Strange activity in Terminal

Discussion in 'MacBook Pro' started by mrogers, Sep 1, 2011.

  1. mrogers macrumors member

    Apr 11, 2011
    There was a weird file that showed up in my search: XIORemoteServer.plugin

    So I clicked it and it opened in Terminal.

    Last login: Thu Sep 1 10:49:08 on ttys000
    MacBook-Pro:XIORemoteServer.plugin oaka33$

    What does that mean? And it said this file was last updated on May 2011 (before I even HAD this macbook). I thought I had all my remote login crap disabled.

    Then I did the "W" search on terminal and this came up:

    why are there 3 users? And what is ttys00?

    Last login: Thu Sep 1 10:50:10 on ttys000
    MacBook-Pro:~ oaka33$ w

    10:50 up 6 days, 15:11, 3 users, load averages: 0.52 0.86 0.70

    oaka33 console - 10:44 5 -
    oaka33 s000 - 10:50 - w
    oaka33 s001 - 10:50 - -bash

    MacBook-Pro:~ oaka33$
  2. Mal macrumors 603


    Jan 6, 2002
    Quick tip: Google searching the name of a file like that can often yield results easier than posting on the forums. In this case, it appears that it's a Epson Printer related file, not anything malicious. That's why it was last updated before you got your machine, because you haven't made any changes to it (and never would). You can safely ignore it.

  3. mrogers thread starter macrumors member

    Apr 11, 2011
    Thanks for that.

    But that is still weird, because I do not have any Epson devices, and this computer has only been used in my house in a secure wireless connection (where no Epson or printing devices exist). Any idea how something like that even got on my file? And would that be the "third" login that was listed in my Terminal?

    Also, does anyone know what exactly ttys000 is? It used to say "console" on my old macbook
  4. treestar macrumors 6502

    Feb 28, 2010
  5. mrogers thread starter macrumors member

    Apr 11, 2011
    Last login: Mon Sep 5 00:14:40 on console

    Now it says Console again. What is the difference between this and ttys00? I dont understand why that shows up sometimes instead of "console". If anyone can shed some light on this I would really appreciate it. Thanks
  6. treestar macrumors 6502

    Feb 28, 2010
    console is Terminal. ttys is a background process, I believe.
  7. mrogers thread starter macrumors member

    Apr 11, 2011

    I tried searching up more info on it, but I cant really find anything. Is there a reason that sometimes when I start Terminal it show my login history for "ttys000" rather than just console? What is this background process exactly and why is it showing up?
  8. treestar macrumors 6502

    Feb 28, 2010
    i think ttys is a protocol for communicating with external devices like printers, bluetooth keyboards, usb peripherals, etc., hence the IO in the XIORemoteServer.
  9. ChazinSeattle macrumors newbie

    Jan 12, 2012
    Not so sure...

    So I did a clean install yesterday of my machine. At least I thought that I had. How ever it appears that I may have some sort of MCX attached to my machine. It just feels fishy. I don't have any Epson devices on my machine either. But I did find that if I login to the network account server (Preverences > Users & Groups) while holding down the option key, that I was part of an LDAPv3 group.) This is my personal machine, not corporately owned. How to I remove myself from this 'domain'? Does anyone know how this may have happened to me?
  10. Ccrew macrumors 68020

    Feb 28, 2011
    The "network account server" uses LDAP to auth, hence you need to be a a member of that group. If you're not a member, you can't parse the LDAP directory tree and you can't authenticate.

    I understand if you put tinfoil on your head it helps. Really.

Share This Page