1

I hate to sound like everybody else. I think my computer is being accessed by somebody, likely the somebody that gifted the computer to me. I don't thing it beneath him at all, or by somebody else.

Any tricks to find a hidden user via Terminal.

I swear I just got on computer and the screen flicked a few times showing different active share settings, but then when I accessed the actual system settings it was back to way I had it setup. Which I hope stops anybody from accessing.

How do can I verify via Terminal if somebody is on my computer. It's only in my physical presence, however it's burning thru fully charged battery in less then two hours.

I had this crash and thought it may be relevant to current possible scenario.

Process:               com.apple.WebKit.WebContent [2000]
Path:                  /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
Identifier:            com.apple.WebKit.WebContent
Version:               10603 (10603.3.8)
Build Info:            WebKit2-7603003008000000~3
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Safari [1959]
User ID:               501

Date/Time:             2017-12-05 06:12:06.596 -0800
OS Version:            Mac OS X 10.10.5 (14F2511)
Report Version:        11
Anonymous UUID:        02226814-09F9-0EEC-CF58-B3BDA3B12B6D

Sleep/Wake UUID:       A7F28CC0-C4E5-4F19-B2B9-E36DAC121165

Time Awake Since Boot: 18000 seconds
Time Since Wake:       14000 seconds

Crashed Thread:        1815  WTF::AutomaticThread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000008

External Modification Warnings:
Thread creation by external task.

VM Regions Near 0x8:
--> 
    __TEXT                 000000010d6d4000-000000010d6d6000 [    8K] r-x/rwx SM=COW  /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent

Application Specific Information:
Bundle controller class:
BrowserBundleController


Thread 0:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib          0x00007fff8e598136 __psynch_cvwait + 10
1   com.apple.JavaScriptCore        0x000000010e13637f WTF::ThreadCondition::timedWait(WTF::Mutex&, double) + 63
2   com.apple.JavaScriptCore        0x000000010ed656e2 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) + 2610
3   com.apple.JavaScriptCore        0x000000010e97269e JSC::Heap::stopIfNecessarySlow(unsigned int) + 254
4   com.apple.JavaScriptCore        0x000000010e97250f JSC::Heap::stopIfNecessarySlow() + 47
5   com.apple.JavaScriptCore        0x000000010e973064 JSC::Heap::decrementDeferralDepthAndGCIfNeededSlow() + 100
6   com.apple.JavaScriptCore        0x000000010ec9e748 JSC::Structure::materializePropertyTable(JSC::VM&, bool) + 1096
7   com.apple.JavaScriptCore        0x000000010e2a9b64 llint_slow_path_get_by_id + 948
8   com.apple.JavaScriptCore        0x000000010eb52f03 llint_entry + 11397
9   com.apple.JavaScriptCore        0x000000010eb56ae8 llint_entry + 26730
10  com.apple.JavaScriptCore        0x000000010eb56ee2 llint_entry + 27748
11  com.apple.JavaScriptCore        0x000000010eb5009b vmEntryToJavaScript + 299
12  com.apple.JavaScriptCore        0x000000010ea27eee JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158
13  com.apple.JavaScriptCore        0x000000010e15dbea JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 522
14  com.apple.JavaScriptCore        0x000000010e6572bd JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 173
15  com.apple.WebCore               0x000000010ffa1332 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) + 594
16  com.apple.WebCore               0x000000010ffa0f36 WebCore::ScheduledAction::execute(WebCore::Document&) + 134
17  com.apple.WebCore               0x000000010f1bc4dc WebCore::DOMTimer::fired() + 332
18  com.apple.WebCore               0x000000010f0e063f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175
19  com.apple.WebCore               0x000000010f0e057f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31
20  com.apple.CoreFoundation        0x00007fff994c4204 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
21  com.apple.CoreFoundation        0x00007fff994c3e93 __CFRunLoopDoTimer + 1059
22  com.apple.CoreFoundation        0x00007fff9953753d __CFRunLoopDoTimers + 301
23  com.apple.CoreFoundation        0x00007fff9947f428 __CFRunLoopRun + 2024
24  com.apple.CoreFoundation        0x00007fff9947e9f8 CFRunLoopRunSpecific + 296
25  com.apple.HIToolbox             0x00007fff8ddd356f RunCurrentEventLoopInMode + 235
26  com.apple.HIToolbox             0x00007fff8ddd32ea ReceiveNextEventCommon + 431
27  com.apple.HIToolbox             0x00007fff8ddd312b _BlockUntilNextEventMatchingListInModeWithFilter + 71
28  com.apple.AppKit                0x00007fff8f2958ab _DPSNextEvent + 978
29  com.apple.AppKit                0x00007fff8f294e58 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
30  com.apple.AppKit                0x00007fff8f28aaf3 -[NSApplication run] + 594
31  com.apple.AppKit                0x00007fff8f207244 NSApplicationMain + 1832
32  libxpc.dylib                    0x00007fff99bcf928 _xpc_objc_main + 793
33  libxpc.dylib                    0x00007fff99bd1030 xpc_main + 490
34  com.apple.WebKit.WebContent     0x000000010d6d5792 0x10d6d4000 + 6034
35  libdyld.dylib                   0x00007fff998435c9 start + 1

