Cannot remove Unknown User

Hi just noticed in (OS X Mountain Lion) System Preferences, Sharing, Screen Sharing: I have a 'Unknown User' and too 2 'Unknown User' in the Remote Login.
See screen shots... got any ideas? (note clicking "–" does not remove the "Unknown User" they are stuck, hence my posting)
thanks

I had the same problem and i solved it (for Remote Login)
1) First remove all users that can be remove from GUI
2) shows the configuration of users
sudo dscl . -read /Groups/com.apple.access_ssh
example result:
AppleMetaNodeLocation: /Local/Default
GeneratedUID: 2F60778C-0931-47A4-B656-DBE07ACD843F
GroupMembers: 3D7C31B1-DEDE-4A5A-AAA8-CDD55645DC75
GroupMembership: youraccoutname
PrimaryGroupID: 404
RealName:
Remote Login ACL
RecordName: com.apple.access_ssh
RecordType: dsRecTypeStandard:Groups
3) remove the group GroupMembers that the user is unknown
sudo dscl . delete /Groups/com.apple.access_ssh GroupMembers 3D7C31B1-DEDE-4A5A-AAA8-CDD55645DC75
4) Go to System preference (dock) and see the result
excuse my bad english.
Ciao,
Andrea.
concretenz wrote:
Hi just noticed in (OS X Mountain Lion) System Preferences, Sharing, Screen Sharing: I have a 'Unknown User' and too 2 'Unknown User' in the Remote Login.
See screen shots... got any ideas? (note clicking "–" does not remove the "Unknown User" they are stuck, hence my posting)
thanks

Similar Messages

How do I remove (unknown) user in permissions & sharing, please?

I re-installed OS X with archive install. I am reinstalling preferences, etc... using Time Machine and my archived Previous System folder. However, many folders are marked and I have an (unknown) user with Read&Write Priveleges in Sharing & Permissions for files within 'Previous System' folders. I am unable to remove (unknown) with - and I have no option for setting 'No Access' to this user.
How do I remove (unknown) user with Read&Write Priveleges in Permissions?
Using Terminal, I have ascertained that my uid=501
Macintosh:~ symone$ ls -ladeO /Previous\ Systems.localized/Previous\ System\ 1/Users/symone/Library/Audio
drwx------+ 5 502 staff - 170 8 Sep 2011 /Previous Systems.localized/Previous System 1/Users/symone/Library/Audio
0: group:everyone deny delete
Macintosh:~ symone$ id
uid=501(symone) gid=501(symone) groups=501(symone),98(_lpadmin),81(_appserveradm),79(_appserverusr),80(admin)

Hmmm, doesn't sound good for your drive.
Check the S.M.A.R.T. status of the drive in Disk Utilty by highlighting the Drive & looking at the bottom of the window.
Could be many things, we should start with this...
"Try Disk Utility
1. Insert the Mac OS X Install disc, then restart the computer while holding the C key.
2. When your computer finishes starting up from the disc, choose Disk Utility from the Installer menu at top of the screen. (In Mac OS X 10.4 or later, you must select your language first.)
*Important: Do not click Continue in the first screen of the Installer. If you do, you must restart from the disc again to access Disk Utility.*
3. Click the First Aid tab.
4. Select your Mac OS X volume.
5. Click Repair Disk, (not Repair Permissions). Disk Utility checks and repairs the disk."
http://docs.info.apple.com/article.html?artnum=106214
Then try a Safe Boot, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, reboot when it completes.
(Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive.)
If perchance you can't find your install Disc, at least try it from the Safe Boot part onward.

