1

I recently visited a website and on pressing a link another window automatically opened saying the website had found a virus on my laptop. Obviously this was a scam so I returned to the original website and tried the link again. This time the same thing happened so I closed the scam window and tried a third time. This time however the same scam page opened only an uncontrollable and loud beeping sound accompanied the warning and many files began to quickly and automatically download from the scam website and into my downloads folder on my dock. I was with a friend and she said that it looked like loads of circular coins were being downloaded. I immediately quit safari and permanently deleted the files that had downloaded from the scan website unfortunately without looking at what type of files they were. Then after searching online to find ways to identify and remove viruses and malware I downloaded Malwarebytes and Dr. Antivirus and did full scans where no threats were found. Then I wanted to see if my mac had been hacked by someone perhaps so i found advice on here:(https://www.techwalla.com/articles/how-to-find-out-if-your-computer-is-hacked) telling me to go into terminal and identify all the current users. All the users seem typical and normal except a user called "Guatoan" and I have no idea if this is normal or not and, if i am indeed hacked, if I can remove this user immediately? If anyone has had a similar experience or has any advice or knowledge regarding to anything I have said in this post that could help me understand better what is going on I would be extremely thankful! thank you very much

  • Is your Mac logged into a corporate network or such? – nohillside Jul 4 '18 at 11:26
  • i don't think so, I used to use my laptop last year to log into my old university online system but apart from that I have no knowledge of being logged into a corporate network. Is there a way I can find out if I am? thanks for helping – James Emery Jul 4 '18 at 11:31
  • Can you please copy/paste text from Terminal instead of using screenshots? Makes your text searchable and it's easier to use it to analyse stuff. – nohillside Jul 4 '18 at 12:57
  • Assuming the timestamps are correct, the account was created on "Thu Oct 6 19:51:46 CEST 2016" and the last failed login occured on "Sat Dec 24 19:52:09 CET 2016". – nohillside Jul 4 '18 at 13:04
  • Another user openly admitting to accessing a website that provides illegal services – JBis Jul 5 '18 at 21:40
5

It’s not clear what user ID you are running - so to rule that out - what does this command show?

id

Next, you’ll want to inventory your backups to know if you can erase everything and or need to make a backup. Next you can inventory all the accounts - run this command

dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]'

This will fetch all the users with their respective directories.

Then you can delete the user using this. sudo is needed as the commands need to run as root.

sudo dscl . delete /Users/your user name(name from the output)
sudo rm -rf (dir from the output)

Only delete the dir if it is not one of the system ones - probably only do that if it is of for /Users/X where X is not one of your normal users.

0

If you don't recognize that user account, I'd say it's better to be safe than sorry - you should delete it. If you have a backup I would actually take it a step further and erase my disk and restore from my backup. Assuming that this is a hacker who has created an account on your mac, there's no telling what he has done/is planning to do. Common attacks are ransomware, cryptomining, and data theft.

You must log in to answer this question.

protected by Community Jul 5 '18 at 13:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .