Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On one of the mac machines I'm somewhat responsible for (Snow Leopard), something periodically changes the default login shell from bash to tcsh.

This seems like it's probably suspicious, but not necessarily so.

Has anyone heard of anything that will transparently do this without notifying the user? Is this a known malware sign?

share|improve this question
Are you able to change it back? You could check the crontabs and call launchctl list to see if there's anything suspicious. – slhck Nov 19 '11 at 9:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.