You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Suspected trojan

Sys Prefs on 2019 macbook air wanted a restart to install an update. Restarted. Got flashy questionmark folder. Also can't connect to my router to reinstall os!!! Was happily on internet b4 restart. Something is very wrong with this.


I am suspecting a trojan because a few weeks ago I got an email from "apple support". I now hover over email addresses to see the real address!! I didn't then and got a page saying some now forgotten bollox.


I immediately deleted all browsing history & cookies. When I tried going back into my email on the macbook air, it wouldn't let me in. On my imac I changed my e-mail password and for good measure, deleted cookies & history on my imac's browser, too.


All went well on the macbook air until now. Is it likely this could have allowed a bogus system update to show in system prefs? It seems too much of a coincidence. That and the fact that my macbook air is now locked out of my router, even within one metre of it, just adds to my suspicions.


Any thoughts?


Thanks in advance!

MacBook Air 13", macOS 10.15

Posted on Feb 12, 2020 5:46 PM

Reply
Question marked as Top-ranking reply

Posted on Feb 12, 2020 8:40 PM

Question mark


A folder with a question mark means that the selected startup disk isn't available or doesn't contain a Mac operating system. Learn how to resolve a flashing question mark.


Internet/Network Recovery of El Capitan or Later on a Clean Disk


     If possible back up your files before proceeding.


  1. Restart the computer. Immediately, at or before the chime, hold down the (Command-Option-R) keys until a globe appears.
  2. The Utility Menu will appear in from 5-20 minutes. Be patient.
  3. Select Disk Utility and click on the Continue button.
  4. When Disk Utility loads select the target drive (will be the out-dented entry) from the side list.
  5. Click on the Erase button in Disk Utility's toolbar. A panel will drop down.
  6. Set the partition scheme to GUID.
  7. Set the Format type to APFS (SSDs only) or Mac OS Extended (Journaled.)
  8. Click on the Apply button, then click on the Done button when it activates.
  9. Quit Disk Utility and return to the Utility Menu.
  10. Select Install OS X and click on the Continue button.



Similar questions

4 replies
Question marked as Top-ranking reply

Feb 12, 2020 8:40 PM in response to BonViveur

Question mark


A folder with a question mark means that the selected startup disk isn't available or doesn't contain a Mac operating system. Learn how to resolve a flashing question mark.


Internet/Network Recovery of El Capitan or Later on a Clean Disk


     If possible back up your files before proceeding.


  1. Restart the computer. Immediately, at or before the chime, hold down the (Command-Option-R) keys until a globe appears.
  2. The Utility Menu will appear in from 5-20 minutes. Be patient.
  3. Select Disk Utility and click on the Continue button.
  4. When Disk Utility loads select the target drive (will be the out-dented entry) from the side list.
  5. Click on the Erase button in Disk Utility's toolbar. A panel will drop down.
  6. Set the partition scheme to GUID.
  7. Set the Format type to APFS (SSDs only) or Mac OS Extended (Journaled.)
  8. Click on the Apply button, then click on the Done button when it activates.
  9. Quit Disk Utility and return to the Utility Menu.
  10. Select Install OS X and click on the Continue button.



Feb 14, 2020 7:50 PM in response to BonViveur

It was just coincidence. The problem had to result from damage to the directory or corruption of a system-related file or cache. That is assuming you didn't delete a file you shouldn't have but I don't believe that to be true. These types of problems are rare, if not caused by some improper user action. If the computer uses a HDD, then it can be caused by some issue with the drive like an abnormal shutdown or electrical storm. Usually, it is much rarer with SSDs because they have no moving parts. If an SSD has a defective chip, then, generally, the entire SSD dies.


An email is not likely to cause such a problem. Email malware usually does something obvious to the software like your browser. The malware can't get access to the computer's OS without some hacking occurring or taking advantage of a security hole. The object of that sort of malware is damage. Your problem was easily fixed without evidence of anything else happening.


Here's some things to look at so you can avoid potential email scams:


About Email and Other Scams


Apple always addresses you by your name or the name they have on file for you.  The Email will be from apple.comor itunes.com. Email addresses can be spoofed. You can go to Mail > View > Message > Show all Headers to see more. Apple Emails will never contain an attachment. Apple will never request personal information such as Social Security numbers.


An exception to the above is when you order something from the Apple Store. The receipt will be addressed to Dear Apple Customer.


Avoid Scams


  1. Identify and report phishing emails and other suspicious messages
  2. Annual Reminder- Watch out for email Phishing Scams
  3. Identifying fraudulent "phishing" email
  4. Beware of Browser Pop-Up Tech Support, Phishing Scams
  5. Phishing & Other Suspicious Emails
  6. Avoid phishing emails, fake 'virus' alerts, phony support calls, & other scams
  7. Phony "tech support" - "ransomware" popups and ... | Communities


Report phishing email to abuse@apple.com.


Feb 14, 2020 6:59 PM in response to Kappy

Hi Kappy,


Thanks very much for your reply. From it, problem solved and I have a fully serviceable laptop once again.


Out of interest, have you an opinion as to this problem having resulted from the suspicious e-mail I referred to in my original post? Or do you think it was just an awkward coincidence?


Thanks again for your advice,


Cheers,


BV

Suspected trojan

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.