Malware On My iMac

Question

Level 1

15 points

Malware On My iMac

Recently, I ignorantly downloaded some orthographic scenery files for my flight simulator to my iMac from a BitTorrent website. Shortly after, my iMac began slowing down and when I opened the "Get Info" for my hard drive it showed that files were being added constantly, even though I wasn't doing anything else at the time.

Now, my 3.12TB hard drive shows less than 100GB of space available and my Mac barely runs at all.

What is the best way to get out of this mess? Do I have to wipe the drive and reinstall macOS Big Sur and then all of my other software, or is there a less labor intensive way to recover?

Thanks,

rickat

iMac 27″, macOS 11.5

Posted on Sep 6, 2021 3:02 PM

Reply

Answer 1

Best reply

Luis Sequeira1

Level 9

64,616 points

Sep 6, 2021 3:31 PM in response to rickat

We need to determine what is using all that space and what software you may have installed.

If possible run Etrecheck while booted normally and post its report here using the additional text button below the message area.

If you can’t do that:

Restart in Safe Mode.

Tell us is the content of the following folders:

/Library/Extensions

/Library/LaunchAgents

/Library/LaunchDaemons

~/Library/LaunchAgents

To open each of the four folders above, in the Finder press Command-Shift-G and paste the corresponding line.

Post screenshots.

Note: Safe Mode is slow. The point of doing this in Safe Mode is to prevent whatever system modification was installed from running while we determine what they are.

Reply

Answer 2

rickat Author

Level 1

15 points

Sep 7, 2021 2:53 PM in response to Luis Sequeira1

Hi Luis,

I was unable to download EtreCheck, so I started in Safe Mode (I think; no "Safe Mode" in upper right corner of screen) as you suggested and took screenshots of the four listed folders. However, when I tried to upload them and post this message I got an error message saying that I was trying to upload illegal files (or something like that). These were just JPG image files. Is there a different format required? I can convert them if needed.

Thanks,

rickat

Reply

Answer 3

rickat Author

Level 1

15 points

Sep 7, 2021 3:49 PM in response to Luis Sequeira1

Hi Again Luis,

Actually, I was able to download EtreCheck Pro and run a check. I'll try to add it here as additional text, but it doesn't look like I can add the entire 10 page report. If not, I'm out of ideas, since I apparently can't attach a file to this posting, e.g. PDF.

Nope, didn't work, and my iMac just crashed while in Safe Mode. I think the full disk caused it.

It looks like I will have to go to the nuclear option: wiping the HD and reinstalling MacOS and all software.

Thanks,

rickat

Reply

Answer 4

rickat Author

Level 1

15 points

Sep 7, 2021 5:04 PM in response to Old Toad

Hey Old Toad,

Yes, I did think of that and plugged it in, but it made no difference. The funny thing is that when I ran EtreCheck the report said that my Mac is running in Safe Mode. Whatever, I seem to be left with the nuclear option as I said above.

Thanks for the thought, though,

rickat

Reply

Answer 5

Old Toad

Level 10

207,607 points

Sep 7, 2021 4:39 PM in response to rickat

If you don't get the red Safe Mode in t he upper right hand corner of the login window connect your rechargeable, wireless keyboard with its charging cable and try booting into Safe Mode again.

Reply