1

Today, I was trying to fix the file permissions and ownership on an external hard drive and while I was trying to add myself as a user/owner the through the get Info window, the system presented me with an unknown to me user with the name: _avqmd.

Of course there is no indication for such user in the system preferences -> users.

But I was also able to spot a avqmd.plist file inside: /var/db/dslocal/nodes/Default/users

Does anyone know what is this and from where it comes from?

  • What version of OS X? Can you dump the plist to inspect it? If it's binary, use plutil -convert xml1 -o - /path/to/user.plist You can then see if it has a shell, proper information added. Normally all the _ users as OS related, but it would be a cool place to hide a malicious account if you were to do such a thing. – bmike Jan 21 '16 at 20:32
1

_avqmd is an account created by the Avira anti-virus.

This account is used to run background tasks without the use of the overall priviliged account root. This is a correct security practice: separation of priviledge.

If you want to see what this account is used for, run for example:

ps -l -u _avqmd

If you didn't install Avira, then this account is a problem. For example, it might be a crapware trying to hide under the name of this software.

  • Hi, thanks for the answer. I remember me installing Avira at some point - but moments later I uninstalled it. So this seems to be leftovers. I also found late last night after googling, some references pertaining to the avqmd term relating to avira. Apple Discussions, and Avira Help – FFrewin Jan 22 '16 at 7:31
  • Apparently the uninstall process didn't finished its job. This is a common problem, and another good question. – dan Jan 22 '16 at 7:33
1

You might be able to get some more details on the user by querying your directory database rather than looking at the record files on the filesystem:

dscl . -read /Users/_avqmd

Hopefully you'll find enough threads to pull on. It's not an account on any of the first few Macs I checked, but perhaps someone else has tracked it down already and has a more concrete answer.

  • thanks bmike - I m still searching on it... but yet to find something on the web. – FFrewin Jan 21 '16 at 21:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .