[Anubis IV]

Ok, here's a new one for me...

A computer in my house was in the middle of running a process in an application when it got the beachball and froze up. My little brother, who apparently was attempting to use a "hacking" app on the computer at that time, force restarted the iMac and now only gets a command line prompt asking him to login whenever he boots up, but as far as we can tell, his login name and password do not work. The system denies his login every time he tries. We can boot up by holding down Shift or boot into Single-User Mode by holding down Shift+S easily enough, but I honestly have no idea what to do or what I'm looking for. I ran fsck just to see if that might help, but fsck -f came up as saying that everything was A-OK. We tried tossing out all the files for those hacking applications that we could find (including the prefs) just as a precautionary measure, but I'm clueless where to go from there since it seems to have had no effect.

Anyone have a similar experience or might have some light to shed on the topic? The faster you guys can help, the better, but I honestly wouldn't mind leaving him without a useable computer for a day or two just to teach him a lesson for trying to use those apps...

[asdasd]

So it works in safe boot?

Sounds like the app added something to

/System/Library/StartupItems

Here is what I have in there

AMD BIND Disks NIS Postfix SystemTuning
Accounting ConfigServer IPServices NetInfo PrintingServices mDNSResponder
Apache CoreGraphics KernelEventAgent Network RemoteDesktopAgent
AppServices CrashReporter LDAP NetworkExtensions SNMP
AppleShare Cron LoginWindow NetworkTime SecurityServer
AuthServer DirectoryServices NFS Portmap SystemLog

[Anubis IV]

Yeah, he and I both have those 32 items in our StartupItems as well, and the date modified isn't too recent for any of his. That sounds like it could be on the right track, but we seem to have hit a bit of a dead-end. Any other ideas?

[asdasd]

a bit stumped

but try and look in

/Library/Logs/CrashReporter

to see what crashed during boot ( root processes are logged here)

[asdasd]

Acutally I misinformed you

You should check out /Libary/StartupItems which won't exist if there were no additions.

safe boot also ingores added kexts ( which *are* stored in System/Library/Extensions inconsistantly), but if they were buggy then you would have a startup panic.

[Anubis IV]

Well, as far as we could tell nothing turned up in the CrashReporter, and likewise, his /Library/StartupItems directory does not exist. In the course of our attempts to repair the computer though, we think we might have discovered that the com.apple.loginwindow.plist in /Library/Preferences was damaged or destroyed, but it seems to be back in place now, and nothing seems to have changed.

A few more little details: The computer seems to start booting up fine, and it goes through the gray Apple, but once it gets to the blue screen it kinda freezes for a second and then switches to a command line prompt that prompts for "username" and the like. There isn't any other info there on that prompt. After it denies his password (which it always does, regardless of whether we use the short name or full name) it goes back to the blue screen for a few seconds, spins that little icon for a bit, then goes back to the black UNIX command prompt asking for his username and password. Just kinda seems like a strange thing.

[asdasd]

See if you get a loginwindow crash in the /Library/Logs/CrashReporter

you may want to remove the loginwindow preferences, it may be corrupted and you don;t need it , loginwindow has defaults which such work.

[Anubis IV]

Well, the prefs file was actually just recreated a few minutes ago, hence the reason why I said that we think it might have been damaged or destroyed previously. The new prefs files was just created a few minutes ago. Anyway, according to him, nothing seems to be crashing during startup and strangely enough, there are no logs whatsoever underneath CrashReporter.

[bmedina]

I've seen a similar problem but never found a solution. I had to do an archive and install.

[Anubis IV]

A quick call to AppleCare and it's been solved. Annoying little brother and his failure to buy AppleCare for the iMac...

Anyway, after telling them that the issue was with my PowerBook and describing it exactly, they figured out that adasd was completely correct, but for some reason things were weird and it didn't work earlier. Long story short, he had us rename the /Library/StartupItems as /Library/StartupItems.old (which I found very strange since /Library/StartupItems did NOT exist when you asked about it earlier, asdasd), and it worked fine after the first reboot. So yeah, you gave us the correct instructions, but for whatever reason that item didn't appear until just a few minutes ago. What's even more strange is that it was a .app file and not a folder. Very strange. Anyway, thanks for all the help and for sticking with us while we got this sorted out. I appreciate it, and I'm sure my brother does as well.