Level 1

5 points

iMac infected with virus that creates hidden windows partition, won’t boot from USB or internet recovery

I have an iMac that has got a serious virus on it. The hard drive is 500gb, but when I format it using disk utility, the drive says it is only formatted to 465 gb, then when I load it in OSX Catalina, it says the drive is 500gb and doesn’t show a bunch of hidden partitions the virus has created.

It seems the virus has its own boot loader and it disables booting from USB and internet recovery. I can start internet recovery but then the Apple symbol comes up and it boots from the virus’s recovery disk, which is sometimes a Catalina disk and sometimes it’s a Snow Leopard or El Capitan boot menu.

The virus has created hidden windows partitions and hidden Mac partitions which are ejectable hidden drives that I can only see from using hdutil list in terminal when I boot from the fake internet recovery.

I was able to use GPT fdisk to remove one of the windows partitions, but when I go to delete the other partitions they come right back after I zero the drives in terminal from the fake internet recovery, and I can’t boot from USB. I’m pretty sure the list of partitions I see in terminal is a fake list because it doesn’t propagate the window fully when I open the terminal to a different sized window from the one I originally ran hdutil list in.

Im totally stuck, if I boot in verbose mode I can sometimes get it to work, but I can’t boot from USB or a real internet recovery because the virus’s fake boot loader denies access to a real install disk and has a hidden 40gb partition that I can’t delete and it just puts the virus right back on after I format.

Can anyone please help me figure this out?

Posted on May 25, 2020 10:35 AM

Similar questions

62 replies

soundboy13 Author

Level 1

5 points

May 25, 2020 9:57 PM in response to TheLittles

Thanks again for all your help so far. I booted up the fresh install, installed GPT fdisk, rebooted into recovery mode and I have the exact same issue as I had before where I can see a partition in GPT fdisk that I don’t know where it came from, and there is a 2 gig Mac OS base system disk image that I cannot get to eject from the computer.

is it normal to have an EFI partition on the base disk0, and a 2gb OSX base image on disk1s1 that I cannot eject or delete? Is that the recovery disk? Because I can boot to it from using option when I boot but I can’t boot from USB

On my previous installs there was always the ability to boot from USB and I never had this 2gb OSX disk that I couldn’t eject.

All I would like to do is boot from USB and format the drive so that it doesn’t say 465gb in disk utility when it’s formatting, I’ve wipes this machine many times and it always formatted to 500gb and I never had any issues booting from USB.

babowa

Level 9

78,562 points

May 25, 2020 10:11 PM in response to soundboy13

This is my last attempt:

is it normal to have an EFI partition on the base disk0, and a 2gb OSX base image on disk1s1 that I cannot eject or delete? Is that the recovery disk?

NORMAL.

Again, you are seeing problems where there are none. And you are creating problems.

There is no need or purpose to install GPT fdisk. Mac OS formats automatically. Why do you want to hack your system? You should not modify the GUID partition table.

soundboy13 Author

Level 1

5 points

May 25, 2020 10:31 PM in response to babowa

If you look at the last picture I posted from diskutilty, what is container disk 1 and why can’t I see it there?

Aside from the strange issue where the drive said it is only formatting 465gb of 500 when it used to say it formatted 500gb, there are other issues with my system when I leave it running.

My internet connection properties will change and Install two thunderbolt connections with my Ethernet connection, then developer tools like Xcode will he installed automatically. Then my system shows it’s running Catalina 15.4 but then I can install the combo update for 15.4 on top of the OS when it says it’s already installed and I am able to download the disk from the App Store without signing into my account. Is that normal? I thought you always had to log in to the App Store to be able to download things, and if you tried to install an update that was already applied, it wouldn’t allow it to install because it checks the version you are running before you try to apply the update.

There is a lot of strange behaviour going on with this Install, and every time I format and start over, nothing changes.

If I could just reboot with a 3rd party partition tool and completely wipe the drive inn pretty sure I can fix it, but there should not be developer tools installing that I didn’t try to install, and then when I try to boot from USB it just goes back to the 2gb Apple disk image that I can’t eject.

I appreciate everyone’s help and feedback but I just wanted to focus on reinstalling the OS from USB so I could fix the issues and I didn’t even really go into all of the strange behaviours I keep having every time I format the computer.

Sorry I couldn’t explain more from the start but I just thought no one would believe me and that the best way to resolve it would be to get it to boot from USB and format it entirely.

babowa

Level 9

78,562 points

May 25, 2020 10:50 PM in response to soundboy13

You don't want to eject the 2 GB Apple disk image. Mac OS needs that or you will create more problems.

You can partition your internal from an external bootable clone drive. Do not hack your system with third party partition modifications.

It appears your USB installer may not have a problem. Don't use it - simply boot into recovery and download a fresh OS.

And stop questioning normal Mac OS processes. The OS is very good at taking care of itself if you will leave it alone.

etresoft

Level 9

56,326 points

May 26, 2020 4:06 AM in response to soundboy13

soundboy13 wrote:

I booted up the fresh install

OK. You are done. That’s all you need to do. Just start using your machine normally.

installed GPT fdisk

stop it.

rebooted into recovery mode

Stop it.

and I have the exact same issue as I had before where I can see a partition in GPT fdisk that I don’t know where it came from, and there is a 2 gig Mac OS base system disk image that I cannot get to eject from the computer.

STOP IT.

is it normal to have an EFI partition on the base disk0, and a 2gb OSX base image on disk1s1 that I cannot eject or delete? Is that the recovery disk?

YES

On my previous installs there was always the ability to boot from USB and I never had this 2gb OSX disk that I couldn’t eject.

You have gotten yourself so worked up that you have no idea what you have or haven’t done.

All I would like to do is boot from USB and format the drive so that it doesn’t say 465gb in disk utility when it’s formatting, I’ve wipes this machine many times and it always formatted to 500gb and I never had any issues booting from USB.

After installing 35GB of Apple operating system onto the disk, it is always going to say 465 GB free - ALWAYS.

Stop erasing your hard drive.

Stop installing partition software.

You have no viruses.

There are no problems on your machine.

Everything (on your computer) is completely normal.

soundboy13 Author

Level 1

5 points

May 26, 2020 8:35 AM in response to a brody

So It’s absolutely normal to be able to download items (like the Catalina install disk) from the App Store without connecting your Apple ID to your account and without logging in?

I didn’t think I should be able to Install the 15.4 combo update on a system which is already running 15.4, shouldn’t it say it’s already installed?

Is it regular to have two thunderbolt bridge connections added to your Ethernet settings, and if you remove them they come back?

and should IOBoot setting always prevent you from changing login settings in terminal by default? And booting in recovery and using terminal to start in verbose mode will turn itself off by default?

and terminal should always go to from bash to zsh mode by default and save a log file of all the commands you enter?

and if I disconnect the Ethernet cable, wifi will turn itself on and connect to my router using the SSID info and password which I have removed?

The behaviour on my “fresh“ installs is not normal. Besides the fact that boot from USB is not working with a fresh install made from terminal using the commands in the Catalina installer, lots of stuff on the computer is not working correctly. Commands which should work in terminal are disabled and settings which I change myself and lock are later changed back to the way they changed on their own.

etresoft

Level 9

56,326 points

May 26, 2020 8:44 AM in response to soundboy13

soundboy13 wrote:

The behaviour on my “fresh“ installs is not normal.

Everything you have described is absolutely normal.

If you can ever make it past this obsession with hacking and conspiracy, people would be happy to help you understand and resolve any of the specific difficulties that you have had. But I want to emphasize this point - YOU SIMPLY HAVE TO GIVE IT UP. Otherwise, nobody is going to bother. You are going to continue to get these same, repetitive replies. You want to know about the transition from bash to zsh due to licensing issues from 2007? People will be happy to explain it, but not here. This thread is dead. You will get nothing further from it other than denials that there is anything wrong in any way.

Kurt Lang

Level 9

68,520 points

May 26, 2020 8:57 AM in response to a brody

Exactly. You will never get 500 GB of free space on a 500 GB hard drive on a Mac.

Not to mention, you'll never get 500 GB of free space even if the drive is "empty". Just formatting it takes up space for the file and partitioning tables.

rkaufmann87

Level 10

148,470 points

May 25, 2020 11:11 AM in response to soundboy13

As stated there are no viruses for Mac OS, if you have one it will be the worlds first. Repeat it is not a virus.

rkaufmann87

Level 10

148,470 points

May 25, 2020 11:22 AM in response to soundboy13

Now Windows may have a virus, that is plausible but even if it does Mac OS is completely secure from it.

rkaufmann87

Level 10

148,470 points

May 25, 2020 11:41 AM in response to soundboy13

Well if your Mac has a virus it is the only one on the planet that does. Good luck, I am done.

a brody

Level 10

85,308 points

May 25, 2020 1:04 PM in response to soundboy13

By the way, the images you posted are too small to read. So I'm afraid we can't help you there.

soundboy13 Author

Level 1

5 points

May 25, 2020 1:10 PM in response to soundboy13

Link to etrecheck report

https://justpaste.it/479d7

etresoft

Level 9

56,326 points

May 25, 2020 1:21 PM in response to soundboy13

You have no virus. Everything is completely normal.

BORg529

Level 4

3,070 points

May 25, 2020 1:32 PM in response to soundboy13

Part of the problem you have “slow” 5400 rpm hard drive, with a lot of programs installed.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

iMac infected with virus that creates hidden windows partition, won’t boot from USB or internet recovery