I was hacked, working with my router support all afternoon, meanwhile, I had an uninvited "guest" on my computer, who has locked me out of keychain password control...also can't delete the guest account. How can I undo the damage?? Using El Capitan on Macbook Pro.
MacBook Pro, OS X Mavericks (10.9.1), New 1T hard drive 8Gb memory
If you do not know the new keychain password, you will need to create a new one and delete the old. You will not be able to recover the passwords.
The guest account will remain if you have FileVault enabled or Back to My Mac enabled.
If someone had enough access to your Mac to change the keychain password, you need to log into every one of your online accounts and change the password. Do that from another computer, or after doing the following.
Since someone had access to your computer, you need to assume everything is compromised. You must Erase the hard drive completely and reinstall. Restore from a backup made prior to the intrusion.
Reset Password
Start the computer,then press and hold down command and R keys to start into recovery partition.
When you see the Apple logo, release the keys.
Wait until OS X Utilities window shows up.
Move the mouse pointer to the menubar at the top and click "Utilities", then select "Terminal"
from the drop down.
Terminal window will appear.
Type in resetpassword and press enter on the keyboard.
Leave the Terminal window open.
Reset Password Utility window will open with Macintosh HD selected.
Select the user account from the popup menu box under “Select user account”.
Enter a new password.
Reenter the new password for the user.
Enter a hint.
Click the "Save" button.
Click in the menubar and select Restart.
Log in.
If Keychain dialog box appears, select “Create New Keychain”.
Thanks to dominic23 for the concise steps.
Turn off FileVault encryption
When you turn off FileVault, encryption is turned off and the contents of your Mac is decrypted. The decrypting could take a while, depending on how much information you have stored. However, you can still use your Mac to do other tasks while the information is being decrypted.
Choose Apple menu > System Preferences, click Security & Privacy, then click FileVault.
Click the lock icon  to unlock it, then enter an administrator name and password.
Click Turn Off FileVault.
Click Turn Off Encryption.
Thank you so much...after looking at a few youtube videos, I learned how to delete the guest account altogether, which deleted everything the hacker did. I am now, trying to get Linksys to replace my router so I'll have a new MAC address...I'm sure the hacker can readily recognize this one...I have also entered the MAC addresses of all my devices and allowed only those MACs to sign on to my network. Unfortunately, 3 windows computers have had the internal network cards disabled. I have yet to deal with that. I have only had this Linksys Router 2 months, and they are wanting to charge me for another upgraded router/new mac address with only a $30 discount. Does anyone know a more secure router to use??
The Guest account deletes everything done in Guest when they log out. There was no need to delete it. A User in Guest cannot change anything on your Mac. There are no admin privileges in Guest.
I think there is some clarification needed on exactly what access the user had on your computer. If they were only able to log into Guest then there is nothing they could have done. However, if you let a "guest" at your home use your User account then they would have the ability to make changes.
See this link for info on MAC address:
Uninvited guest changed keychain password
