eto@spacely.Jpl.Nasa.Gov (Edward Olsen) (05/25/88)
I have encountered a strange growth of the System file on some Macintosh II's. The files, which I initially installed with a size of 241K (since we have Suitcase, I have stripped all fonts and DAs out except for the bare minimum) have grown to over 10M. A clover-I indicates this as well as the report of space used on the internal hard disk. ResEdit indicates that the growth appears in the resource fork, but when I search through all the resources I can only identify one which is abnormally large. It is Cmra (or cmra), and reports a size of 1.6M. The other 7M+ do not show up at all. Funny thing, I can drag the system file over to an 800K floppy with no trouble (although Cmra still appears to be 1.6M). A clean release of the system does not contain Cmra at all. I therefore cut it out of the system and found it returned to 241K in size. No problem operating since then. I also had Cmra on my Mac Plus, but it never grew beyond 26 bytes. I cut it out of the system there as well with no ill effects. Can anybody give me an explanation of what is happening? I cannot find a reference to Cmra anywhere. All Macintoshes were running Finder 6.0 and System 4.2 and Multifinder, and were connected to LaserWriter Pluses. The Macintosh II's were equipped with rev B ROMs and Radius Full Page Displays. Edward Olsen
benjamin_kuo@pedro.UUCP (Benjamin Kuo) (05/29/88)
Sounds like a virus. These unknown resources are ALMOST ALWAYS viruses getting to your system. (25 megabyte DeskTop file, in my case).
steele@Apple.COM (Oliver Steele) (05/31/88)
eto@spacely.Jpl.Nasa.Gov (Edward Olsen) writes about a System file and a Resource that got Too Big. Your system file has been corrupted. Replace it. Don't even try to copy your FONTs/DAs/etc. from it into the new one; arbitrary resources may have been trashed. This is the case any time you see a resource with a huge or negative size, as it is if you click on a FONT/DA with Font/DA Mover and see a preposterous size for it. Exception: Some ResEdits may show a size of -1 for certain resources; this means that they're in the ROM. Don't try to delete, replace, or copy these resources with that ResEdit. There's not necessarily a relation between the funny resources and the program that corrupted them. My guess would be a crash or errant program _combined with_ (or maybe the same as) one that attempted to modify the System file, such as Chooser, Control Panel, or FadeToBlack, but I'm not a Resource type of guy. ---------------------------------------------------------------------------- Oliver Steele steele@apple.com Apple ATG Disclaimer: this isn't official.
korn@eris.berkeley.edu (Peter "Arrgh" Korn) (06/02/88)
In <240@pedro.UUCP>, benjamin_kuo@pedro.UUCP (Benjamin Kuo) said: > Sounds like a virus. These unknown resources are ALMOST ALWAYS viruses >getting to your system. (25 megabyte DeskTop file, in my case). NO, it does NOT sound like a virus. "unnkown" resources ALMOST ALWAYS belong to Desk Accessories and INITs that are living in your system. Occasionally uninstalling them didn't uninstall all of their resources, just the INIT or DRVR resource. Let me repeat, it is most likely NOT a virus which caused this. I've had this happen to me several times, and always the culprit was a prerelease copy of some program that installs or removes resources (certain early copies of ResEdit, the installation programs that occasionally accompany INITs, etc.). Typically what has happened is that the resource map is hosed, and I've yet to successfully repair it once damaged. Peter -- Peter "Arrgh" Korn korn@ucbvax.Berkeley.EDU {decvax,dual,hplabs,sdcsvax,ulysses}!ucbvax!korn