Tabakal@UB.CC.UMICH.EDU (11/18/89)
I'm starting to think I've got a virus, and I'm not speaking lightly.
My computer is starting to act really quite funny. I ran ProSel's Mr.
Fixit to see if the drive has been changed, but no conclusive data.
To recap: I've been getting a ProDOS #56 error quite a bit. Not only
Zlink, but Kermit and other problems. Today I had two other weird
events that haven't occurred before. First is that when I booted GS/OS
from my hard drive, it kept accessing the hard drive rapidly for a
lengthy period after the thermometer finished. Much too long for the
number of DA's and startup files I have on the machine. When I booted
up a 5.0 disk by 3.5 disk, it booted up much more quickly.
In fact, eventually, I just hit Reset since the Finder wasn't coming up.
After the 3.5 bootup, there's no problem with bootup, yet.
Periodically, I'm getting strange beep sounds, not when it should beep,
but at seemingly random times in comm. programs and AppleWorks.
Finally, I tried to move two files in the finder from one subdirectory
to another. One move. The other did not (shift-clicked on both).
I got System Error #8051. Whatever that is. I'm starting to get
concerned. If I do think that I'm infected with something, not any
virus I've seen before, BTW (including CyberAids and Festering Hate),
what ought I do?
Backups are obviously in order...
-- Todd
-----------------------------------------------------------------------------
Todd A. Bakal I believe in the Cubs,
U of M Apple User's Group Bo's national championship
Ann Arbor, Michigan chances, and my Apple ][gs.
Internet: Tabakal@ub.cc.umich.edu FTP: 35.1.1.43
UUCP: ...!uunet!ub.cc.umich.edu!tabakal BITnet: Tabakal@UMICHUBbsherman@mthvax.cs.miami.edu (Bob Sherman) (11/18/89)
>I'm starting to think I've got a virus, and I'm not speaking lightly. >My computer is starting to act really quite funny. I ran ProSel's Mr. >Fixit to see if the drive has been changed, but no conclusive data. [................] ) Todd A. Bakal I believe in the Cubs, ) U of M Apple User's Group Bo's national championship ) Ann Arbor, Michigan chances, and my Apple ][gs. ) Internet: Tabakal@ub.cc.umich.edu FTP: 35.1.1.43 ) UUCP: ...!uunet!ub.cc.umich.edu!tabakal BITnet: Tabakal@UMICHUB Mr. Fixit is not designed to detect or fix a virus. I suggest you purchase a copy of AppleRx, also by Glen Bredon.. It is designed to detect a virus. -- bsherman@mthvax.cs.miami.edu | bsherman@pro-exchange | MCI MAIL: BSHERMAN >> Miami's Big Apple - 305-948-8000 - 24 hours - 300/1200 - PCP'able << >> Oldest Apple support board in Southeast. Now in it's ninth year. <<
mattd@Apple.COM (Matt Deatherage) (11/19/89)
In article <3986762@ub.cc.umich.edu> Tabakal@UB.CC.UMICH.EDU writes: > >To recap: I've been getting a ProDOS #56 error quite a bit. Not only >Zlink, but Kermit and other problems. Today I had two other weird >events that haven't occurred before. First is that when I booted GS/OS >from my hard drive, it kept accessing the hard drive rapidly for a >lengthy period after the thermometer finished. Much too long for the >number of DA's and startup files I have on the machine. When I booted >up a 5.0 disk by 3.5 disk, it booted up much more quickly. > >In fact, eventually, I just hit Reset since the Finder wasn't coming up. >After the 3.5 bootup, there's no problem with bootup, yet. > >Periodically, I'm getting strange beep sounds, not when it should beep, >but at seemingly random times in comm. programs and AppleWorks. > >Finally, I tried to move two files in the finder from one subdirectory >to another. One move. The other did not (shift-clicked on both). >I got System Error #8051. Whatever that is. I'm starting to get >concerned. If I do think that I'm infected with something, not any >virus I've seen before, BTW (including CyberAids and Festering Hate), >what ought I do? > >Backups are obviously in order... > > -- Todd Yes, but probably not why you think they are. Let's look at this more logically (see, I can do that. It ain't my precious machine that's gone mashugga. I wonder how often indifference masquerades as "professionalism" in other fields, like health care? "It's not *my* leg..." :) Error $56 is Bad Buffer Address. An address passed to OPEN or SET_BUF is either not page-aligned (not likely) or already marked as used in the System Global Page. Error $8051 clears out to $51, which means "directory structure is