1

I have done a foolish thing. I deleted private/var folder due to malware I was after. I immediately felt that strange things are beginning to happen so I pressed cmd+Z to reverse action. The computer frezzed so I shut it and rerun it. Now I cant relaunch it, because it shuts down while it is loading into my user account.

So I went to single user mode and and tried to copy the var folder from .Trashes to private folder. The problem is that .Trashes seem to be empty. Meaning that cmd-Z worked, which would mean that var folder is back in place. But the computer doesnt start. Does ls command dosnt show files in trash? What seems to be the problem?

Also, if this doesnt work, I am gonna have to copy important files to external disc from Single user mode. What is the path to external harddrive?

EDIT > private/var does indeed have content. I am now getting confused. Did the system put some content in there for me?

Improve this question
8
  • How did you delete it. Note that delete does not put things in Trash - in Finder Move to Trash does.
    – mmmmmm
    Apr 25, 2016 at 10:40
  • with cmd-backspace
    – sanjihan
    Apr 25, 2016 at 10:42
  • That would have required you to enter an admin password as well
    – mmmmmm
    Apr 25, 2016 at 10:43
  • It did. An antivirus program pointed out a file in this folder. I inspected the folder and there were a lot of files that I knew were malware. Deleted the entire folder. I am amazed by my stupidity :D
    – sanjihan
    Apr 25, 2016 at 10:47
  • In tat case restore from an old backup - before the malware was installed - I'll delete m=y answer as that changes everything - please put the reason in your question
    – mmmmmm
    Apr 25, 2016 at 10:49

1 Answer 1

Reset to default
3

If you assume a malware infection, by all means reinstall the OS by rebooting into the Recovery Partition with Cmd-R and reinstall from there. This should not affect your existing users (or their files).

See OS X: About OS X Recovery for details about the procedure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .