iMac infected with virus that creates hidden windows partition, won’t boot from USB or internet recovery

I have an iMac that has got a serious virus on it. The hard drive is 500gb, but when I format it using disk utility, the drive says it is only formatted to 465 gb, then when I load it in OSX Catalina, it says the drive is 500gb and doesn’t show a bunch of hidden partitions the virus has created.


It seems the virus has its own boot loader and it disables booting from USB and internet recovery. I can start internet recovery but then the Apple symbol comes up and it boots from the virus’s recovery disk, which is sometimes a Catalina disk and sometimes it’s a Snow Leopard or El Capitan boot menu.


The virus has created hidden windows partitions and hidden Mac partitions which are ejectable hidden drives that I can only see from using hdutil list in terminal when I boot from the fake internet recovery.


I was able to use GPT fdisk to remove one of the windows partitions, but when I go to delete the other partitions they come right back after I zero the drives in terminal from the fake internet recovery, and I can’t boot from USB. I’m pretty sure the list of partitions I see in terminal is a fake list because it doesn’t propagate the window fully when I open the terminal to a different sized window from the one I originally ran hdutil list in.


Im totally stuck, if I boot in verbose mode I can sometimes get it to work, but I can’t boot from USB or a real internet recovery because the virus’s fake boot loader denies access to a real install disk and has a hidden 40gb partition that I can’t delete and it just puts the virus right back on after I format.


Can anyone please help me figure this out?

Posted on May 25, 2020 10:35 AM

Reply

Similar questions

62 replies

May 25, 2020 11:59 AM in response to soundboy13

You can't even begin to believe how far off into left field you are. I'm not even sure where to start, there's so much wrong with your statements.


Let's start with the massively illogical argument that you think you have a Windows virus.


  1. You don't have Windows installed.
  2. A Windows virus can only run in Windows.
  3. So, um, exactly how is a Windows virus running on a computer that doesn't even have Windows on it?


Check our what I see from disk utility in the fake Catalina base system install when I try to boot from internet recovery.

That's the Recovery partition the Mac boots to when you choose to startup in Recovery Mode (Command+R). It shouldn't even be visible. That you managed to make it visible is a good sign you destroyed it. Good job.


Your next couple of posts and screen shots only repeat that you think a hidden disk image that's supposed to be there is a problem. It's not. Except you now made it one by wrecking it.

Here is some more photo evidence of a program that I didn’t install that can now access my computer.

Every single Mac has that function. It's proof of nothing.

5 minutes from booting the computer I have 115,000 console messages.

Whoop-dee-doo. Every computer running Unix will pile up that many messages, or more, in that amount of time.

May 25, 2020 12:11 PM in response to Kurt Lang

I didn’t install windows on the computer, the virus did. If I’m installing Catalina from internet recovery using Ethernet after I just totally formatted the hard drive and then it boots and my wifi settings are populated and I didn’t put in the password, then obviously the 35gb partition is saving some information and I’m unable to format the hard drive because there are hidden partitions.


The computer has a virus and it won’t boot from USB and the internet recovery is a boot loader that is fake and uses a 2gb OSX Install disk that is on my computer every time I boot it. Sometimes it boots at Catalina, sometimes it boots as older OS versions.


There are hidden partitions on the drive, I can’t access them, and I can’t delete them and I didn’t install windows but GPT fdisk says it’s installed.



Take a look at the picture where it clearly shows the 500gb drive is formatting as 465gb. Every other time I formatted the drive it totally erased the drive to 500gb space. Now it saves 35gb to keep the virus. I can’t boot from USB or use the real internet recovery because the internet recovery that you claim that I broke, is actually a boot loader that uses the virus partition to install the OS instead of the real internet recovery.


What more proof do I need? All I’m asking for is a partitioning tool that will override the boot menu so I can wipe the drive because the fake disk utility and fake terminal won’t allow me to delete the 35gb partition that contains the virus.

May 25, 2020 12:21 PM in response to soundboy13

Except I’m not running windows and I didn’t install windows on the computer, I installed Catalina.
I didn’t install windows on the computer, the virus did.

Do you have any idea - at all - how ridiculous that is? You're describing a thoroughly impossible loop.


  1. You don't have Windows installed.
  2. You somehow have a Windows virus anyway.
  3. The virus, which requires Windows to run, installed Windows. Something you couldn't have possibly missed happening.
  4. Except, it's impossible for the virus to install Windows since it requires the presence of Windows to run - at all.
  5. Go back to step 1 and keep repeating this very literally impossible sequence.


the fake disk utility and fake terminal

Wow. Just wow. Where did these "fake" utilities come from? Saturn? There's no penetrating this much utter nonsense and paranoia.


I sure won't be wasting any more time on this topic. I may continue reading it for the fantasy entertainment value, but nothing else.

May 25, 2020 1:30 PM in response to soundboy13

Normal, in terminal execute this command...


diskutil info -all


Down on the list you'll see...


  Device Identifier:    disk0s1

  Device Node:       /dev/disk0s1

  Whole:          No

  Part of Whole:      disk0


  Volume Name:       EFI

  Mounted:         No


  Partition Type:      EFI

  File System Personality: MS-DOS FAT32

  Type (Bundle):      msdos

  Name (User Visible):   MS-DOS (FAT32)


  OS Can Be Installed:   No

  Media Type:        Generic

  Protocol:         SATA

  SMART Status:       Verified

  Volume UUID:       0E239BC6-F960-3107-89CF-1C97F78BB46B

  Disk / Partition UUID:  14F65236-8282-4FEE-A916-01189FD6ADA3

  Partition Offset:     20480 Bytes (40 512-Byte-Device-Blocks)


  Disk Size:        209.7 MB (209715200 Bytes) (exactly 409600 512-Byte-Units)



May 25, 2020 4:02 PM in response to BDAqua


That's my report. Is it normal to have a 2gb OSX file system that I can't eject, and being unable to boot from USB? I just want to erase the computer and start over with a clean install, but every time I format the computer, it says the drive is only formatted to 465GB in diskutility, then right away everywhere else sees the drive as 500gb, but if I run GPT fdisk I can see a 40GB windows partition, and this is immediately after formatting the computer and booting into OS Catalina for the first time. It also remembers my previous wifi network and password when I install the OS from ethernet on a fresh format, and when it boots I'm connected to wifi without having to enter my SSID and password.

May 25, 2020 4:55 PM in response to soundboy13

soundboy13 wrote:

Everything is far from normal

Everything is completely normal.

why does my 500gb drivd format to 465gb

It doesn't. You are looking at free space:

Container Free Space: 466.9 GB

It is only 467 GB because you have used 33 GB for other data.

then immediatly show it’s formatted to 500gb and create a windows partition?

Modern Macs aren't much different than Windows machines. They run the same Intel chips. They can boot Windows. The low level hardware-support volumes are in Windows format because that simpler format is something that the booting firmware can understand. Once the system is up and running, it uses the normal Mac booting volumes.

It also remembers my previous wifi network and password when I install the OS from ethernet on a fresh format, and when it boots I'm connected to wifi without having to enter my SSID and password.

Completely normal. This information is stored in the parameter RAM. It is a convenience for updating your system and installing firmware updates when you only have a WiFi connection.

May 25, 2020 4:57 PM in response to soundboy13

soundboy13 Said:

"iMac infected with virus that creates hidden windows partition, won’t boot from USB or internet recovery: [...]I can see a 40GB windows partition, and this is immediately after formatting the computer and booting into OS Catalina for the first time.[...]"

-------


To Emphasize on my Previous Reply:

After you delete the partition, be sure to format the Hard Drive - If using Catalina - use APFS as the File System (AKA: The Format Type).

May 25, 2020 8:18 PM in response to TheLittles

I booted into recovery mode because I have the Catalina USB ready to install but I cannot get the computer to boot from USB. I made a video to show that when I format the drive, for some reason disk utility says the drive is only 465gb and right after it format then it shows it’s 500gb. This is normal? Shouldn’t it show the used space?


https://vimeo.com/422648809


Also when it boots from internet recovery, shouldn’t it go directly into the recovery mode? If you watch the video you will see where it shows an apple symbol and loads the recovery mode after that.


Then when it’s installed and I first boot I can see a hidden windows partition when I use GPT fdisk, this is a pic which I took after it happened twice in a row after I did internet recovery and formatted the drive completely.



I’ll finish installing

May 25, 2020 8:22 PM in response to etresoft

But what I don’t understand is why is the data not shown as taking up space after you format the drive? What is 35gb of data used for and why won’t it show up in disk utility?


It shouldn’t show that there is nothing on the drive and then I boot up and I can use GPT fdisk to see a hidden partition, when I haven’t used boot camp or installed windows.


Also is it normal to be able to see untitled Electable drives In disk utility in recovery mode? Like this?



May 25, 2020 8:42 PM in response to soundboy13

soundboy13 Said:

"when it boots from internet recovery, shouldn’t it go directly into the recovery mode. If you watch the video you will see where it shows an apple symbol and loads the recovery mode after that."

-------


You are welcome.


Thank You for the Video!

It is Doing it as intended - what it is in fact doing is downloading and then encapsulating all the install files, readying itself for installation. Internet Recovery Mode is its own method - it does not go into Recovery Mode, after going through the download. View: "If you can't start up from macOS Recovery"at this link: About macOS Recovery


Erase the Drive:

Are you concerned with losing data? If not, just erase the drive, setting APFS format. Once formatted, see if all 500GB is shown (it might be a few GB less, because the drive has its own files on it).


As for the other 50GB:

Is the other 50GB shown after performing an erase? It would read maybe 498GB.

May 25, 2020 9:42 PM in response to soundboy13

I have reinstalled a few times now and I keep having the same issues, so this time I formatted with a GUID partition, but once I install Catalina it seems to be automatically formatted as APFS


That is the correct way to do it: GUID. Catalina will reformat automatically. that is normal.


right after it format then it shows it’s 500gb. This is normal? Shouldn’t it show the used space?


formatting erases the drive which means there will be nothing on it. it is normal.


You are seeing problems where there are none.


At this point, I recommend that you contact Apple support for further assistance.


This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

iMac infected with virus that creates hidden windows partition, won’t boot from USB or internet recovery

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.