Weird MBP Password Reset Issue - Possible malicious software?

steiney

macrumors 6502
Original poster
Nov 6, 2009
478
29
Hello all!

My girlfriend and I went on a trip this weekend. She used her computer all day Friday for school, etc., before we left for the weekend and had no issues. We got back late last night and she just tried using her computer this morning. She had powered down the computer when we left on Friday. So, she starts up the computer this morning and after a minute, the "choose your language" screen shows up, as if it's a new Mac and she's setting it up from scratch. She showed me and I told her not to go any further. So, she restarted the computer by holding the power button for seven seconds. Then, the computer restarts to the regular account log in screen, but the computer was extremely slow and unresponsive. A couple times, the arrow keys would allow me to navigate between highlighting her account and the guest account, but the enter key would not allow me to invoke the password prompt for her account and other items were unresponsive as well. So, she restarts the computer via holding the power key for seven seconds again and the computer reboots to the new account language selection prompt. So, she chooses American English and moves forward one screen, and the next screen is a password reset prompt (as pictured). This is the part that makes me very suspicious.

My girlfriend has since logged into her Apple account directly from her iPhone and her regular password still works and there are no alerts/warning/etc. within her Apple account and no email alerts, etc. She is also fairly competent with a computer and is not the type to go downloading a program without being positive it's from a safe source, etc.

I tested the "Reset Password" prompt a bit by entering a fake Filevault password to see if it would move to a new screen, acting like I correctly entered the password when I really used a fake password, but the reset prompt behaved correctly, which does not necessarily rule out malicious software.

This whole thing just doesn't make sense to me so I'm reaching out here to see if any thinks this is either a bug, a piece of malicious software, etc.?

P.s. Her OS is 10.11.6

2017-04-17 10.49.06.jpg


2017-04-17 10.48.49.jpg
 

DeltaMac

macrumors G3
Jul 30, 2003
9,525
2,298
Delaware
Be sure to set the boot disk again. The NVRAM reset would leave you with NO disk selected.
So, System Preferences/Startup Disk pane, then click on the boot drive to make sure it is selected.
 

steiney

macrumors 6502
Original poster
Nov 6, 2009
478
29
Be sure to set the boot disk again. The NVRAM reset would leave you with NO disk selected.
So, System Preferences/Startup Disk pane, then click on the boot drive to make sure it is selected.
Thank you! I'll check it out.