Q&A: MacFixIt Answers
Firmware passwords not resetting on new Mac systems, and more questions answered.
MacFixIt Answers is a feature in which we answer questions e-mailed in by our readers.
Question: Firmware password not resetting on a new Mac system
MacFixIt reader Jim asks:
I went to boot into target disk mode on my Nov 2011 MacBook Pro, having secured it with a password that I have since discovered I have lost. Now, whenever I try to boot, the machine asks for the target disk password. I tried your suggestion of changing the RAM configuration from 8GB to 4 GB and I get the same result. Do you have any other suggestions?
The only way to clear the firmware password is to alter the hardware configuration; however, Apple has taken some steps in more recent hardware revisions to prevent this. Some people have had success in changing the RAM configuration several times (swapping chips, using only one chip, trying different slot configurations), but in a knowledgebase article Apple mentions that for later systems the only way to clear the firmware password is to take the system into a service center.
Question: Clearing malware from Time Machine backups
MacFixIt reader Ken asks:
In the new climate of security concerns, I recently installed Sophos 8 Mac because VirusBarrier was missing Windows malware attachments. There has been a pesky e-mail supposedly from Fed-Ex, which has a Trojan attachment. Even if you don't try to open it and trash the e-mail, it remains in the Trash Folder until emptied depending on Mail settings. It then gets copied onto Time Machine volume at the next backup and Sophos picks it up during the hourly copy. [When this happens, it] states that it cannot be cleaned up and has to be done manually.
That leads to two problems, first trying to find it by drilling through the backup folders but then if you find it and try to delete it, Time Machine comes up with warning that items cannot be deleted from backups. How can you delete items from Time Machine without deleting the whole backup folder that the item is in?
While deleting files directly from the Time Machine volume can usually be done without any problems, it may cause faults in how the filesystem manages the many hard links used in the backups.
To delete individual files, it is best to invoke the Time Machine interface and then locate the most recent backup of the file. Then right-click it within Time Machine and choose the option to delete all backup instances of the file. This is how I would recommend getting rid of any backups that contain malware. In this case you can do this directly from within Mail, as the program supports browsing backups from within the program instead of relying on the Finder.
The malware on the backups will not harm the system at all, and should eventually be discarded as the backups are replaced with new ones. The only concern here is if an old backup instance needs to be restored in full; however, you can avoid this by creating a current malware-free backup of your system in its working state, and then use that or a more recent one as the backup to restore, if needed. At this point, any files from previous backups can be restored individually.
Question: Trash immediately deleting files and requesting admin password
MacFixIt reader Mark asks:
I seem to have unknowingly created a problem that I can't seem to fix. Whenever I move an item to the Trash via either the "command-delete" shortcut, or the "Move To Trash" option in the Finder's "File" drop-down menu, or a simple drag and drop to the Trash icon, I now get a Finder alert that forces me to enter my password. When I do, the item moves to the trash and empties. Very annoying and troubling because it disallows me from storing or removing an item from the Trash. I've tried deleting the Finder Preference file with no change and I've got the "Warn Before Emptying The Trash" option unchecked. Can you help?
You have a corrupted trash folder on your system. To correct this problem, try running the following command in the Terminal (located in the /Applications/Utilities/ folder):
sudo rm -rf ~/.Trash
Be sure to copy and paste this exactly as-is, and then provide your password when prompted. This command will remove the trash folder within your user account, which will be recreated by the Finder and hopefully work properly when you next trash a file.
MacFixIt reader Bob asks: