Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > Mac OS X > Run "users" - unknown users on the system?

Run "users" - unknown users on the system?
Thread Tools
Dedicated MacNNer
Join Date: Jul 2001
Status: Offline
Reply With Quote
Oct 27, 2004, 09:21 AM
 
Command "users" is supposed to list the login names of the users currently on the system

So I run it and here's what I get:

Code:
jilh:~ wunderkind$ users wunderkind tllp3e4200 dbz7hc1x hp40112085313
Wunderkind is me, but what are the next three lines? I've never seen this before. Somebody can explain?

The same with "who":

Code:
jilh:~ wunderkind$ who wunderkind_ _console_ Oct 22 00:01 wunderkind_ _ttyp1_ _ Oct 27 22:10 tllp3e4200 dbz7hc1x hp40112085313
Really puzzled Thanks.
PB G4 12" 1.5GHz/1.2GB/100GB/SuperDrive/AE/Mac OS X Tiger
     
Professional Poster
Join Date: Oct 1999
Location: :ИOITAↃO⅃
Status: Offline
Reply With Quote
Oct 27, 2004, 04:04 PM
 
Either you got hacked, or your /var/run/utmp file got corrupted. Hopefully the latter.

Run these two commands:
niutil -list / /users
and
niutil -list / /users home

Be prepared to back up your data and clean install.
     
Dedicated MacNNer
Join Date: Jul 2001
Status: Offline
Reply With Quote
Oct 27, 2004, 09:02 PM
 
Already checked NetInfo Manager and /Users. Nothing unusual there, just my two accounts.

And niutil -list / /users does not show anything unusual.

I found that I get such output from "users" and "who" only at work. And even there if I disconnect network cable, restart Terminal and run "users" and "who" again both list only me as an active user.

I am even more puzzled now.

And found this in system.log:

Code:
Oct 27 22:34:46 Wunderkind lookupd[2932]: lookupd (version 324.6) starting - Wed Oct 27 22:34:46 2004 Oct 27 22:34:47 Wunderkind set-hostname[2944]: setting hostname to tllp3e4200 dbz7hc1x hp40112085313 jilh
So is "tllp3e4200 dbz7hc1x hp40112085313 jilh" a hostname? But why does it show up in the output of "users" and "who" commands. And also - when I start the Terminal right below "Welcome to Darwin"?
PB G4 12" 1.5GHz/1.2GB/100GB/SuperDrive/AE/Mac OS X Tiger
     
Fresh-Faced Recruit
Join Date: Jul 2004
Location: Seattle WA USA
Status: Offline
Reply With Quote
Oct 30, 2004, 08:57 PM
 
ps aux | grep tllp3e4200

make sure they aren't running anything wakey

then
grep tllp3e4200 /etc/passwd

then try
netstat -f inet

make sure nothing is calling home .
(Last edited by johnmccaig; Oct 30, 2004 at 09:05 PM. )
     
Mac Elite
Join Date: Oct 1999
Location: San Jose, Ca
Status: Offline
Reply With Quote
Nov 2, 2004, 08:28 AM
 
It sounds like you are on a Windows Active Directory Domain and their DNS server is giving you garbage back. It is probably returning a string that contains non-valid characters, and a lot of the tools are having problems with it. I have never seen this issue... but there is always a first time. You might want to ask the network admin to look into what you have for entries on the server. It might be a 2 minute fix on his end.
     
   
Thread Tools
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Top
Privacy Policy
All times are GMT -5. The time now is 06:58 AM.
All contents of these forums © 1995-2011 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.7 © 2000-2011, Jelsoft Enterprises Ltd., Content Relevant URLs by vBSEO 3.3.2