iMac infected with virus that creates hidden windows partition, won’t boot from USB or internet recovery

It would be much preferable to use Paragon's own built-in uninstaller.

https://kb.paragon-software.com/article/4500

See not all software have uninstallers. I was only recommending it, in event they didn't. But good to know they do.

That is true. I just wanted to point out this one does, rather than trying to use a third party option.

etresoft wrote:

Everything (on your computer) is completely normal.

😎

Exactly. You will never get 500 GB of free space on a 500 GB hard drive on a Mac.

I had to read that three times before it sunk in. 😆

🤓

Autocorrect error: Your drive is dreaded.

So, get this serviced.

There's no virus. Catalina formats your disk using APFS. APFS creates one visible volume and four invisible volumes. As an example, if you name your disk "Macintosh HD," then that is the only visible volume you will see mounted on your Desktop. There are four invisible volumes named: Macintosh HD - Data, Preboot, Recovery, and VM. Of these four, only the Data volume will be shown by Disk Utility. The whole array, however, will be displayed if you use diskutil in the Terminal.

These five volumes are all grouped under what APFS calls a "container." Containers are similar to partitions but unlike partitions, containers can share the available space on the storage device. They have many more features you can read about.

When should you use APFS Containers, Volumes, and Folders?

Partition Drives & Create APFS ‘Containers’ for Space Sharing with Disk Utility

Tech 101- Explaining the New Apple File System (APFS)

Copy, move and clone files in APFS, a primer

Add, delete or erase APFS volumes in Disk Utility on Mac - Apple Disk Utility User Guide

What others suggested in loading Etrecheck is a good idea. It will reveal hidden launch daemons that might have installed as trojan horses. Quite different from viruses, these are software that promote their value to the unsuspecting user and encourage you to install them. Where a virus will come onto your computer without even provocation.

Examples of trojan horses are software made by Macpaw and Zeobit that are purported optimizers.

Website extensions that force Chrome to load a different start website like weknow.ac.

There phishing websites that look like the real thing unless you reveal the full link to the website. Those are known as adware, and can be very dangerous if you use your machine for personal information.

And while you could technically run a script that could cause some significant damage, it won't do so without root account access, which requires you divulge the administrative password to a software that does not need it.

Let's start by identifying the launch daemons:

https://discussions.apple.com/docs/DOC-250002463

And once we do, we will restart in safe mode (using the shift key), to remove the said programs using EasyFind, also documented in the tip. But first we need to ensure you only delete that which does not belong.

Paragon software allows read/write access to PC formatted hard drives in the NTFS format. That's where you are getting the PC partition, to allow it to manage your ability to write to PC formatted hard drives. That's a feature of the program, not so much virus. Because it is sifting back and forth between two file systems, that can slow read/writes into the other file system of large files.