Groups > comp.sys.mac.system > #120298

Re: Recover root/wheel password?

From	nospam <nospam@nospam.invalid>
Newsgroups	comp.sys.mac.system
Subject	Re: Recover root/wheel password?
Date	2019-01-08 00:43 -0500
Organization	A noiseless patient Spider
Message-ID	<080120190043395709%nospam@nospam.invalid> (permalink)
References	<q10hl1$ief$1@panix3.panix.com> <070120192342023892%nospam@nospam.invalid> <q11arg$1mc$1@reader2.panix.com>

Show all headers | View raw

In article <q11arg$1mc$1@reader2.panix.com>, Brian Gordon
<briang@panix.com> wrote:

> >> My mac's environment was created eons ago, but my personal login has most
> >> superpowers.  I need to delete a file owned by root/wheel and I am not
> >> being
> >> allowed to do it. Is there some way a privileged user can recover the
> >> needed password?
> >
> >what file is it and why do you want to delete it?
> >
> >there's probably a very good reason why it's not letting you do that.
> 
> The file has been identified by CyberByte as being infected. It is
> /Library/Preferences/.3FAD0F65-FC6E-4889-B975-B96CBF807B78, and is
> the only file in that directory with a name in that format. It was created
> late
> at nignt on 10/24/18.  I have a saved copy, so it can be restored if its
> removal causes problems.

cyberbyte appears to be an antivirus tool, but one that reeks of being
scamware.

does it say if there any other infected files?

see what malwarebytes has to say:
<https://www.malwarebytes.com/mac-download/>

anyway, assuming you know the admin password, use sudo to rm it, which
i assume you've tried.

if that doesn't work, it probably has the uchg and/or schg bits set.

check to confirm (ls -lO) and if so, they'll need to be cleared, which
probably will require single user mode.

if you don't know the admin password, that's a different problem...

Back to comp.sys.mac.system | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Recover root/wheel password? briang@panix.com (Brian Gordon) - 2019-01-07 16:51 -0500
  Re: Recover root/wheel password? Alan Baker <nunya@ness.biz> - 2019-01-07 13:58 -0800
  Re: Recover root/wheel password? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-07 23:09 +0000
  Re: Recover root/wheel password? Jolly Roger <jollyroger@pobox.com> - 2019-01-08 01:45 +0000
    Re: Recover root/wheel password? Alan Browne <bitbucket@blackhole.com> - 2019-01-08 08:27 -0500
      Re: Recover root/wheel password? Jolly Roger <jollyroger@pobox.com> - 2019-01-08 14:06 +0000
        Re: Recover root/wheel password? Alan Browne <bitbucket@blackhole.com> - 2019-01-08 20:07 -0500
          Re: Recover root/wheel password? Jolly Roger <jollyroger@pobox.com> - 2019-01-09 20:30 +0000
            Re: Recover root/wheel password? Alan Browne <bitbucket@blackhole.com> - 2019-01-09 19:43 -0500
              Re: Recover root/wheel password? Alan Baker <nunya@ness.biz> - 2019-01-09 16:55 -0800
              Re: Recover root/wheel password? Jolly Roger <jollyroger@pobox.com> - 2019-01-10 02:13 +0000
                Re: Recover root/wheel password? Alan Browne <bitbucket@blackhole.com> - 2019-01-10 07:48 -0500
                Re: Recover root/wheel password? Jolly Roger <jollyroger@pobox.com> - 2019-01-10 17:34 +0000
      Re: Recover root/wheel password? Alan Baker <nunya@ness.biz> - 2019-01-08 11:34 -0800
      Re: Recover root/wheel password? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-08 22:12 +0000
        Re: Recover root/wheel password? Alan Browne <bitbucket@blackhole.com> - 2019-01-08 20:11 -0500
  Re: Recover root/wheel password? nospam <nospam@nospam.invalid> - 2019-01-07 23:42 -0500
    Re: Recover root/wheel password? briang@panix.com (Brian Gordon) - 2019-01-08 05:01 +0000
      Re: Recover root/wheel password? nospam <nospam@nospam.invalid> - 2019-01-08 00:43 -0500

csiph-web