    11,896
    Rep Power
    22
    That article suggests that an icon would appear even when the Guest account was disabled. I presume that if one were to click on that icon, it likely wouldn't login since the guest account is disabled, so the "fix" is more of a clean up of the icon to avoid confusion.

    The other thing you should ensure you've disabled is any of sharing, especially screen sharing. You will find this in the Sharing section of System Preferences.

    The CPU fan is designed to maintain good temps of the CPU and it would be at the higher speeds if the CPU was getting hot. In Activity Monitor that usually equates to one or more processes taking up a close to 100% of the CPU percentage for a sustained duration. The machine should also feel like warm, especially on the bottom toward the hinge.
    --
    Regards
    ...Ashwin


  5. #5
    Quote Originally Posted by Raz0rEdge View Post

    The other thing you should ensure you've disabled is any of sharing, especially screen sharing. You will find this in the Sharing section of System Preferences.
    I had checked that already - everything was disabled there.

    Quote Originally Posted by Raz0rEdge View Post
    The CPU fan is designed to maintain good temps of the CPU and it would be at the higher speeds if the CPU was getting hot. In Activity Monitor that usually equates to one or more processes taking up a close to 100% of the CPU percentage for a sustained duration. The machine should also feel like warm, especially on the bottom toward the hinge.
    That was precisely my worry - the bottom of the computer was warm, the fun was spinning with a high noise but the Activity Monitor shows no processes with a CPU usage above few percents.

  6. #6
    Guest User account logged in by itself and switched the camera on
    chscag's Avatar
    Member Since
    Jan 23, 2008
    Location
    Keller, Texas
    Posts
    58,432
    Your Mac's Specs
    2017 27" iMac, 10.5" iPad Pro, iPhone 7+, iPhone 8, Numerous iPods, Mojave
    Rep Power
    53
    Something woke your computer up and since the lid was closed, that caused it to get warm and that's why the fan increased in RPM. Whatever woke your computer up somehow activated the guest account and turned on your camera. Those things do not happen by themselves.

    Make sure you have all sharing turned off and also the option to wake the computer for Network activity is off. And of course, disable the guest account and set passwords like you've been told.

  7. #7
    Thanks, I have done already what you suggested. Hopefully that should make my computer secure.

    Quote Originally Posted by chscag View Post
    Something woke your computer up and since the lid was closed, that caused it to get warm and that's why the fan increased in RPM. Whatever woke your computer up somehow activated the guest account and turned on your camera. Those things do not happen by themselves.

    Make sure you have all sharing turned off and also the option to wake the computer for Network activity is off. And of course, disable the guest account and set passwords like you've been told.

  8. #8
    Guest User account logged in by itself and switched the camera on
    MacInWin's Avatar
    Member Since
    Jan 01, 2009
    Location
    Winchester, VA
    Posts
    6,355
    Your Mac's Specs
    MBP 15" Mid 2015, iPhone XS, an iMac, plus ATVs, AWatch, MacMini
    Rep Power
    26
    You might also check the password on your WiFi network and change it to be a strong password and not the default or easy. That could be the vector for the wakeup and maybe even the guest account login.
    Jake

  9. #9
    Thanks for the suggestion, in fact I did that already a while ago - my router password has always been long and strong.
    By the way are there any logs which could be checked to find out if there was an intrusion to my computer?

    Quote Originally Posted by MacInWin View Post
    You might also check the password on your WiFi network and change it to be a strong password and not the default or easy. That could be the vector for the wakeup and maybe even the guest account login.

  10. #10
    Guest User account logged in by itself and switched the camera on
    chscag's Avatar
    Member Since
    Jan 23, 2008
    Location
    Keller, Texas
    Posts
    58,432
    Your Mac's Specs
    2017 27" iMac, 10.5" iPad Pro, iPhone 7+, iPhone 8, Numerous iPods, Mojave
    Rep Power
    53
    I don't think the logs will show that. However, there's a real good program that will tell you that and also much much more. It's called "Little Snitch" but it's no longer a free app. A bit pricey at $45 per single license but well worth it if someone or something is attacking your computer.

  11. #11
    Thanks, I'll give it a try.

    Quote Originally Posted by chscag View Post
    I don't think the logs will show that. However, there's a real good program that will tell you that and also much much more. It's called "Little Snitch" but it's no longer a free app. A bit pricey at $45 per single license but well worth it if someone or something is attacking your computer.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Guest Account can search for User Private Files on Spotlight
    By simonvee in forum macOS - Operating System
    Replies: 2
    Last Post: 09-22-2014, 10:47 AM
  2. Cannot search when logged into Google account
    By JDJetz in forum Apple Desktops
    Replies: 0
    Last Post: 10-23-2013, 10:06 AM
  3. Replies: 2
    Last Post: 01-11-2013, 11:05 AM
  4. Guest Account help
    By Chris H. in forum macOS - Operating System
    Replies: 25
    Last Post: 08-10-2010, 06:11 PM
  5. How to get rid of Guest account
    By cadsmn in forum Switcher Hangout
    Replies: 0
    Last Post: 02-23-2006, 04:23 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •