Imac bizarrely self-quarantined.. am I halfway to ransomware? being pranked?

[openpoljes]

First time poster with a really odd situation.. I've used this imac regularly for several years (2017 27-inch Intel). A few days ago, I noticed "Guest User" was an option on the login screen alongside my own icon/username, which struck me as mildly odd- I didn't remember enabling that, but didn't think much more of it, & nothing else seemed amiss.

Yesterday I went to log in (under my username), and it said my password was incorrect. I checked the capslock key and tried a several more times- no dice. Super odd. So I restarted the computer..

This time, when the login screen loaded, my username/icon was missing entirely, with the only available option now being "Guest User"..

I suppose as expected, when logging in as Guest none of my own files are accessible or can be displayed, however the hard drive is using a similar capacity to what it was before-

so I'm hoping they're safe.

My admin username is also missing from the list in System Preferences > Users & Groups,

is this normal from within the Guest account?

As you can see, "Enable Parental Controls" is also checked. If I uncheck this, it just rechecks itself again a moment later. Clicking the lock pops up the admin name/password dialogue box (without the Name field automatically populated), and my old credentials don't pass.. Is it possible the admin user is being hidden from the login screen by parental controls?

Although my phone didn't detect the imac on it's own, when initiating an airdrop from the mac while in Guest, the request comes up on my phone as being (seemingly) from my previous username. However I suppose the computer's ID name and my admin username are actually distinct/separate entities, even if they're both the same words, so perhaps a red herring.

At this point I restarted in recovery mode with the idea of creating a new admin account. In terminal (bash 3.2), "resetpassword" opens the tool, but once again the list of users is blank-

and there seem to be no other options.. I cannot see a way to create a brand new user from within the graphical tool.

(Apparently 79 people on Apple's forum have also had this experience, without a reply from them)- https://discussions.apple.com/thread/252192805

From recovery mode terminal, the commands "sysadminct1" and "dsc1" (which I was led to believe might allow a new user to be created) generate the output "command not found".. Should these commands normally be available in recovery mode terminal?


At this point, since I already had a linux live USB, I decided to try booting from that to see if I could access my files.

Linux sees the imac's SSD, but labled it as "encrypted".

When I try to open it, I'm given the esoteric message "Unable to mount. No .Filesystem or .Encrypted interface on D-bus object"

I'm not sure if this is evidence the contents are actually encrypted, or whether that would be unusual or not. But I think linux can normally understand Apple's file structure..

I saw another thread here mentioned booting from a live macOS USB- I hadn't heard of that before & may try it next if I can make one from within the guest account.

Any thoughts on what may have caused this, or advice for getting things back to normal (or at least recovering my files) are appreciated.

 

[Nermal]

I've never heard of this happening before, but I suspect your files are fine, if you can get at them. It would make sense that the guest account can't see other users on the system, and it certainly wouldn't be able to create them.

If you have FileVault enabled then the encryption will be getting in the way when you use Linux. Can you see your files when booted into recovery (in /Users/yourusername)?

 

[adib]

This looks like file system corruption on the main drive. You could try target disk mode and mount the main drive from another Mac, and then use Disk Utility to repair it. Otherwise, use macOS Recovery to mount the drive and then run Disk Utility from there. Else, erase everything and restore from Time Machine.

Btw, Linux distributions usually don't recognize the Mac's file system, much less able to decrypt it.

 

[openpoljes]

Ah, I'd been incorrectly typing the number "1" instead of lowercase "L" in the "dscl" command. It lists users as being "daemon", "nobody", and "root"

(apparently "nobody" is a legit system user with regular responsibilities for things here and there 😉). But no humans made the cut..

Can you see your files when booted into recovery (in /Users/yourusername)?

Great suggestion! Checking there, not only my admin account, but the entire "Users" directory itself appears to be missing 😦..

 

[Nermal]

You're likely looking at the recovery volume itself (I'd forgotten about that when I made my suggestion above). What's inside /Volumes?

 

[openpoljes]

You're likely looking at the recovery volume itself (I'd forgotten about that when I made my suggestion above). What's inside /Volumes?

You're right! "/Volumes" shows the hard drive, which has the Users folder, admin folder and personal files 🤗🤗🤗.. So glad everything seems to be intact!

Now figuring out next steps..

 

[Fishrrman]

OP:

Can you get to INTERNET recovery?
This is NOT THE SAME as "the recovery partition".

What to try (takes only a few mins):
Power down, all the way off.
Press and HOLD these keys: "command-option-R"
KEEP HOLDING THOSE KEYS DOWN as you press and RELEASE the power on button.
DON'T LET GO OF THOSE KEYS (all shouting is intentional).

You can let go when:
If using ethernet -- when you see the spinning globe
If connecting via wifi -- when you're asked for your wifi password.

The internet utilities take a while to load.
Can you get to the screen with the internet utilities?

Try this and get back to us.
There are "other ways" to "get at" your user account (unless you somehow deleted it)...

 

[Nermal]

What's the goal there? I would have thought that Internet Recovery would be a worse choice than "normal" recovery, as it's likely to be an older version that may not understand any newer APFS features (if any have been used).

I suspect that in any case, the solution might be doing a cp -R or similar to just dump the entire user directory onto an external disk, then make a new account and start again. Not ideal though, so hopefully there's a better way.

 

[openpoljes]

An interesting thing about this anomaly is that the password box does not appear to be associated with the Guest User displayed on the login screen-

After all, the Guest account requires no password. If anything is entered into this password field, or even if it is left blank- pressing enter results in the "Wrong password/Access denied" shake. The image of the guest user must be clicked to bypass this & get into the guest account.

Seeing that happen triggered my memory that this exact phenomenon happened to me once before, quite a long time ago- I believe well over 10 years ago- on a completely different imac. In that case I'd concluded there were actually two "users" present on the login screen- a visible one associated with the guest icon, and another one that had somehow become invisible, which was associated with the displayed password field.

I'm not sure if that conclusion was correct, but a little digging shows that such hidden users can actually be created intentionally. For instance, this article discusses creating a hidden user on the login screen, for use by a remote administrator-

How to Hide a Specific User Account from Login Screens of Mac OS X

Mac users who have multiple user accounts on a single machine may sometimes wish to hide a specific user account from appearing on the login screens of OS X. This is fairly common for systems admin…

osxdaily.com

Also, the following video demonstrates how any user(s) can be hidden from appearing in the System Preferences > Users & Groups side pane, as was noticed above:

From other reports, people who have unexpectedly experienced a similar thing to what my imac is doing, associate it with two circumstances-

The first is when a computer under MDM experiences a hiccup. MDM is Apple's method of remote device management. It allows companies, schools, organizations, etc to push configurations, install software, and enforce policies on devices that they have enrolled.

"...I had just wiped MDM profiles using the profilesAreInstalledmethod... Something about non-admin users caused my next restart to only show 'Guest User'..." "

"This is my office laptop... Issue is that this was newly set MDM device but I restarted it with Network off. This has never occurred to me on previous MDM devices."

https://apple.stackexchange.com/questions/348339/cant-see-the-user-on-the-login-screen

The second comment caught my eye because my Imac's current issue also developed when it was restarted while access to the internet was blocked. (My router was not working).

Interestingly, a system admin commenting at the next link revealed that it is possible for a regular home computer outside of an organization to become enrolled into their MDM "accidentally", (for instance, if among the list of devices they submit to Apple to enroll, one of the serial numbers has a typo, which ends up being the serial number of a home user). He had seen this happen once, but estimates occurances to be rare.

It's also mentioned that devices purchased secondhand (for instance, prior school computers) may retain MDM, unbeknownst to the buyers.

How to Detect MDM presence in my Mac. - Apple Community

discussions.apple.com

The discussion seems to indicate that the MDM configurations actually live below the OS, buried in the system firmware itself, can persist through system recovery, and that their presence on a Mac may not be obvious. All of which is quite rather interesting.

Similar references:

https://www.reddit.com/r/MacOS/comments/xvmoa9/is_it_possible_to_accidentally_enrol_someone

Corporate computer keep enrolling to unkn… - Apple Community

discussions.apple.com

The other condition often associated with the "Guest-only" login screen is users report it happened when their hard drive space was near to it's full capacity-

Mac Account/Login Disappeared... - Apple Community

discussions.apple.com

And, most of my hard drive space was in fact being used when this happened to me (~3GB remaining), although I've often had less than 1GB remaining without problems previous to this.

All interesting food for thought 😉

 

[mw360]

Sorry for this being stupidly obvious but just in case you didn't notice it, in the first screenshot Guest User isn't the only option. There's a back arrow there which normally goes to the full list of accounts

 

[openpoljes]

Sorry for this being stupidly obvious but just in case you didn't notice it, in the first screenshot Guest User isn't the only option. There's a back arrow there which normally goes to the full list of accounts

I did notice 😉. In this case, pressing that button immediately logs into the Guest account rather than going to the other users. There's much more I've posted in a previous comment, but it's currently awaiting moderator approval.

 

[Apple_Robert]

Do you not have a backup of your important files? If you do, why haven't you wiped the drive and setup as new?

 

[openpoljes]

Oh I guess pressing the back arrow didn't immediately log me into Guest, but pressing it just continues to show the guest account as the only option. Here's a video showing it & the password box's behavior-

https://jmp.sh/s/RlmU1yjd2DiUHKrQusPQ

 

[openpoljes]

Do you not have a backup of your important files? If you do, why haven't you wiped the drive and setup as new?

No, I did not have a backup of my important files. However after Nermal showed the appropriate path I was able to back up my entire user directory by following this video-

From here I'm confident the imac can be restored without issue with one of several methods, however I'm of the opinion that 100x more can be learned about a machine while it's exhibiting an unusual state vs when everything is working correctly, so it's kind of an opportunity (certainly I've been learning a lot).

Also, while poking around recovery terminal, I found the infinity mirror 😉..

 

[Fishrrman]

nermal asks about internet recovery:
"What's the goal there?"

I'm thinking:
a. get booted to internet recovery
b. install a working OS onto an EXTERNAL drive
c. now as part of the initial setup, the user will create a new ADMINISTRATIVE account (I'm GUESSING that the guest account doesn't have administrative abilities? I've never used one).
d. with a new account with administrative powers, the user can "poke around" with more "power" than he could as a guest user on the problem Mac.

Another course of action might be to delete the ".usersetupdone" file, which would cause the initial setup app to run on the problem Mac and use that to create a new administrative account that way.
But... you have to use the terminal to delete it.
Or... boot from another drive.

Since the OP now says that he has a backup, all the more reason to boot to internet recovery, use disk utility to erase the entire drive, reinstall a clean os, and restore from the backup.

 

[uacd]

I think you are wasting too much time on trying to understand the phenomena which you shouldn’t.

We must answer the main question here: is it malware/trojan? Highly likely. It looks like someone took control over your computer, then found your password and booted you out.

From there you have the only working option – fully & clean reinstall macOS with the method outlined by Fishrrman:

What to try (takes only a few mins):
Power down, all the way off.
Press and HOLD these keys: "command-option-R"
KEEP HOLDING THOSE KEYS DOWN as you press and RELEASE the power on button.
DON'T LET GO OF THOSE KEYS (all shouting is intentional).

Beware that wiping your HDD via disk utility will destroy all your files and applications. So if you have something that you need then try to copy it via guest or, alternatively: use an external SSD, install macOS there and copy from one system to another, but then copy again from that system on some random drive - you don’t want to get this malware again after direct system file copying.

Try to think about where it might have came from. Any suspicious recent app installations? Any cracked applications (especially Adobe stuff)? Maybe someone used your computer when you wasn’t there? A kid or someone else. Maybe some legacy app that you installed since you have said that you had similar issue on one of your much older macs. This way you won’t have same virus again

 

[laptech]

deleted: post related to how the login screen looked in one of the other posts, it looked wrong but I looked at the main post and saw it was my eyes playing tricks on me.

 

[genexx]

The other condition often associated with the "Guest-only" login screen is users report it happened when their hard drive space was near to it's full capacity-

Mac Account/Login Disappeared... - Apple Community

discussions.apple.com

That was my first thought... how can you think all the Temporary files to run a System / OS can be created with just 2.82 GB left?

I was also thinking it might be filled with garbage because of an error, but you mentioned later that you do this every day without a backup.