damaged". But Mr. Fixit finds no directory damage problems. This suggests that the error was actually a corrupted disk cache in GS/OS, which is tossed when you go to P8 (where you run Mr. Fixit). The disk stops booting. Strange sounds (like beeps) come out when you're not expecting it. I think two solutions are much more likely than some virus (from everything I can tell, the spread of viruses in Apple II land has been really limited and is not the threat everyone thinks it is. That doesn't mean people shouldn't be vigilant, but it does mean you shouldn't think of a virus as a likely trouble-causer): 1) You've installed a new DA or INIT recently that's stepping on othe people's memory. A CDA or INIT could install a heartbeat task whic continues to function in ProDOS 8, causing problems all the time. I think this is the most likely solution. 2) Memory in your system is going or has gone bad. This would account for a lot of the stuff like corrupted disk cache blocks or failure to boot, but probably couldn't account for the ProDOS 8 error $56 (unless motherboard memory has gone bad as well; P8 runs in banks $0 and $1 which are always on the main logic board). So I'd run a memory tester and then start removing DAs and setup files, and see how things go. -- ----------------------------------------------------------------------------- Matt Deatherage, Apple Computer, Inc. | "The opinions expressed in this tome Send PERSONAL mail ONLY (please) to: | should not be construed to imply that Amer. Online: Matt DTS | Apple Computer, Inc., or any of its ThisNet: mattd@apple.com | subsidiaries, in whole or in part, ThatNet: (stuff)!ames!apple!mattd | have any opinion on any subject." Other mail by request only, please. | "So there." -----------------------------------------------------------------------------
dlyons@Apple.COM (David Lyons) (11/19/89)
In article <3986762@ub.cc.umich.edu> Tabakal@UB.CC.UMICH.EDU writes: >[...] >To recap: I've been getting a ProDOS #56 error quite a bit. Not only >Zlink, but Kermit and other problems. (By the way, I think you *don't* have a virus. Keep decent backups anyway.) ProDOS error $56 can happen like this: your SYS program OPENs a file using a particular 1K buffer area. It gets some sort of error and never manages to close the file. Later it tries to open another file with that same 1K buffer, which is still marked "in use" in the memory bitmap. Presto--error $56. You might want to check with the authors of ZLink and Kermit to see whether you've got the latest version, and whether your version had problems with $56 errors. -- --Dave Lyons, Apple Computer, Inc. | DAL Systems AppleLink--Apple Edition: DAVE.LYONS | P.O. Box 875 America Online: Dave Lyons | Cupertino, CA 95015-0875 GEnie: D.LYONS2 or DAVE.LYONS CompuServe: 72177,3233 Internet/BITNET: dlyons@apple.com UUCP: ...!ames!apple!dlyons My opinions are my own, not Apple's.
prl3546@tahoma.UUCP (Philip R. Lindberg) (12/06/89)
From article <3986762@ub.cc.umich.edu>, by Tabakal@UB.CC.UMICH.EDU: > I'm starting to think I've got a virus, and I'm not speaking lightly. > My computer is starting to act really quite funny. > > To recap: I've been getting a ProDOS #56 error quite a bit. > [...] First is that when I booted GS/OS > from my hard drive, it kept accessing the hard drive rapidly for a > lengthy period after the thermometer finished. Much too long for the > number of DA's and startup files I have on the machine. [...] > -- Todd I have not had the ProDOS #56 error, or any other of you symptoms EXCEPT I have had the "kept accessing the hard drive rapidly for a lengthy period after the thermometer finshed" problem. I was really surprised to see it happening. The only two things I have changed resently were the update to 5.0.2 a couple of weeks ago and yesterday's change to AWGS 1.1 which was a couple of hours before the reboot incident happened. I don't know if it was related. It may have been just coincidence, and it only happened once. Anybody out there with any ideas? +--------------------------------------------------------------+ | Grampa says when he was a kid they did math with a trig. book| | Phil Lindberg snail mail: 13845 S.E. 131 ST | | UUCP: ..!uunet!bcstec!tahoma!prl3546 Renton, WA 98056 | | Disclaimer: I don't speak for my employer (and I not | | sure they even know I exist....) | +--------------------------------------------------------------+