Cannot remove a User Role

In the User Administration regarding the user roles when we select a user and search for his roles we can see his defined roles. We can edit some roles of the user but we cannot edit somre roles for example to remove a role. I can remove one role but i cannot remove another role. Can anyone tell me the reason why is this case and what is the solution.
thanks
murali

Hi,
You can assign one role to one user in two ways:
Direct asignment: You asign one role directly to one user.
Indirect asignment: You add a user to one group which is asigned to one or more roles.
Then, you can delete only roles in the first group. If you have a role because you have been added to one group you must delete user-group asignment to delete role asingment.
Hope to be understable.
Consider rewarding points.

Cannot remove deleted user from people picker - SharePoint Foundation 2010

So I think I've read all the people picker articles here and I can't find a solution so I thought I'd start a new thread. Here is the issue:
A user was deleted from Active Directory and removed from SharePoint Foundation 2010. The user was still showing in the People Picker within the site collection, so we have performed a few things to try and get rid of this user.
User is deleted from AD
User is deleted from SharePoint Site Collection
Have tried stsadm -o deleteuser
Have removed all mention of this user from UserInfo table
User does NOT show in
https://<SiteCollectionURL/_layouts/people.aspx?MembershipGroupId=0
Cannot find any mention of this user anywhere.
Ran a full crawl as we read on a forum somewhere that it might help.
If I try and add the user back to SharePoint I get "The user does not exist or is not unique"
If I try "stsadm -o deleteuser -userlogin DOMAIN\USER -url https://<sitecollectionurl>" I get "The user does not exist or is not unique"
I am not sure what else I can try now. Can anyone help?
Thanks,
Vinny
Vinny

No other domain trusts that this user could be in.
Just so everyone can stop with the warnings, we do NOT regularly delete users from the UserInfo table and fully are aware of the problems behind it, which is why it is so rarely done. But at times, you have to do what you have to do to help a customer, you
know? This one user is the only one that was removed from the UserInfo table, but there are a few other users that are also deleted (from SharePoint, not manually from UserInfo) that are still showing as well. This one user included.
There MUST be another place that the people picker gets it's information from. ALL of the user's old information still shows in the people picker (username, email address, display name), and yet none of that information exists anywhere other than in the
People Picker. Mailbox is gone from Exchange, User deleted from SharePoint, User deleted from Active Directory. Is there no cache someone could point me towards that People Picker might store information in.
Vinny

How do I remove a user? ( the name is greyed out and has a check next to it )

I cannot remove a user ( my wife ) from my Macbook. I go to Sys. Pref, Accounts, and unlock the lock ( I'm the Admin ). I'm able to click on and highlight the guest account but that's not what I want to delete. My wife's user name is greyed out and it has a check mark by it. I'm unable to highlight it so that I can remove it. There's gotta be a simple fix, right? Please help. Thanks, Michael K.

Which version of Mac OS X?
To delete a printer you have to select the printer (on the left), then click the - (minus sign). Which part of this is greyed out?

My PC cannot find my Mac and also it ask for a password and I put it in and tell Logon failure:unknown user name or bad password

I need some help on my MAC about them problem that I have and the question is: My PC cannot find my MAC and it ask a question about putting in the password and I did it come back and said: Logon failure: unknown user name or bad password.
Thank You
Lumpy

You have to explain a little more fully what you are trying to do and what protocol. Whats your set up?

Firefox downloaded with a virus cannot remove program from my computer.Have tried normal removing i.e control panel remove program I am a new user

Firefox has a virus attached. I download without an anti virus program in place.I now cannot remove current version of mozilla 3.6.3 from my computer. I've tried =control panel= add and remove programs nothing happens. I have all kind of problems trying to open mozilla and it constantly freezes and almost ever session displays restore session box. I would like to be able to remove this version and download again with anti-virus in place. I am new to using a computer and a lot of what I do is trial an error but I have always been able to add &remove programs. Thank you
== This happened ==
Every time Firefox opened
== I downloaded

Help->Troubleshooting information
Copy contents of the webpage
Paste them into your reply
Help->Troubleshooting information
Find on this page this part of table
Build Configuration about:buildconfig
click "about:buildconfig" link
copy contents of this page
paste them into your next reply
(separately from contents of previous page)
If possible, give link to the web-page from which you downloaded Firefox.
Are you opening Add&Remove programs as the same user which installed Firefox?
--------------------------------------------

Cannot remove user define fields

Hi,
I am trying to remove a user defined field (U_Prirev) in Table (OHEM) and am getting the following error:
Ref count for this object in higher then 0. Error No -1120
The code is as follows :
        Dim sRequete As String
        Dim errCode As Long
        Dim errMsg As String
        Dim IdField As Integer
        Dim oUFields As SAPbobsCOM.UserFieldsMD
        oUFields = oCompany.GetBusinessObject(SAPbobsCOM.BoObjectTypes.oUserFields)
        Dim oRecordSet As SAPbobsCOM.Recordset
        oRecordSet = oCompany.GetBusinessObject(SAPbobsCOM.BoObjectTypes.BoRecordset)
        sRequete = "SELECT FieldID FROM CUFD where TableId = '" & pNomTable & _
                   "' and AliasID = '" & pNomChamp & "'"
        oRecordSet.DoQuery(sRequete)
        If (oRecordSet.EoF = False) Then
           IdField = CType(oRecordSet.Fields.Item(0).Value, Integer))
            If (oUFields.GetByKey(pNomTable, IdField) = True) Then
                If (oUFields.Remove() <> 0) Then
                    oCompany.GetLastError(errCode, errMsg)
                    Console.WriteLine("Erreur => Code = " & errCode.ToString + " Message = " + errMsg)
                End If
            End If
        End If
             System.Runtime.InteropServices.Marshal.ReleaseComObject(oUFields)
        oRecordSet = Nothing
    End Sub
Anyone knows why i am getting this error.
Thanks
Laurent.

Hi Laurent
That error you are getting is the error that you get is when there is more than one instance of meta data object open. You see only one metedata object can be open at a time.....if it's higher than zero it means others are available. I see you have,
System.Runtime.InteropServices.Marshal.ReleaseComObject(oUFields)
oRecordSet = Nothing
this is good and what closes the meta data object. But check that you have done this in previous funtions where you might of added other things.Also your recordset, close it before adding.....move oRecordSet = Nothing to before your Remove of the field. that has be the case for me before. Do it without the recordset as a test and you'll see it works.
Hope it helps

Remove user, then cannot reuse that user's code

A client accidentally removed a user that he would now like to recreate. But is unable to because that user code still exists in the OUSR table. I tried the same thing in a test environment, I created a user 'donna', then removed her, then tried to create a new user with user code 'donna' and I get the following error:
"This entry already exists in the following tables 'Users' (OUSR) ..."
Is there a way to permanently delete that user entry from OUSR, or a way to reinstate that user in SAP again so that I can reuse the user code, but just change the information.
Thanks,
Sarah
Edited by: Sarah Anne Buchanan on Mar 11, 2008 4:57 PM

There is no legitimate way around this unfortunately, but...
"SELECT * FROM OUSR" will show all records in the database including your deleted user. I wouldn't delete it because it may have been used in old documents etc. But you can reinstate it with:
UPDATE OUSR
SET GROUPS=0
WHERE user_code='sophie'
The group will have been set to 99 when the user was removed.
Be very careful with this and make sure you get your WHERE clause right.

"Logon failure: unknown user name or bad password" even with correct Credentials

I have networked PCs before many times successfully, so this is not my first time trying to network PCs in a home environment. Though I’m wondering if Windows 8.1 is part of the problem.
I would have thought that for sure, until one of the new laptops running W8.1 would not connect to any of the other three PCs/Laptops running W8.1. Yet these other three W8.1 PCs/Laptops CAN connect to this laptop. Then it gets a little more interesting:
this same laptop that couldn’t connect to those three W8.1 PCs/Laptops, CAN connect to a Windows 7 desktop, and a XP Laptop, and those two can also connect back to it without issue. It’s almost like my network is divided in half, and only half can talk to
each other. But then when I thought it couldn’t get any more interesting, I realized the first three W8.1 PCs/Laptops can talk to the others, it’s just that the others (W8.1 Laptop, W7 Desktop, XP Laptop) can’t talk back to them without getting the error,
"Logon failure: unknown user name or bad password” even though the username and password are 100% correct.
I don’t fully understand this error, because on the surface, it’s just WRONG!
My username and password are correct, but it appears something somewhere is interfering or hijacking the authentication process. Three of the computers (laptops) are brand new, just purchased last week and setup this week. The HostPC is also fairly new,
just purchased last month.
I am not using a HomeGroup, and have removed all computers that were part of a HomeGroup. I have enabled file sharing and network discovery and enabled “Use user accounts and passwords to connect to other computers” on all PCs.
I have DSL and am using the wireless modem provided by my ISP which has router functionality built into it. It is a Sagemcom Model: F@ST 1704N.
All computers are connected wirelessly. Time is correct on all PCs. I cannot use Group Policy, since they're all Standard or Home edition. DHCP is enabled and all computers are on the same subnet, using the 192.168.254.x range of ip addresses.
The six computers are as follows: (I figured this may make is easier to visualize the layout)
HostPC: HP Desktop W8.1
PC Name: DrsBlend
U/N: DrsBlend p/w: 123456 (not showing my real password)
PC1: HP Laptop W8.1
PC Name: DrsBlend-1
U/N: DrsBlend    P/W: 123456
PC2: HP Laptop W8.1
PC Name: DrsBlend-2
U/N: DrsBlend    P/W: 123456
PC3: HP Laptop W8.1
PC Name: DrsBlend-3
U/N: DrsBlend    P/W: 123456
PC4: HP Desktop W7 SP1
PC Name: DrsBlend-4
U/N: DrsBlend    P/W: 123456
PC5: Dell Laptop XP SP3
PC Name: DrsBlend-5
U/N: DrsBlend    P/W: 123456
Every PC stated above has the same user name and password and is logged-in with the username, DrsBlend and the password 123456. The "Logon failure: unknown user name or bad password” happens when trying to access HostPC, PC1, or PC2 from PC3, PC4, or
PC5.
The HostPC can see and connect to all the PCs, but only PC1 and PC2 can talk back or access the HostPC.
It’s like the HostPC and PC1, and PC2 are in their own little clique, and can talk back and forth to each other. Those three PCs can also talk to PC3, PC4, and PC5 as well, but PC3, PC4, and PC5 cannot talk back to them (HostPC, PC1, PC2).
Profile corruption? I would have entertained that thought, but the fact the first three PCs can access and talk to one another kind of defeats that idea, and the fact the PCs were just recently setup.
Firewall? Disabled, and disabled TrendMicro with no change. With them on/off, the first three PCs can still talk to each other and the rest of the PCs.
Anyone have any additional suggestions?

Hi，
How did you connect to other PCs? Do you use RDP to connect to other PCs? If so, check the version of the RDP, as I know, some low version RDP can't connect to higher Windows like 8.1.
And could you please tell us the detailed information about how the six PCs connect to the home network?
Can PC1, PC2, PC3 ping back to host PC, PC1 and PC2?
You can also run command " rundll32.exe keymgr.dll, KRShowKeyMgr " view the credentials stored in your PC,check whether this issue is related with some old credentials stored in your system.
Yolanda Zhu
TechNet Community Support

With TSM adware removal tool I was able to remove unknown software that was making ads pop up when using Safari. So the y don't pop up anymore. The problem now is that when I open safari It is still downloading websites and after awhile it

With TSM adware removal tool I was able to remove unknown software that was making ads pop up when using Safari. So the y don't pop up anymore. The problem now is that when I open safari It is still downloading websites and after awhile it freezes the browser. I have to constantly go to Safari Preferences to remove them and then the browser will start working again. What can I do to stop this?

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the behest of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed:
☞ Copy a line of text in this window to the Clipboard.
☞ Paste into the window of another application.
☞ Wait for the test to run. It usually takes a few minutes.
☞ Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^$[0-9]+$ /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/ { next;} /(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]" "$1;b=b$1;} END { if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/$L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' '" L*/P*/*loginit*' 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA$|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true $ -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' -i4TCP:0-1023 com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D13 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-
Copy the selected text to the Clipboard by pressing the key combination command-C.
7. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start Time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

How do I remove the Certified Toolbar Search toolar??-- MALWARE -- tried everything I know -- cannot remove UIGGHH!!!

I have tried ALL the malware removal tools I know of and still cannot remove this!

hello, please install the search reset addon - it will revert the most common customziations those adware programs do in firefox back to the default: https://addons.mozilla.org/firefox/addon/searchreset/
if your settings don't stick after a restart of the browser also go to firefox > help > troubleshooting information > profile folder - "show folder", then a new window will open up. in this window look out for a file named '''user.js''' (it might be used to overwrite your custom settings). in case it is present , delete or rename this file and restart firefox afterwards.
[[Remove a toolbar that has taken over your Firefox search or home page]]
[[How to fix preferences that won't save]]

Unknown user

Hi everybody
after upgrade my os x to 10.5 I had problem with the "unknown" user. I had resolve my problem temporary with this article http://docs.info.apple.com/article.html?artnum=307128.
When I had resolve the problem I had remove the group from all my hd and than with the command "dscl . delete" I had removed the groups and users. At now if I do the command: dscl . list on terminal I don't have any more the group and user unknown.
But on my external hd(on macintosh hd I don't have this problem) when I create a new file or directory the user unknown come back!
I have the same problem if I attach any hd on my computer and make an partition with Mac OS file system.
there is other that I can do for delete the unknown user definitly?
there is another question: why when I create a group on terminal with that command: sudo dscl . create /Groups/"group_name" why can't I find under user and groups?
many thanks

Hi-
You would be much better off to place your post in the Leopard Forum.
This is a forum specifically for "Feedback about Discussions"- questions or comments regarding the entire Apple Discussions forum (or part of) only.

Unknown user in permissions

Why do the permissions for my Public Folder include an 'unknown' user? I cannot delete or change the permissions for this user.

I've reviewed some of the other threads. Seems like this problem doesn't 'have' to be fixed. I had never noticed it before, because I was never using the "public" folder and the 'drop box' feature. I got concerned mainly because when I did open this folder for the first time, I discovered a file (jpg) that was not mine and rather creepy. I thought perhaps the 'unknown' user was part of the problem (hacker), but since the folder had open access for the 'everyone' group as well that's probably how the file was put on my computer.

Unknown User account appears on login page

Hi,
Recently on my Login Page an unknown user has appeared on my computer. When I go to administer accounts the unknown user does not appear.
It has it's own avatar too...a human shadow with outer space in back of it.
I recently set up a myspace.com account, but that should not have done it.
I cannot get this thing off my computer and I fear I am being hacked.
Can anyone help me get rid of this thing and/or explain to me what it is?
Thanks, RWard

Gill
Welcome to Apple Discussions!!
I went to the link you noted but was unable to find 'security' in the linkTrue, all it says there is
The root user should only be used for specific administration or monitoring tasks. After completing a task as the root user, log out of Mac OS X and log back in using a normal or administrator user account.
Disable root access if you do not use it often.However, if anyone does manage to hack into your machine, he can do more damage if there is an enabled root account (he still has to guess the password of course). If root is disabled, that's another barrier.
If you are really interested, see Mac OS X: Security, and this PDF document: Security in Mac OS X

Cannot remove Unknown User

Similar Messages

Maybe you are looking for