Warning: Suspicious User in the Users folder! Don't Panic?

Unless you physically glue up the ports on your computer, remove the wireless chips and all the other input capabilities, no matter how careful you are, it’s still possible to get caught out by unwanted surprises.

I was doing a bit of routine maintenance on my MacBook Pro over the weekend and I noticed an unusual item in the Users folder of my primary disk. At my local supermarket an “Unexpected Item In The Bagging Area” is the grocery shopper’s equivalent of an air raid warning, and is met with shivers, sweaty palms, red faces, and an overwhelming sense of wanting to go and hide in a deep hole. On a Mac, an unexpected User in the Users folder is even worse.

To make it worse, the unexpected user went by the name “tsninja”. Having any sort of ninja lurking, uninvited, on your computer does not bode well, and I immediately started panicking. How long had it been there, how did it get there, what was it doing there, and most importantly, what the heck had it been doing while it had been there.

What sane person creates a User account called 'tsninja'?

Let’s just add some context before going any further. I take precautions. I have firewalls in place, Little Snitch is installed and configured, I don’t spend my time surfing ‘adult’ sites, I have Malwarebytes set up to scan the laptop every day, the computer is protected with ultra-strong passwords and TouchID, and has never been accessible to members of the general public. In other words, it’s about as secure as it can be, within reason. But something had created this intruder user and I wanted to find out what.

Donning my best deerstalker, I began to investigate. Google didn’t proffer any useful indicators. I ran Malwarebytes again but it came up clean. I ran EtreCheck but nothing untoward there. I guess the smartest thing to have done now, would have been to attempt to delete the ‘fake’ user and get on with my life, but I couldn’t let it lie.

So I started to dig down into the tsninja folder, and this is what I found:

User folder tsninja appears to contain MS-Team configuration data

This didn’t look much like a normal User folder. A little further investigation on the internet suggested that the files at the lowest level of folders were configuration data for Microsoft Azure, and everything in the entire tsninja folder was timestamped on the same date and at the same time. Sure enough, I’d installed Microsoft Teams (for research purposes) at about the same time according to the system logs. By this time, some of the panic was beginning to seep away, but I really wanted a second opinion.

I asked some chums on the Mac To The Future (MTTF) Facebook group if they’d encountered anything similar. I got a response pretty quickly saying that they’d used MS-Teams for about six months but couldn’t reproduce the issue. I checked my fiancee's laptop because we’d also installed MS-Teams on her MBA. Nothing was showing up on her machine either. Signs of panic were beginning to reappear. My MTTF FB chums weren’t making any reassuring noises.

I decided to try a brute force experiment. I deleted the whole ‘tsninja’ folder. Interestingly it just let me!  Usually attempting to delete a Users folder would require a password at the very least. Anyhow it was gone, for now.

I relaunched MS-Teams and although it appeared to have to found a glitch it ran as expected. But lo and behold, as soon as I quit the programme, the ‘tsninja’ folder had reappeared in the Users directory. That was too much of a coincidence. But why was it showing up on my system but no-one else’s?

My only guess is that I had set my system up as the host for a Team, with my MBP effectively acting as a server, whereas my fiancée was a member of that team. The guys I was talking to on MTTF were also in a similar situation; they were members of other teams.

Ultimately, we collectively came to the solution that it is just shoddy programming by Microsoft. Despite (or maybe because of) Apple’s guidelines about where application support data files should be stored, Microsoft have a history of doing their own thing. In this instance, it’s cost me a bit of time trying to track down the root cause of the problem, and a few more ageing lines. And despite sending messages to the MS-Team product support people, they have declined to reply although I have now joined the MS-Teams community and started the discussion there. I’ll report back on any updates.

For now, I'm comfortable with my own explanation, and I'm not batoning down the hatches. But seriously, for a professional programmer writing business application software, creating a user folder called tsninja and sticking it in a reserved space should be a disciplinary offence. It's childish and unnecessary, and it's cost me a couple of lost days and an uncomfortable night. Time to grow up Micrsoft!

Mavericks Woes - Tracking Down the TrueSuite Culprit

Doggone - it's happened again! I was working on the MacBook Air yesterday morning and I had to restart the computer after installing an update but the machine went straight into its infinite reboot mode. I didn't even bother messing about this time - I just went ahead and restored from the previous Time Machine backup taken about 30 minutes previously.

Actually, that's not quite true. I did unplug everything except the mains cable - a step that I had previously neglected to perform when the problem first occurred. But that didn't make any difference.

However, I do think I may have found the culprit...Only time will prove the hypothesis correct, but it seems that the TrueSuite fingerprint recognition software may be responsible for the bad behaviour. Which is really rather ironic, since Apple bought Authentec - the original developers - about a year ago. [For more info about TrueSuite and fingerprint recognition on the Mac, I wrote about it in this post in July 2013]

I had come across some horror stories on the web about Mavericks not playing well with TrueSuite - that may be a bit of an understatement - users were reporting that they couldn't actually logon after installing Mavericks without uninstalling TrueSuite first - regardless of whether a fingerprint scanner was physically present. The general consensus has been to remove TrueSuite before even attempting to install Mavericks.

Whilst I never suffered the problem of being unable to login following a power-up, I did find that I couldn't log out and log back in without a full restart. So, yesterday morning, as I was doing some general housekeeping, I decided to remove TrueSuite using the appropriate uninstall programme. And the next thing I knew was that the machine would no longer reboot.

While I was restoring the system I started doing some more investigation along these lines and lo and behold, many users were reporting that if you tried to uninstall TrueSuite on a 10.9.x Mac it would not reboot and a restore would be required. In fact the safest thing to do was to restore to a Mountain Lion version, uninstall TrueSuite and THEN upgrade to Mavericks. Now you tell me!! After I've bricked two machines, one of them twice!

In fact, Apple have now published a work around for the problem which doesn't involve removing TrueSuite from a Mavericks machine. All that's required is to disable "Fingerprint Log On" from within TrueSuite. [December 12, 2013]

In summary:

• if you have TrueSuite installed and haven't yet upgraded to Mavericks, uninstall TrueSuite now, as this is the safest thing to do
• if you've already installed Mavericks, do not attempt to uninstall TrueSuite but disable the "Fingerprint Log On" option in the settings
• make sure you have a recent backup of your system whatever else you do

Other functionality within TrueSuite may or may not be working as expected under Mavericks, I've not had time to investigate properly yet. Don't take anything for granted though, and sadly don't expect your existing fingerprint scanner to work on a Mac through newer releases of OS X.

If you've suffered this or similar problems with TrueSuite under Mavericks, please let me know - there seems to be a lot of folk in the same predicament and it would be good to let Apple know that TrueSuite users are suffering and back it up with hard evidence.

Finally, as we head into the last full week before Christmas, my current Number 1 favourite game for the iPad is The Room Two. It's just as beautiful and evocative as its predecessor and great for casual gamers and puzzle solvers like me. And it's a snip at £2.99!

Happy Christmas everyone, and see you in the New Year!

Mavericks Woes - A Real Conundrum

Two weekends ago I had to return back to Apple Harvest HQ from my girlfriend's house to sort a few things out and to pick up some forgotten bits and pieces.

On the Sunday morning I booted up the MacBook Air for the first time since I'd arrived since I'd been using the iMac exclusively over the course of the weekend. Well, I tried to boot it up but it wasn't having any of it. The Apple logo would appear, then the start-up chime would sound and the spinning gear wheel would start, all as normal. Then the screen would flicker and the gear wheel would change appearance slightly before stopping completely. The screen would then flicker again, changing colour slightly, the wheel would spin a bit more and so on. But it wouldn't boot.

I tried rebooting in safe mode and although the safe mode progress bar would appear the result was the same. Boot failure. For the next hour, I tried every trick in the book. I cleared the PRAM, SMC, ran the internal diagnostics (no issues!), reinstalled Mavericks through booting up in recovery mode but nothing worked. The disk utility checks also indicated that the flash drive was OK. I had been thinking the worst - that this was a major hardware failure and was likely to be very expensive (although the MBA is still covered by Apple Care until next July) - but if the logic board had failed, or the video was knackered, then I wouldn't have been able to run any of the utilities or reinstall the OS.

I had a Time Machine backup from the previous Thursday so I decided to restore this as a last resort. It worked, and I've not had any problems since.

This last weekend I went back to HQ again to check on things. I've been remotely connected to the iMac via Slink but noticed that one or two updates had failed, so I decided to reboot the machine and try again. And guess what...Yes, exactly the same scenario as with the MBA. Complete boot failure under every attempt. The only difference on this occasion was that under the dual screen set-up, the extended display flickered rather than the main iMac display.

In this instance I was unable to fix the iMac - for some reason, Time Machine has not been backing up to the 3Tb Time Capsule for the last month so my most recent backup available was pre-Mavericks. However, I did clone the disk as a precaution should I lose the connection to the iMac from Mel's house. Sadly I didn't have it with me this weekend, and I also ran out of time, so I'm hoping that a clean install of Mavericks and a restore of the cloned disk will end up getting me the right result, namely a fully restored iMac.

How extraordinary that two different machines, with completely different configurations should fail in exactly the same way within a fortnight of each other. Coincidence? I doubt it, but I'm stumped as to the root cause. I can only guess that some installation or update of something has caused it - but it's now impossible to narrow it down. I've not seen the message boards or forums awash with this specific problem, although I have seen some similar instances, but no pain free solutions or root causes.

So, until I get home next week, there's nothing I can do except sit and wait, and hope that my proposed fix will work - note to self...remember to take the clone disk home and not write over it in the meantime!!!!!

Kernel Panics Can Seriously Damage Your Health

They say that getting married, moving house, starting a new job and bereavement are the most stressful things that happen to us in our lives. Well, they need to add installing a new or upgraded operating system to the list.

Having successfully installed OS X 10.8.5 on the MacBook Air while having breakfast this morning, I retired to the Apple Harvest office to repeat the process on the new iMac. I should add that both installations were being done through the Mac App Store - no magic tricks required for a routine software update. The OS asked for a restart as usual and when it had rebooted it went straight back into 10.8.4; on the MBA it went to a modeless dialogue box and showed the download progress.

I tried again, and this time I got the expected behaviour. The download proceeded without any problems but when it rebooted I got a multi language message saying something like "the computer had previously closed down because of an error. Wait a few seconds or press any key to continue". I pressed any key and the system went into kernel panic and rebooted into a continuous cycle.

I powered down, waited and restarted. Same thing. I tried to reboot from a different disk (holding down the Alt key) and was surprised to only see the main disk (no recovery disk nor any of the three external drives. Same problem on selecting the drive. I tried safe mode (holding down the Shift key) but it never even made it through the boot sequence. I tried diagnostic mode (holding down the D key) and that appeared to crash after 30 seconds. I was beginning to have my own kernel panic by now.

Not my actual system but you get the idea!

I tried resetting the PRAM (Cmd+Alt+P+R which requires considerable manual dexterity when you've only got little fingers like mine!). A glimmer of light. A new screen came up that I'd never seen before saying "attempting internal recovery" and then a little globe appeared with a progress bar underneath. This ran to completion, rebooted and the same error message appeared briefly before going into the Utilities app. Phew, I thought, at least the machine itself doesn't appear to be kaput.  My worst thought that the 3Tb Fusion drive was corrupt proved to be over-reaction.

I elected to reinstall the OS and after the longest hour of this year, finally everything is back to normal. My heart rate slowly went back to normal and then I noticed the date…Friday 13th September!