[comp.sys.mac] Hang due to floppy copy -- update

dce@stan.UUCP (David Elliott) (03/13/89)

Last night, I was downloading some new programs, and as the finder was
rebuilding the desktop, it hung again.  I rebooted, and every time the
finder started trying to rebuild the desktop (whether I told it to or
not), it would hang.

I ran Disk First Aid and it found and fixed a problem.  I ran the disk
verification tests, and no problems were found.

After that, every time the finder tried to start up, it told me that
"minor disk repairs" needed to be made.  I let it try, but it hung
every time.

This morning, I began running destructive disk tests, but I doubt that
I'll find any problems.

My current suspicion is that the desktop is limited in size, and I
passed that size.  This might explain why I could duplicate and copy
from floppy files that were already on the hard disk, but any new
files caused the hang.

-- 
David Elliott		...!pyramid!boulder!stan!dce
"Splish splash, I was rakin' in the cash"  -- Eno

trebor@biar.UUCP (Robert J Woodhead) (03/14/89)

In article <581@salgado.stan.UUCP> dce@stan.UUCP (David Elliott) writes:
>
>Last night, I was downloading some new programs, and as the finder was
>rebuilding the desktop, it hung again.  I rebooted, and every time the
>finder started trying to rebuild the desktop (whether I told it to or
>not), it would hang.

1) You were downloading programs.  What does this suggest?
2) Why would the desktop need to be rebuilt after this?

>
>I ran Disk First Aid and it found and fixed a problem.  I ran the disk
>verification tests, and no problems were found.
>
>After that, every time the finder tried to start up, it told me that
>"minor disk repairs" needed to be made.  I let it try, but it hung
>every time.
>

This sounds suspiciously like a virus called ANTI from France.  You
should take several steps to determine if this is so, immediately.

* The latest version of VirusDetective has new checks for ANTI.
  It just got posted to comp.sources.mac.

* Virex 1.3 [disclaimer, I am the author] can cure ANTI.  If you have
  1.3, run it.  If you have an earlier version, consider upgrading
  (especially if VirusDetective tells you ANTI is around)

* AntiToxin (another commercial product) can reportedly kill ANTI
  as well.

* Boot off a clean floppy.  Rename the finder on you hard old_finder
  and copy a new finder onto your hard disk.  Reboot off the hard
  disk and see if the problem reoccurs; if it doesn't, your finder
  was infected, as was every other program you have run since you
  got infected.  At this point, you must either use VirusDetective
  to locate these files and replace them, or one of the commercial
  tools to scan your disk and _repair_ them.



-- 
* Robert J Woodhead * The true meaning of life is cunningly encrypted and *
* uunet!biar!trebor * hidden somewhere in this signature...               *
* Biar Games, Inc.  *                       ...no, go back and look again *

macak@lakesys.UUCP (James Macak) (03/15/89)

In article <376@biar.UUCP> trebor@biar.UUCP (Robert J Woodhead) writes:
>In article <581@salgado.stan.UUCP> dce@stan.UUCP (David Elliott) writes:

>>Last night, I was downloading some new programs, and as the finder was
>>rebuilding the desktop, it hung again.  I rebooted, and every time the
>>finder started trying to rebuild the desktop (whether I told it to or
>>not), it would hang.

>1) You were downloading programs.  What does this suggest?
>2) Why would the desktop need to be rebuilt after this?

>This sounds suspiciously like a virus called ANTI from France.  You
>should take several steps to determine if this is so, immediately.
(Lines from both messages deleted.)

It might be good to add one point to the recommendations made by Mr. Woodhead:
if you indeed _do_ find that a virus was causing these problems, please get in
touch with the source of the suspect software (the stuff you were downloading
that was likely carrying the virus) and warn them that a virus is present in
those files.

Not only should we safeguard ourselves against viruses, but if we engage in
exchanging shareware/freeware for the Mac, we have an obligation to inform
others if we know of a file that carries a virus.  To know and not warn
others is tantamount to speading the virus yourself...

Jim


-- 

Jim Macak  <lakesys!macak@csd1.milw.wisc.edu>

dce@stan.UUCP (David Elliott) (03/16/89)

In article <466@lakesys.UUCP> macak@lakesys.UUCP (James Macak) writes:
>In article <376@biar.UUCP> trebor@biar.UUCP (Robert J Woodhead) writes:
>>1) You were downloading programs.  What does this suggest?
>>2) Why would the desktop need to be rebuilt after this?
>
>It might be good to add one point to the recommendations made by Mr. Woodhead:
>if you indeed _do_ find that a virus was causing these problems, please get in
>touch with the source of the suspect software (the stuff you were downloading
>that was likely carrying the virus) and warn them that a virus is present in
>those files.

First of all, I think that Bob was a little careless when he posted
this.  Viruses are indeed a problem, but we don't need people making
statements that infer that downloading programs will always result in
viruses.  After all, just because viruses can imitate real system
problems doesn't mean that system problems don't exist.

In my case, I believe that it is fairly clear that my problem was not
a virus.  First of all, I run virus detection programs every day.
Secondly, the only places I have downloaded from recently are sumex
and NCSA.  Finally, I was able to cause this problem booting from a
locked floppy which was scanned for viruses.  I did say in my first
posting that I was sure that the problem was not a virus.

My current theory is that this was caused by bad bundle bits that
caused my desktop to bloat.  Even when I rebuilt the desktop a week
before the problem happened, it was taking over 30 seconds to update
the desktop.  Now that my system has been completely restored, the
update takes less than 5 seconds.  I also noticed that about 3 weeks
ago, StuffIt archives began appearing as archives belonging to
applications that had just been added to the system.

I do agree, Jim, that if someone finds a virus that they should
locate the carriers and warn people.  We're all in this together.

-- 
David Elliott		...!pyramid!boulder!stan!dce
"Splish splash, I was rakin' in the cash"  -- Eno

urlichs@smurf.ira.uka.de (Matthias Urlichs) (03/18/89)

In comp.sys.mac dce@stan.UUCP (David Elliott) writes:
< 
< Last night, I was downloading some new programs, and as the finder was
< rebuilding the desktop, it hung again.  I rebooted, and every time the
< finder started trying to rebuild the desktop (whether I told it to or
< not), it would hang.
Another one bites the dust.

The Desktop file is a resource file. If this gets full, you get rather
spectacular crashes. (Apple forgot to do some basic tests here. :-( :-( )

The Fix: Get the Desktop Manager INIT from someone. It is supplied on
AppleShare server installer floppies. Place into your System folder,
reboot, and rebuild the Desktop.
No more problems, except that you can't drag hard disks to the trash any more.

Disclaimer: Apple specifically warns against doing the above.
I am doing the above for more than a year now and have never had a single
problem.

PS: You might want to use something like Disktop and copy a Desktop file from a
freshly initialized floppy to you HD. This will a) clean out the old
damaged Desktop file and b) prevent the Finder from automatically
rebuilding the desktop if you should boot without the Desktop Manager.

This posting, as well as the problem it adresses, will be repeated next
month at the latest. Big HDs get more common. Apple: Please give us
an approved now. Waiting for System 7.0 is no fun... :-)
-- 
Matthias Urlichs -- Humboldtstrasse 7 -- 7500 Karlsruhe 1 -- FRG
urlichs@smurf.ira.uka.de -- ++49+721-621127@PTT