Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today when I tried to restart my machine, my log in screen showed a user named "Varnish". I have no idea when this was created.

Is it a virus or other malware inside my Mac?

share|improve this question
up vote 0 down vote accepted

OS X has basically three places it looks to find accounts:

  1. Locally-defined accounts, like you're already familiar with. You can see these account in the "Users & Groups" pane of System Preferences.

  2. Network accounts, defined on a Mac OS X Server Open Directory server or Windows Active Directory server. If your Mac is on an enterprise network and bound to an OD or AD server, you might see these accounts. You can see what OD or AD servers you are bound to in System Preferences > Users & Groups > Login Options > Network Account Server.

  3. External accounts, which are accounts on other mounted hard drive partitions, other local hard drives, or other local flash drives.

So, if I were you, I'd look to see if the "Varnish" account exists on any other partitions or hard drives or flash drives I've got mounted, then I'd look to see if I'm bound to an OD or AD server, then I'd look to see if "Varnish" is a local account.

Note also that when someone has physical access to a machine, they can create a local admin account. This is an intentional design choice by Apple, so you don't have to throw away everything and start over from scratch if you ever forget your password for your only account on a machine. With physical access to a Mac, there are a small handful of ways to create a new local admin account, so that you can get back into a machine that you had accidentally locked yourself out of. It's possible that someone used one of these tricks while you weren't looking, and created themselves a local account call "Varnish".

share|improve this answer
basically, this Mac only myself can access, I lock it when I am not around. Is it possible to check when does this Varnish user was created? Can check the log. I suspect might be Mac Software created this user. – Shiro Aug 24 '12 at 8:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .