When I login to my MacBook, I see my user as well as a use called Red. But if I go to my Users folder, there is no user called that. And if I go to my Users control panel, there is no user listed there other than mine. Ideas?

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

Run OmniDiskSweeper (free) on your Mac. It will give you a Hierarchical List of each folder along with the size.
Right-click on a folder and select "show in Finder".

You can use Cmd Shift period to toggle hidden folders and search for "Red" yourself.

Hopefully Red is not an intruder.

Report back what you find, please. Inquiring minds want to know.

---

Ed (modelamac)

I think I will just put an OUT OF ORDER
sticker on my head and call it a day.

Found nada.

everything is as it should be. I ran a command line to find hidden users and the only one that popped up was makerbot. Which I made visible, then deleted. But that was earlier today. My first thought was Red Giant software as I had installed a video plugin from them a while back. But no idea why it would show a fake user.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

Maybe this guy?

---

It is what it is.

....call Scooby gang......???

---

_____________________________________

I reject your reality and substitute my own!



Edited 1 time(s). Last edit at 11/20/2020 11:07AM by NewtonMP2100.

Tried looking at users with terminal?

No idea if this will help, but seems harmless to try.

---

rj
AKA
Vreemac, Moth of the Future

Quote
rjmacs
Tried looking at users with terminal?

No idea if this will help, but seems harmless to try.

Yep. Did that. Just found me. Then I found the command to look for hidden users. And found the makerbot. Then I found a command line to make hidden users visible. Then I went to the users and groups control panel and found the makerbot user and deleted it. Rebooted. Weird "Red" user is still there. And by "still there", I mean its there when I log in...but nowhere else.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.



Edited 1 time(s). Last edit at 11/20/2020 12:32PM by bazookaman.

Have you tried logging in as that user? Does it have a password hint set?

If it's due to some sort of corruption, maybe during the login process it will figure out the inconsistency and report some different error or clean it up, just a guess.

Is it there if you log in with a new account? Boot from archived external clone?

---

In tha 360. MRF User Map

Quote
GGD
Have you tried logging in as that user? Does it have a password hint set?

If it's due to some sort of corruption, maybe during the login process it will figure out the inconsistency and report some different error or clean it up, just a guess.

I tried. I don't think it had a password hint. I'll wait until I restart next to see.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

Quote
Filliam H. Muffman
Is it there if you log in with a new account? Boot from archived external clone?

That I don't know. I haven't tried either of those things. Actually I take that back. I USED to have two logins for myself. And when I got to the login screen, there would be my two logins and the Red login. But like I said, once I get past the login screen and into the actual computer, there's no sign of that Red user anywhere.

But I WILL try the clone boot when I get home tonight.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.



Edited 1 time(s). Last edit at 11/20/2020 01:28PM by bazookaman.

If that fails, try creating a new user called Red, see if you are allowed, if so, see if you then have two Reds showing up. If not, remove the newly created Red and both disappear (hopefully).

@N-OS: LOL!

This is worrisome. I’d nuke it from space and pave.
Care to share OS and suspicious apps?

Quote
hal
If that fails, try creating a new user called Red, see if you are allowed, if so, see if you then have two Reds showing up. If not, remove the newly created Red and both disappear (hopefully).

Well there you go. Unable to create a user called Red b/c one already exists.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

Quote
rich in distress
@N-OS: LOL!

This is worrisome. I’d nuke it from space and pave.
Care to share OS and suspicious apps?

Catalina. No suspicious apps.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

YES!!!!

Found this post on Apple:
[discussions.apple.com]

Which talks about an app installing a hidden user account. WTF for one thing???

Then one lone person who responded wrote this nugget:
sudo dscl . delete /Users/GhostUserNameHere

Copy/Paste/Change name. BOOOM! So long Red.

I wish I knew which app installed that. And why. It still makes the most sense that it was Red Giant. But I have no idea for sure. How annoying!

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

....scoob......bie...dobie....doo.....

---

_____________________________________

I reject your reality and substitute my own!

Good!!
Thanks for posting this, new step when troubleshooting

Ps: scoo beabadoobee do

Which talks about an app installing a hidden user account. WTF for one thing???


Installing a hidden account obviously gives the dev some advantage over not doing so.

The question is — what?

Data mining?

Crypto mining?

It wasn't an admin user account, was it?

Did you see what date Red was added?

Maybe an app was added the same day or just prior?

Could something like this be a function of a friend using your computer to visit a dodgy website?

I'd pass this experience on to Apple Feedback.

I'd also monitor your OS for it or another account popping up Lazarus/Whack-A-Mole style.

---

When a good man is hurt,
all who would be called good
must suffer with him.

Everybody matters or nobody matters.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

-An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

Mister, that's a ten-gallon hat on a twenty-gallon head.

I *love* SIGs. It's Glocks I hate.

Well thats the weird thing. When I searched for hidden users, there was no user named Red. I STILL never found any indication of a user named Red, other than a) the user showing at login and b) trying to create a new user named Red. Those are the only two instances. When I used the command line to search, Red did not show up.

And no. No one uses my computer but me. And I have no idea if it was an admin account. I couldn't find it to tell. I think I will pass this on to Apple.

---

__________________________________
There’s a guy wearing overalls with no shirt.
Which I think we all know is the International uniform for the last guy you’ll ever see.

Where's Sarcany? This seems like a question tailor-made for him....

---

rj
AKA
Vreemac, Moth of the Future

Sorry. No good explanation.

It seems like it might be a network-user account as a login by a network user wouldn't necessarily leave a home folder, but why would there be a network user logging in on a personal Mac? When was this Mac joined to a directory server? Doesn't make sense.

If it was a normal "service account" for an app or antivirus software then it would not appear at the login screen.

Hmm... Could be that there was a home folder, but it was remapped to another drive while the user was experimenting with one of those data-on-a-hard-drive-boot-from SSD scenarios, but I should think that's something he'd recall. Too late to check now to see what the path was to the user's home folder in the advanced Users & Groups settings.

---

Edited 1 time(s). Last edit at 11/21/2020 02:31PM by Sarcany.

....could it be....Ghost in the Machine.....??

---

_____________________________________

I reject your reality and substitute my own!