Account users terminal list

PowWow332 wrote:

I ran dscl . -list /Users to see the list of users on my Mac, im not sure if all of them are "authentic" can someone please tell me if any of them look off?

Nothing looks off.

the whole dump from A to Z < _accessoryupdater...._xserverdocs > all part of the Directory Service.

You would be better off with a more refined command

This will list all registered users on you computer that you would be interested in for a list of users:

dscl . list /Users | grep -v '_'

normal example would be similar here:

daemon

YourUserName

nobody

root

PowWow332 wrote:

Thanks for the link, this is my first Mac product, it’s a 2019 M1 MacBook pro, was _clamav something preinstalled on all Mac products? I’m assuming it is, and didn’t come with something i specifically installed. Thanks for taking time and responding to me, it’s much appreciated!

I am confident there are many many things in that long list you have no idea about.

The reference above goes back to OS X 10.5 from 2006. The _clamav still shows up in current package and shows up in the most recent macOS 15.4. I would not be concerned. You have no control there.

I would not waste any more time on a non-issue.

dscl . list /Users | grep -v "^_|daemon|nobody|root"

avoids everything but the real user (e.g. human) accounts configured for the Mac.

This is an artifact from an old install, and has followed you as you migrated forward.

You can safely ignore it, it does no harm and is not active since you no longer have the application. I would not be concerned.

current macOS 15.4

Could you provide some background on this?

Because this topic can head in different directions.

It’s quite difficult to prove a negative, for instance; that no compromise exists.

When looking at account listings, consider that an attacker could compromise a legitimate account, or could replace a legitimate account with their own. They could enable root access and set a password, here.

If you suspect or have evidence of an existing compromise, you’re usually headed for a re-install from known-good sources.

_clamav is part of macOS 13. I don’t have macOS 15 handy to check. But given concerns about _clamav, this discussion certainly looks familiar.

PowWow332 wrote:

That screenshot from your device, correct?

Also, thanks for this, I simply just wanted to know if others saw this on their machine,

yes this is my current working macOS 15.4 screen shot from the Terminal.app

you can also see it listed in the deprecated article going back to Security Update 2009-001...

About the security content of Security Update 2009-001 - Apple Support

PowWow332 wrote:

I’m trying to move away from this, but my mac is 2019 m1. If this isn’t something pre-installed on my mac, how could it have gotten there? Regardless, it’s not something i should be generally be worried about, right?

ClamAV is not installed on your Mac. No Mac has had ClamAV pre-installed in the last decade or so.

As for “worry”, there are certainly other things to be aware, which can include the sorts of problems that can arise from add-on security apps, from “coffee shop” VPN apps, bad password choices including re-used passwords, two-factor authentication not being enabled on an Apple Account, lack of encryption, and a variety of other security-related topics.