Login Screen/Process has changed. Is there another user?

Hi - Thank you for responding.

"anerismithe" is my home folder. It has 2 sections: (1) "favorites" (desktop, documents, downloads) and (2) "Devices" (Remote disc). Do you have any idea what this "remote disc" might be"? It does not open. I have no discs apart from what Apple put in the Mini.

It is conceivable that someone might have come in during the night to access the USB, but I saw no other evidence of entry. Two USB ports are occupied by me, mouse in one,keyboard in the other.

Where would I look for administrative wakes? I haven't set any. I'm told Apple does housekeeping.

No wake for WLAN or Wifi access that I know of. I have done what I can to disable Wifi, Bluetooth (except for keyboard), firewire connections. On occasion, WiFi has turned itself on. Bluetooth would open and lock into modem serial ports 1 & 2, even if I had cleared the field in advanced preferences.

Since I wrote there are now two additional login sequences and screen versions. I never know which one will present itself. Red checkmark or not, vault to open or not. The Mini shuts down when left in sleep mode. Not always.

I thank you so much for reaching out. What do you think I should do next?

Hi -

Appreciate your guidance. Here are the answers to your questions.

No calendar events in Sept. Four in Oct. (10/9, 10/12/, 10/20, 10/21) All on my Mac. All all day. No alerts set except the default. Calendar is not set up to interact with any programs including Cloud.

(Paranthetically, iCal is the first thing that crashed on the ipad, followed by Mail, Safari, account settings, Setup, Store, lockdownd_localhost - I understand this is not the ipad forum. Adding just in case it's related.)

I use no online backup.

Console wake search results: three types (no correlation with calendar or regular time of day)

1)

10/18/13 11:29:03.000 PM kernel[0]: Wake reason: XHC1

10/18/13 11:29:03.000 PM kernel[0]: AirPort_Brcm43xx::powerChange: System Wake - Full Wake/ Dark Wake / Maintenance wake

10/18/13 11:29:03.000 PM kernel[0]: The USB device CompositeDevice (Port 4 of Hub at 0x14000000) may have caused a wake by issuing a remote wakeup (2)

2)

My mobile device is an ipad, which Apple was kind enough to replace because of similar anomalies. I am keeping the iPad and Mini unrelated for now. They do not share an apple ID. I have put no apps on it. It has no iCloud storage. I do not play games on either. I did put my POP email account on the iPad. On the MacMini I access it through Safari. That's not a problem, is it?

The only other thing they share is the 2-wire modem/router. Mini is on Ethernet. iPad on the 2-wire Wifi signal.

About the login sequences changing, I will take careful notes. It has to do with whether I need to enter my username or just the PW, or both, or the PW twice and also with the appearance of the login screen.

Embarrasing to sound this ignorant, what is the Bluetooth PAN and Bluetooth DUN? I couldn't find it. Anyway, some of the network settings are not as I left them.

Truly appreciate your time. Wish I were more knowledgeable. Please tell me what to do or look at next.

USB 3.0 Hi-Speed Bus:

Host Controller Location:Built-in USB

Host Controller Driver:AppleUSBXHCI

PCI Device ID:0x1e31

PCI Revision ID:0x0004

PCI Vendor ID:0x8086

Bus Number:0x0a

Composite Device: Mini's name for the USB keyboard. Not @14000000. Not typo.

Product ID:0x0010

Vendor ID:0x0b38

Version: 1.02

Speed:Up to 1.5 Mb/sec

Location ID:0x14400000 / 2

Current Available (mA):500

Current Required (mA):100

Web Pro Optical: Infrared Mouse circa 2001. (Apple's is going to have to wait.)

Product ID:0x1926

Vendor ID:0x2525

Version: 0.00

Speed:Up to 1.5 Mb/sec

Manufacturer:Fellowes, Inc.

Location ID:0x14200000 / 1

Current Available (mA):500

Current Required (mA):100

OK. Im going to find out how to SafeBoot and move files. In the meantime, an error message on the iPad got me to look up the Airport app. It presented an network name and asked if I wanted to manage that network. If so, download Airport App. Is it possibe that my stalking symptoms and preference resets are the result of being networked by someone's Airport?

For what it's worth, I took another look at airport/wake: (Mini's WiFi is not turned on by me)

10/18/13 9:13:43.000 PM kernel[0]: AirPort_Brcm43xx::powerChange: System Sleep

10/18/13 9:13:52.000 PM kernel[0]: AirPort_Brcm43xx::powerChange: System Wake - Full Wake/ Dark Wake / Maintenance wake

10/18/13 9:13:52.000 PM kernel[0]: AirPort_Brcm43xx::checkInterfacePowerState: Check _pwrOffThreadCall!

10/18/13 9:15:55.000 PM kernel[0]: AirPort_Brcm4331: Ethernet address 28:cf:e9:00:2d:8d

10/18/13 9:16:04.252 PM airportd[71]: _processDLILEvent: en1 attached (down)

10/18/13 9:16:04.000 PM kernel[0]: AirPort_Brcm4331_P2PInterface::init name <p2p0> role 1 this 0xffffff8012857000

10/18/13 9:16:04.000 PM kernel[0]: AirPort_Brcm4331_P2PInterface::init() <p2p> role 1

10/18/13 9:16:10.000 PM kernel[0]: AirPort: Link Down on en1. Reason 8 (Disassociated because station leaving).

THanks. Again.

Thanks... I'd read the Freddy-Linc posts. It is hard to differentiate between apple's smoke &amp; mirrors privacy/security screens and uninvited screen sharing. I would turn off all the mentioned sharing preferences, then find them on on restart.

28:cf:e9:00:2d:8d is AirPort Extreme (en1) - wake on wireless, supported; air drop supported. It seems to jump into several minutes of action when finding power off. Not sure why it's interfacing with anything.

I find it most interesting that one port is more prone to interference...

Not sure I know USB naming conventions. There are four USB Ports. Keyboard in USB4. Mouse is usually not recognized, so gets unplugged, then plugged back in at random. When the charging cable for BT keyboard surfaces, it will go into one of the USB ports. I find it worrisome that it's not at hand. ESP since you asked if someone had USB access.

Still need to boot in safe mode.

Yes, I will do that. Got started in safe mode (boot).

Quirky restart. Cleared all history. Tabs not my favorites kept popping up. Deleted. etc etc... FForward: something I found this morning.

Disk Utility may not be able to verify or repair permissions on a software RAID setName: Untitled RAID Set 1 Unique ID: A7F6D953-229B-42AF-AEC2-90343622FF12 Type: Mirror Status : Online Size: 319. 7 GB (319728943104 Bytes) Rebuild: manual Device Node: disk2

Verifying permissions for “Macintosh HD”

Group differs on “Library/Preferences/com.apple.alf.plist”; should be 80; group is 0.

Permissions differ on “System/Library/Frameworks/CoreGraphics.framework/CoreGraphics”; should be lrwxrwxrwx ; they are lrwxr-xr-x .

Permissions differ on “System/Library/Frameworks/CoreGraphics.framework/Resources”; should be lrwxrwxrwx ; they are lrwxr-xr-x .

Permissions differ on “System/Library/Frameworks/CoreGraphics.framework/Versions/Current”; should be lrwxrwxrwx ; they are lrwxr-xr-x .

Permissions verification complete

Verifying permissions for “Macintosh HD”

Group differs on “Library/Preferences/com.apple.alf.plist”; should be 80; group is 0.

Permissions differ on “System/Library/Frameworks/CoreGraphics.framework/CoreGraphics”; should be lrwxrwxrwx ; they are lrwxr-xr-x .

Permissions differ on “System/Library/Frameworks/CoreGraphics.framework/Resources”; should be lrwxrwxrwx ; they are lrwxr-xr-x .

Permissions differ on “System/Library/Frameworks/CoreGraphics.framework/Versions/Current”; should be lrwxrwxrwx ; they are lrwxr-xr-x .

Permissions verification complete

________________________________________________________

There is also an iPod image capture installation that doesn't quite fit. What's a USB3?

OMG. Thank you so much for your guidance in the USB direction. This is the system report USB list after iPod image capture installation.

System Profile:

Model: Macmini6,1, BootROM MM61.0106.B03, 2 processors, Intel Core i5, 2.5 GHz, 4 GB, SMC 2.7f0

Graphics: Intel HD Graphics 4000, Intel HD Graphics 4000, Built-In, 512 MB

Memory Module: BANK 0/DIMM0, 2 GB, DDR3, 1600 MHz, 0x02FE, 0x45424A3230554638424455352D474E2D4620

Memory Module: BANK 1/DIMM0, 2 GB, DDR3, 1600 MHz, 0x02FE, 0x45424A3230554638424455352D474E2D4620

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x10E), Broadcom BCM43xx 1.0 (5.106.98.100.17)

Bluetooth: Version 4.1.7f2 12718, 3 service, 21 devices, 2 incoming serial ports

Network Service: Ethernet, Ethernet, en0

Serial ATA Device: APPLE HDD ST500LM012, 500.11 GB

USB Device: hub_device, 0x8087 (Intel Corporation), 0x0024, 0x1a100000 / 2

USB Device: hub_device, 0x8087 (Intel Corporation), 0x0024, 0x1d100000 / 2

USB Device: hub_device, 0x0424 (SMSC), 0x2512, 0x1d180000 / 3

USB Device: BRCM20702 Hub, 0x0a5c (Broadcom Corp.), 0x4500, 0x1d181000 / 5

USB Device: Bluetooth USB Host Controller, apple_vendor_id, 0x828a, 0x1d181300 / 8

USB Device: IR Receiver, apple_vendor_id, 0x8242, 0x1d182000 / 4

USB Device: Web Pro Optical, 0x2525, 0x1926, 0x14300000 / 3

(My monitor connects with an HDMI cable)

Do we have sufficient preliminary evidence that another user has access to my Mini? Maybe a neighbor...

Question re your last posr: New admin account... after the AC powered USB hub???

My apologies for being all over the place here. I hope it's not just ignorance that's driving suspicion. I have many screen shots and logs and will be happy to look through them if it would help answer any questions.

Message was edited by: LebCoPA

Embarrassing: http://support.apple.com/kb/index?page=hvkb&id=TS4284&agent=helpviewer

However

Last login: Thu Oct 24 10:57:46 on console

macvanagas:~ anerismithe$ diskutil checkRAID

No AppleRAID sets found

macvanagas:~ anerismithe$

Doesn't make sense - didn't do anything special @4:30

Last login: Thu Oct 24 16:22:59 on ttys000

macvanagas:~ anerismithe$ who

anerismithe console Oct 24 10:57

anerismithe ttys000 Oct 24 16:31

macvanagas:~ anerismithe$

This morning, the first history item was instructions to activate a u-tube device. I didn't have the proper code. For a time I owned, never used, and returned an apple u-tube accessible nanny cam. Just sayin...

Not able to bring these up on Terminal.

/Users/YourUserName/Library/Preferences/com.apple.Bluetooth.plist

/Users/YourUserName/Library/Preferences/ByHost/com.apple.Bluetooth.<HexNumber>.p list

/Users/YourUserName/Library/Preferences/ByHost/com.apple.Bluetooth.UnknownHostID.plist

I just get: No such file or directory. What am I doing wrong?

(Anerismithe's privileges seem to be limited. Also not allowed to uncheck "Allow Bluetooth devices to wake this computer" in sharing preferences.)

Been wondering about this entry in Mini -system -report -Network -Modems:

"No Apple modem found. If the Modem is external, make sure it’s connected via USB".

(Hope it's ok that I'm connected to the 2-wire with an Ethernet cable. BTW the cable is in Ethernet4, but it's Ethernet1 with the green light.)

OK. So I put mMac to sleep last night, it had turned itself off, I booted up this morning, login screen showed little apple above my chosen pic, checkmark in red circle next to Aneri Sanseur under pic, and a PW field. - Suspicious of that checkmark in red circle (it's appeared very recently), so I restarted... no checkmark. In the upper R corner next to spotlight, the name had always been Aneri Sanseur. The last few days its anerismithe. This evening when I click on it, on the pull down, the user is identified as Aneri Sanesur, there is a checkmark in a pink circle, and the field is grayed out. So I'm wondering how anerismithe went from being a file folder to... SO much to learn! Somewhere I read the checked red circle indicates being networked. Does it?