What does the red circle with white checkmark mean?

I just got this same issue today - did you find an answer? Not sure if it's due to filevault enabled or b/c of someone hacking my system...

If you are using 'Fast User switching' to change accounts rather than loging out the red circle and white tick mark shows who else on your computer is already logged in.

That, I know, but this wasn't when fast switching between accounts. This was waking up my MacBook Pro for the first time in a few days and finding two password requesting login screens. The first the unique one - grey background with the darker grey Apple Logo, my picture with the red encircled white checkmark which led to the normal second login screen that comes on whenever I wake up my machine normally with my background and a white box around my picture, name, and password box...

Is it repeatable or was it just that one time, I cannot replicate the double logon screens as you describe so it is difficult for me to advise.

If it was just the once I would ignore it, if it is repeatable I would contact Apple while the machine is new and get their advice.

I haven't been able to repeat it, which is why I'm still bordering on assuming my system was hacked. It happened for the first time after leaving my machine off for several days. So I'm assuming if I keep it off again for a few days it will repeat. If so, then I won't be worried anymore, but if not then I'm still trying to find out if it's FileVault or something to do with the waking process. Normally it never goes through two logins...

Could be the need to check and 'repair disk permissions' may help, as Disk Utility can do that; and from an admin account, it may resolve minor problems on all subsequent or lesser privileged user accounts. On other occasion, one may try & boot into SafeBoot, login, then repair disk permissions, and restart.

Hopefully this helps somewhat.

Good luck & happy computing! 🙂

Thanks for the tip - I just did that and the only weird one out of place was ARDAgent (pic below). Any idea what that is? Ton of ibooks and a few java permissions that need to be fixed, but those don't concern me as much.

I tried SafeBoot and it doesn't seem to go that route - I think the system is too fast for it to go that direction, but will try again.

Well, I've not seen that one before. In fact I had to click on it so as to read the tiny

text, then it appeared in another window as a .png image... so I retyped it + also

supplied a .jpg of the same image of different size. Too wide: automatically scale.

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.

...maybe this is large enough to see without clicking? It probably scaled small.

•About the actual topic in your reply, in regular size text:

{ did you upgrade from an older Mac OS X? from what?}

You mean it could not or would not boot SafeBoot?

Here's an official support topic page about it.

•OS X: What is Safe Boot, Safe Mode?

http://support.apple.com/kb/HT1564?viewlocale=en_US

Could be you need to start from a boot volume, or Recovery partition to repair it.

That is a more detailed way to repair disk & repair disk permissions, unmounted.

Not sure about that SUID thing, though. It may revert after a normal startup.

Maybe someone can offer better 'ways & means'... LOL!

Good luck & happy computing! 🙂

{edited 2x ... ps: maybe start a new topic if this one sees no action?}

Thanks for all the help guys - I left my system off for 5 days and then awakened it today and was able to replicate the same extra login screen. I no longer believe my system was hacked but rather an added security feature OSX does when a system is asleep long term. It may be FileVault or it may be just to shut everything down to conserve battery - either way was able to duplicate it by leaving my system asleep for several days. Thanks!