5

I am not a mac user, and honestly, I have no idea how to use one (besides the terminal). So, a friend asked if I could help them out with fixing their computer. She says the last thing she was on, was on some website with "free movies", and she mustt've been clicking something. We can get into recovery mode and we can go on the guest user, but not on the main user. Whenever you log in to the main user, it just shuts down.

Since I have a fair knowledge of Ubuntu, I thought I could just back up her files through a live USB (not store them on the live USB, but on an external hard drive) and reinstall OS X. I booted into the live USB, and there was no mounted hard drive, which was odd. I checked it, and figured it was encrypted, so I went on and installed libfvde on the live usb to see if I could hack the encrypted system open (had tried all kinds of other things before this), but I just could not do it.

So, what I want to do now is find out what is wrong, figure out if it can be fixed, and if not, back up the files and reinstall the OS. Thing is I don't know how to do it. Anything you guys can help with?

4
  • When it shuts down, does it appear to be a normal shutdown process? Or, does the machine just power off?
    – tim.rohrer
    Apr 3 '16 at 13:52
  • In a nutshell - boot to recovery mode and then look at terminal in the utilities menu. Tools like gpt and df and diskutil cs list or diskutil list should get you the lay of the storage land. You don't need a USB installer if recovery works so start there per klanomath's answer
    – bmike
    Apr 3 '16 at 15:36
  • I think you can do what you tried to do from a live USB from booting into OS X recovery, which should support mounting the encrypted drive. Apr 3 '16 at 17:20
  • @tim.rohrer Screen turns black and computer turns off. Apr 4 '16 at 16:22
17

The best thing you can do is creating a new admin user and inspecting the assaulted main user/the system.


Boot to Recovery Mode (hold cmdR while booting).

Unlock and mount the main encrypted volume either with Disk Utility or Terminal:

#list all CoreStorage items
diskutil cs list
#unlock the locked Logical Volume (replace lvUUID by the UUID found above. Usually it's the last one listed and looks similar to this one: 21019876-ABA9-5678-1234-123453789012!)
diskutil cs unlockVolume lvUUID

Get the name of the main volume (usually it's the last one of the many):

df

The name of the encrypted main volume is also visible if you enter diskutil cs list again. Example:

    ...
    +-> Logical Volume 21019876-ABA9-5678-1234-123453789012
        ---------------------------------------------------
        Disk:                  disk16
        Status:                Online
        Size (Total):          1106191572992 B (1.1 TB)
        Conversion Progress:   -none-
        Revertible:            Yes (unlock and decryption required)
        LV Name:               Macintosh HD
  --->  Volume Name:           Macintosh HD
        Content Hint:          Apple_HFS

Change the working directory (here I assume the main volume name is "Macintosh HD"):

cd /Volumes/Macintosh\ HD/var/db

List all files:

ls -laO

Remove the file .AppleSetupDone

rm .AppleSetupDone

Check if the file was deleted:

ls -laO

Reboot the Mac. After rebooting you will be asked to unlock the encrypted volume. Enter the password even if it is the one for the only configured user.

After booting has finished you will be asked to set-up your Mac. After configuring locales create a new admin user. Log-in as new admin user.

Now you may either back up the data of the infected main user. Or you can inspect LogIn items, launch agents of the user or system wide launch agents/daemons.

You may also install an anti-malware solution like Anti-Malware for Mac and check for an infection.


Report back if you can't find a culprit.

11
  • I am running into a problem at cd /Volumes/Macintosh\ HD/var/db. I would expect it to move into the directory, just like normal, but nothing happens. I also think it's odd that where I am used to see username@usergroup:~$ it says -bash-3.2#. Apr 4 '16 at 16:45
  • it appears to be Rasmus HDD (yes, with two d's). I wrote it in the terminal like this cd /Volumes/Rasmus\ HDD/var/db. Nothing happened. Apr 4 '16 at 16:50
  • 1
    @OHMYDEARPUFFINS Then try to cd to the directory successively: 1. cd /Volumes 2. ls -laO 3. cd Ras.. 4. ls -laO 5. cd var etc. The O is a big Omaha. In step 3 you may use bash completion: Enter the first few letters of your main volume. Then hit the Tab key.
    – klanomath
    Apr 4 '16 at 16:54
  • Ah, I see now, I wrote ls -la0 (zero) instead of O (Omaha). It fixed the problems. Now I ran into other problems at rm .AppleSetupdone. It appears to be read-only, and can't get it removed. Anyway I can change its permissions? Apr 4 '16 at 17:54
  • 1
    @tim.rohrer Though the answer is marked as accepted the issue is still there. Check the chat. Probably the CoreStorage volume was corrupted. The OP wanted to ping me if he is ready to continue solving the problem but he didn't until now.
    – klanomath
    Apr 7 '16 at 12:26
0

If you can get into the guest user, the problem does not lie within the system, so reinstalling it will not fix the problem. Free movie sites (and other free sites) can sometimes trigger a virus or a bug that damages a Mac’s user files. You would be better off if you started on an external hard disk, and then used Disk Utility (In Applications/Utilities) First Aide feature to “fix” the ahrd disk itself. It sounds as if the problem most likely is a disk error that will now allow the ahrd disk to mount properly. Disk Utility should be able to repair that. You will know if Disk Utility finds an error (one that is listed in red under the Details arrow) and announces it has fixed it. If disk utility does not repair the problem, the computer will need be taken to Apple or be looked at by a Mac Specialist or qualified consultant. There are many professional tools available to them to fix this problem.

3
  • If the disk wouldn't mount properly, logging in as guest wouldn't work either.
    – nohillside
    Apr 3 '16 at 14:01
  • 2
    The OP said he could get in as guest, which is why I asked about the shutdown. I agree with part of the answer here that the OP, if he can get in as guest, might be able to su to the main user and then clean up nefarious log-in scripts, if that is what is happening.
    – tim.rohrer
    Apr 3 '16 at 14:51
  • I should have mentioned that I did try the disk utility thing (sorry, I tend to forget things as I write). Disk utility found no errors. Apr 4 '16 at 16:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .