0

I'd like to get some insight on the chances of re-infection during a wipe of all partitions on a Apple Silicon Mac.

On an infected Mac, if I attached an external drive and formatted it with free space: diskutil eraseDisk free %noformat% MBR /dev/disk1. Can a virus still move to that drive as there are no partitions any more? Or can they live in the MBR partition map?

/dev/disk7 (external, physical):
#:                       TYPE NAME                    SIZE       IDENTIFIER
0:                                                   *61.5 GB    disk7

Also, is it possible for a virus to live on any of the partitions in the new Apple Silicon partition map after doing a "Erase All Content and Settings"? e.g.

In these physical partitions

0:      GUID_partition_scheme                        *500.3 GB   disk0
1:             Apple_APFS_ISC Container disk1         524.3 MB   disk0s1
2:                 Apple_APFS Container disk3         494.4 GB   disk0s2
3:        Apple_APFS_Recovery Container disk2         5.4 GB     disk0s3

Or these synth volumes

4:                APFS Volume Preboot                 6.3 GB     disk3s4
5:                APFS Volume Recovery                1.1 GB     disk3s5
6:                APFS Volume VM                      20.5 KB    disk3s6

Also Also, if I was to do a DFU https://support.apple.com/en-au/108900 clean, what are the chances a virus hiding in one of the partitions above could be transfered to the "controlling" Mac that is wiping the affected Mac?

Improve this question
4
  • There are no known viruses at all, in the sense you use the word, that affect macOS. Any known malware will be removed by erasing the data volume.
    – Linc D.
    Commented May 11 at 4:08
  • 2
    I presume this a hypothetical question, and not actually relating to any real malware?
    – benwiggy
    Commented May 11 at 7:50
  • Thanks for the comments all. When I say virus, I mean any kind of malware/virus/attack/etc. This is not hypothetical. My system was comprimised and it had an active antivirus software installed + a range of other counter measures.
    – sansSpoon
    Commented May 18 at 2:57
  • Each virus/attack is different. A generic solution may or may not work in your case. There might be malware which can jump to a newly formatted drive, you may even copy it yourself because it hides in a spot you didn‘t expect it to be.
    – nohillside ♦
    Commented May 18 at 5:38

1 Answer 1

Reset to default
1

If you suspect that your Mac has malware on it, you should use an app like Malwarebytes to check and remove the threat.

The developers of such products know about what threats are being used "in the wild"; how they operate; and how best to remove them.

As said in the comments, just erasing the Data volume should be sufficient.

Security is very complex and difficult: I'd respectfully submit that in order to deal with any malware 'manually', you need a very thorough grounding in the subject.

Improve this answer
4
  • I tend to agree with you re the need for in-depth knowledge to remove malware. But given Apple's penchant for not documenting things - how would you recommend one acquire this knowledge?
    – Seamus
    Commented May 11 at 19:32
  • @Seamus Apple does document their security practices pretty well here: support.apple.com/en-gb/guide/security/welcome/web Most computer security is described in fine detail in academic papers; and you would really need to take a "university" style approach (e.g. years of extensive reading on the subject on the subject and practical testing using VMs or test machines); not "do-your-research" googling. ;-)
    – benwiggy
    Commented May 12 at 17:04
  • Thanks @benwiggy, but as I mention in the above comment, I had 3rd party antivirus installed, it didn't detect shit :(
    – sansSpoon
    Commented May 18 at 2:58
  • @sansSpoon So what leads you to believe that your computer is compromised? I'd suggest using Malwarebytes, not something like Norton, nor Macaffee.
    – benwiggy
    Commented May 18 at 7:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .