I think that my macbook pro had a virus since all issues that it had disappeared after I restored it to factory settings. i would like to know how to remove viruses without resorting to this extreme in the future.

More info about the problems I faced:

  • extreme lagging: the computer was basically unusable
  • no/minimal lagging in Guest user mode
  • Slow start-up time (10 minutes or more)
  • basically unusable
  • 2
    Lisa, does your MacBook Pro have a hard drive or does it use flash storage? If it uses a hard drive, your symptoms fit the possibility that your disk had bad blocks that needed to be remapped (which only happens when they get written to, not read from) reinstalling the OS writes a ton of blocks, so it may have cleared up the problem. In the entire history of OS X, there have been extremely few viruses in the wild, so "my Mac must have had a virus" is actually a very unlikely explanation. – Spiff May 4 '15 at 20:33
  • Note however that if you have that many bad blocks, its time to get a new HDD. you can confirm this by reading the SMART stats on the drive, and checking the 'reallocated sector count' and the 'current pending sectors count'. if there are more than a few, then the drive is likely approaching failure all too quickly. Its also possible that the issue was filesystem corruption, which would be repaired on a reformat. – Frank Thomas May 4 '15 at 21:10

Unfortunately, there is no generic approach to removing malware that is available to normal people with normal systems. Personally, I think that since you don't have any more specific clues indicating malcode, that your system was suffering from age-based bloat, or misconfiguration. Systems get a little out-of-wack after a few years use.

First, you must understand that malware strains vary in how they infect, and what they do. Most likely what you have is a Trojan (if you have malware at all). Trojans are fully fledged programs that once run, can fully address and use the components of the operating system upon which they execute. That means they can do almost anything to a system, if they are written to hide, auto-update, repair themselves, and install other components like RAS/root kits. Some rare few can even hide in firmware. This particular danger is most common with big manufacturers that produce millions of systems using the exact same hardware (eg: Apple).

So, cleaning a Trojan ranges in severity from simply stopping and deleting a single executable, to buying a new system, and destroying the old with fire and sledge.

In your case, start with the ps -ef command, and examine the processes you have running. look for names that appear suspicious, including random character strings, names in poor taste, and in general anything you don't recognize and can't find on google. Consider any programs you have installed from third party sources. See if a malware scanner detects anything. Look for processes executing out of odd directories in your home folder. If you can remember when everything went south, look for files modified on those dates. If there are specific program that are particularly glitchy, examine them for signs of modification or the loading of unusual libraries.

Ultimately, its detective work, attempting to find clues so you can identify the type of malware, and seek guidance on how to deal with that particular strain.

unfortunately, these aren't really things we can easily teach you without knowing specifics. In the end, a rebuild is often the safest approach to dealing with trojan or worm code. theres just no good way to tell the extent of the impact they've had on your system, unless you can identify the specific strain, and get instructions from an AV firm on how to address them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.