I recently visited a website and on pressing a link another window automatically opened saying the website had found a virus on my laptop. Obviously this was a scam so I returned to the original website and tried the link again. This time the same thing happened so I closed the scam window and tried a third time. This time however the same scam page opened only an uncontrollable and loud beeping sound accompanied the warning and many files began to quickly and automatically download from the scam website and into my downloads folder on my dock. I was with a friend and she said that it looked like loads of circular coins were being downloaded. I immediately quit safari and permanently deleted the files that had downloaded from the scan website unfortunately without looking at what type of files they were. Then after searching online to find ways to identify and remove viruses and malware I downloaded Malwarebytes and Dr. Antivirus and did full scans where no threats were found. Then I wanted to see if my mac had been hacked by someone perhaps so i found advice on here:(https://www.techwalla.com/articles/how-to-find-out-if-your-computer-is-hacked) telling me to go into terminal and identify all the current users. All the users seem typical and normal except a user called "Guatoan" and I have no idea if this is normal or not and, if i am indeed hacked, if I can remove this user immediately? If anyone has had a similar experience or has any advice or knowledge regarding to anything I have said in this post that could help me understand better what is going on I would be extremely thankful! thank you very much
-
Is your Mac logged into a corporate network or such?– nohillside ♦Commented Jul 4, 2018 at 11:26
-
i don't think so, I used to use my laptop last year to log into my old university online system but apart from that I have no knowledge of being logged into a corporate network. Is there a way I can find out if I am? thanks for helping– James EmeryCommented Jul 4, 2018 at 11:31
-
Can you please copy/paste text from Terminal instead of using screenshots? Makes your text searchable and it's easier to use it to analyse stuff.– nohillside ♦Commented Jul 4, 2018 at 12:57
-
Assuming the timestamps are correct, the account was created on "Thu Oct 6 19:51:46 CEST 2016" and the last failed login occured on "Sat Dec 24 19:52:09 CET 2016".– nohillside ♦Commented Jul 4, 2018 at 13:04
-
Another user openly admitting to accessing a website that provides illegal services– user7886229Commented Jul 5, 2018 at 21:40
2 Answers
It’s not clear what user ID you are running - so to rule that out - what does this command show?
id
Next, you’ll want to inventory your backups to know if you can erase everything and or need to make a backup. Next you can inventory all the accounts - run this command
dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]'
This will fetch all the users with their respective directories.
Then you can delete the user using this. sudo is needed as the commands need to run as root.
sudo dscl . delete /Users/your user name(name from the output)
sudo rm -rf (dir from the output)
Only delete the dir if it is not one of the system ones - probably only do that if it is of for /Users/X where X is not one of your normal users.
If you don't recognize that user account, I'd say it's better to be safe than sorry - you should delete it. If you have a backup I would actually take it a step further and erase my disk and restore from my backup. Assuming that this is a hacker who has created an account on your mac, there's no telling what he has done/is planning to do. Common attacks are ransomware, cryptomining, and data theft.