Thread 1:: Dispatch queue: com.apple.libdispatch-manager
0   libsystem_kernel.dylib          0x00007fff8e599232 kevent64 + 10
1   libdispatch.dylib               0x00007fff945c326e _dispatch_mgr_thread + 52

Thread 2:
0   libsystem_kernel.dylib          0x00007fff8e5934de mach_msg_trap + 10
1   libsystem_kernel.dylib          0x00007fff8e59264f mach_msg + 55
2   com.apple.CoreFoundation        0x00007fff9947fcd4 __CFRunLoopServiceMachPort + 212
3   com.apple.CoreFoundation        0x00007fff9947f19b __CFRunLoopRun + 1371
4   com.apple.CoreFoundation        0x00007fff9947e9f8 CFRunLoopRunSpecific + 296
5   com.apple.AppKit                0x00007fff8f35d56b _NSEventThread + 137
6   libsystem_pthread.dylib         0x00007fff9338905a _pthread_body + 131
7   libsystem_pthread.dylib         0x00007fff93388fd7 _pthread_start + 176
8   libsystem_pthread.dylib         0x00007fff933863ed thread_start + 13

Thread 3:
0   libsystem_kernel.dylib          0x00007fff8e598136 __psynch_cvwait + 10
1   libc++.1.dylib                  0x00007fff96a9bc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47
2   com.apple.JavaScriptCore        0x000000010ed7d39c void std::__1::condition_variable_any::wait<std::__1::unique_lock<bmalloc::Mutex> >(std::__1::unique_lock<bmalloc::Mutex>&) + 108
3   com.apple.JavaScriptCore        0x000000010ed7d31b bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() + 155
4   com.apple.JavaScriptCore        0x000000010ed7d1ed bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadEntryPoint(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*) + 29
5   com.apple.JavaScriptCore        0x000000010ed7d49d void* std::__1::__thread_proxy<std::__1::tuple<void (*)(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*), bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*> >(void*) + 93
6   libsystem_pthread.dylib         0x00007fff9338905a _pthread_body + 131
7   libsystem_pthread.dylib         0x00007fff93388fd7 _pthread_start + 176
8   libsystem_pthread.dylib         0x00007fff933863ed thread_start + 13


External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 2077
    thread_create: 2042
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 19253
    thread_create: 10820
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=316.3M resident=140.6M(44%) swapped_out_or_unallocated=175.7M(56%)
Writable regions: Total=1.2G written=37.2M(3%) resident=20.1M(2%) swapped_out=78.8M(6%) unallocated=1.2G(98%)

REGION TYPE                        VIRTUAL
===========                        =======
CG shared images                      144K
CoreAnimation                           8K
Dispatch continuations               8192K
Foundation                              4K
IOKit                                12.1M
Image IO                               84K
JS JIT generated code               128.0M
JS JIT generated code (reserved)    896.0M        reserved VM address space (unallocated)
Kernel Alloc Once                       8K
MALLOC                               73.1M
MALLOC (admin)                         32K
Memory Tag 242                         12K
OpenGL GLSL                           256K
STACK GUARD                          56.0M
Stack                                10.1M
VM_ALLOCATE                          81.1M
WebKit Malloc                        50.1M
__DATA                               29.3M
__GLSLBUILTINS                       2588K
__IMAGE                               528K
__LINKEDIT                           95.3M
__TEXT                              221.1M
__UNICODE                             552K
mapped file                          53.1M
shared memory                          68K
===========                        =======
TOTAL                                 1.7G
TOTA]

Any assistance appreciated.

2

The first thing to do with any computer gifted to you is to nuke & pave.

Nothing on there belongs to you anyway, not even the OS itself; any updates will require the credentials of the original owner... so trash it all & start over. Secondary benefit is you can be absolutely certain nothing can then spy on you.

See - Apple KB - What to do before you sell or give away your Mac

As the original owner failed to complete Steps 1 through 5, you can ignore & start from Step 6.

You would also benefit from having a more modern OS on there too.

  • Not to mention the user ID is 501 which is the first user macOS creates, likely the one you are logged in as. You could also try sqwarq.com/detectx But really wipe the drive and start from scratch, it's the safe thing to do. – Steve Chambers Dec 6 '17 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .