Context: I've erased my hard drive and had OS El Capitan reinstalled via a bootable drive from a Genius Bar many times leading up to me asking this question. After going through the process of erasing + reinstalling + setting up preferences/calendars + changing passwords etc, the day after there have always been little things that were noticeable enough to arouse suspicion regarding a RAT/trojan on my Macbook (minor changes to iCal entries I definitely didn't make etc).

Recently, I tried a different route: I erased the hard drive and reinstalled the OS via Recovery using an Apple store's wifi. But even after doing this, I noticed the day after of setting up my Macbook as new again that one of my iCal entries were edited that I didn't make...

However, I read somewhere that it's best to reinstall the OS from a non-recovery partition source because if there is/was a RAT/trojan on my Macbook, said RAT/trojan could modify some files in the recovery partition without my knowledge thus leading me to unwittingly install a backdoored OS. Does this seem plausible? Should I once again try and erase/reinstall the OS from a bootable drive at a Genius Bar?

  • Many things are plausible with computers, most things are not likely however. What are these "edits" you refer to? Is it possible that iCloud syncing could be causing these changes? It is known to sometimes sync incorrectly, so that's a more likely scenario. – William T Froggard Nov 12 '15 at 6:12
  • @William T Froggard The edit that occurs most frequently is an entry where a slash will be replaced with a comma. When I first enter the entry into iCal, it syncs correctly between my Macbook and iPhone, but the edit occurs overnight when I turn everything off to go to bed. For example, I’ll enter an entry as “blah - 1/2/3” and then the next morning it’ll read “blah - 1/2, 3”. – oats58459 Nov 12 '15 at 7:13
  • Other suspicious things that have occurred is rules for my third party firewall application (Little Snitch) not staying permanent even though I myself turned them permanent and someone changing the gender of my Spotify profile. The first has happened but not the latter since erasing + reinstalling using the recovery partition. – oats58459 Nov 12 '15 at 7:13
  • Knowing that Apple's cloud services tend to be unreliable, I'd suggest looking around to see if the issues with Little Snitch and Spotify could be issues that other people have experienced. If not, you could contact the developers and see if they have any ideas. It may very well not be a Trojan, or any other form of malware. – William T Froggard Nov 12 '15 at 7:21

You are correct - a suitably advanced attacker could technically rewrite the OS on the recovery HD to point it to a bad source when you reinstall the OS.

Better would to be use internet recovery since that would require even more advanced work to compromise the firmware on the Mac.

Best would be to bring a bootable installer from a machine you have more confidence hasn’t been comnptromised.

In 98% of the time - all of the above steps to erase the hard drive and reinstall the OS are going to be equally effective, but there are increased levels of safety to be had than just using the self-contained recovery HD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .