Resolved What Just happened after the update??

[RobinHood5]

I just installed the most recent update on my 2011 27" iMac and had something strange happen. When I rebooted it for only about 1-2 seconds a screen flashed up at the beginning of the boot process that was all red with christmas trees and stuff and said Merry Christmas (didn't get a good look at it) and I read the text "to boot to Macintosh SSD" right before it continued (I assume click X "to boot to Macintosh SSD" which is the name of my boot drive.

What Happened??? Easter Egg much?? I'm freaking out right now, shut down and rebooted and did not see it again.

 

[roberthallin]

What did you update?

 

[RobinHood5]

What did you update?

Just the most recent OS X update and some apps - I searched and could not find anything about anyone else seeing this...

 

[roberthallin]

I did a quick search as well and couldn't find anything like it. I really have no idea what's going on, but I think it's safe to say that it's not coming from Yosemite/Apple. I'd be a little worried as well, haha.

 

[cynics]

Are you talking about the Yosemite update that came out 2 weeks ago? I'm assuming you have been waiting to update?

 

[yjchua95]

I just installed the most recent update on my 2011 27" iMac and had something strange happen. When I rebooted it for only about 1-2 seconds a screen flashed up at the beginning of the boot process that was all red with christmas trees and stuff and said Merry Christmas (didn't get a good look at it) and I read the text "to boot to Macintosh SSD" right before it continued (I assume click X "to boot to Macintosh SSD" which is the name of my boot drive.

What Happened??? Easter Egg much?? I'm freaking out right now, shut down and rebooted and did not see it again.

I think you got infected with Thunderstrike, where the boot ROM somehow got hijacked.

Can you take a video of it happening?

If it's really Thunderstrike, I'm afraid you're really screwed.

 

[redheeler]

I think you got infected with Thunderstrike, where the boot ROM somehow got hijacked.

Can you take a video of it happening?

If it's really Thunderstrike, I'm afraid you're really screwed.

If it's really Thunderstrike then it would be the first reported instance of it out in the wild.

 

[yjchua95]

If it's really Thunderstrike then it would be the first reported instance of it out in the wild.

It really sounds like Thunderstrike, because instead of the usual blank screen before boot, it shows up with the weird stuff before proceeding to boot. Which means the boot ROM has been screwed with.

 

[nj-mac-user]

I think you got infected with Thunderstrike, where the boot ROM somehow got hijacked.

Can you take a video of it happening?

If it's really Thunderstrike, I'm afraid you're really screwed.

He would've had to have a Thunderbolt drive connected to get infected.

 

[yjchua95]

He would've had to have a Thunderbolt drive connected to get infected.

This might be a new implementation which mounts a virtual drive containing the firmware to infect the boot ROM. It's possible, because as a software dev myself, it's been done on a Windows BIOS system. I suppose the same could apply for UEFI.

 

[RobinHood5]

He would've had to have a Thunderbolt drive connected to get infected.

My boot drive is a thunderbolt attached SSD

----------

I think you got infected with Thunderstrike, where the boot ROM somehow got hijacked.

Can you take a video of it happening?

If it's really Thunderstrike, I'm afraid you're really screwed.

it only happened the once so far, I tried rebooting it once and it didn't. This is sounding like some pretty scary stuff. It was right after I installed some OS X updates and installed a new Cyberpower UPS.

----------

Are you talking about the Yosemite update that came out 2 weeks ago? I'm assuming you have been waiting to update?

I haven't used my iMac much in the last couple weeks so its likely that it was.

 

[hoejo]

I saw this on a few hackintoshes using the clover bootloader

 

[RobinHood5]

I saw this on a few hackintoshes using the clover bootloader

Really? I have a Hackintosh but this was my iMac that had this... Any more info about it?

----------

This is the screen I got!! I found someone that posted a screenshot of it relating to a clover install. I have a server that is a hackintosh but never even used clover on it to install it.

Heres the photo

 

[hoejo]

I must admit: I built a hackintosh myself, to see if the os can fit my needs - I loved the os, so I bought a 5k iMac and I'm simply blown away!!! It's very near to perfection machine for me (and I've seen and owned a lot of computers) - but to answer you question:

I saw this screen on my hack too - here you'll find some information: http://www.insanelymac.com/forum/topic/284656-clover-general-discussion/page-171

Strange, that you saw this on an original iMac....