iMac infected with virus - seeking best approach to cure.

We have a user who has reported a virus in their iMac. The details I have our sketchy and I don’t have the specific symptoms other than that they shut down the iMac in fear that data loss would occur.

In the PC world I would know exactly what to do, i.e. first remove the drive and mount it as a secondary drive to remove the essential data, but how do I approach this in the Mac world where I can’t easily open the device to get to the drive?

Is there a mode where I can safely copy data to a USB hard drive before I get to work on it? (Of course I will educate the user to the benefits of backup afterwards.
Any other general tips on the approaching this are appreciated.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Yes, it's called target disk mode.  You can boot from another Mac or attach it as an external drive.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Also, you could try to hold down the option key while booting, and if it's new enough you should see a recovery HD.  Boot to that, attach a usb drive and copy the Macintosh HD to the USB drive.
What makes him think he has a virus? They are rare and it is extremely unlikely he has one, particularly if his software is up to date. You need to find out why he thinks he has a virus before galloping off in the wrong direction.

There are a couple of free Mac antivirus programs he can download to check and clean his computer if necessary:
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

As strung said, I think you need to do some initial diagnosis of the problem first. The user's personal diagnosis of the problem (or even just their description of the symptoms) are frequently inaccurate, and sometimes just plain wrong.

If the user is extremely concerned that simply powering on the mac will result in data loss... you can appease them by copying their data elsewhere before you work on the Mac.

But probably more likely is the user saw a scary message on the screen (imagine a scary looking advertisement popup on a sketchy website they were visiting), panicked, and shut the computer down and called you. Powering it back on probably won't have any bad effects on anything.

Don't assume virus until you see it for yourself. The first step is to reproduce the issue that the user is experiencing.
afflik1923Author Commented:
Will update soon. We have the Mac in our office now.
afflik1923Author Commented:
OK. A new thread was started on this so feel free to comment on this:

Thanks as always.
afflik1923Author Commented:
In the end this was the anti virus software being out of date, I believe a few bad sectors on the disk etc. once we done general update and maintenance the issue was resolved. The AV software was effectively reporting normal files as viruses.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.