[comp.virus] help with mac "virus"?

billj@uop.uop.edu (Snugglupagus) (05/05/91)

recently, we've come across a problem with one of the macs in our lab.
we really don't know if it's a virus or not, but it does act something
like one.  anyway, here are the symptoms:

- - the mac has a 40 meg hard disk
- - there is only about 16 meg of software installed
- - both the finder and mactools report 38 meg used, 2 meg free
- - disinfectant can't find anything, and neither can virus detective
- - there are no hidden files anywhere on the disk (if there are, neither
  mactools nor resedit can find them)
- - the "virus" hasn't spread to any of our other macs

what we really want to know is: is this some sort of new virus, or is
our mac just confused?

thanks in advance,

snugglupagus
- --
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  "Steppin' on toes is a common routine    |  Send email/flames to:
   Sneakin' up from behind                 |     billj@uop.edu
   You won't get anywhere                  |-----------------------------------
   Dancin' out of time" - Deborah Gibson   |  Disclaimer:  It's all mine!
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CANDERSO@uga.cc.uga.edu (Christopher T. Anderson) (05/06/91)

> recently, we've come across a problem with one of the macs in our lab.
> we really don't know if it's a virus or not, but it does act something
> like one.  anyway, here are the symptoms:
>
> - - the mac has a 40 meg hard disk
> - - there is only about 16 meg of software installed
> - - both the finder and mactools report 38 meg used, 2 meg free
> - - disinfectant can't find anything, and neither can virus detective
> - - there are no hidden files anywhere on the disk (if there are, neither
>   mactools nor resedit can find them)
> - - the "virus" hasn't spread to any of our other macs
>
> what we really want to know is: is this some sort of new virus, or is
> our mac just confused?"

This problem is not necessarilt indicative of a virus, but an
otherwise corrupted Directory (or possibly Desktop).  You could try
rebuilding your Desktop, but probably should defrag/optimize the
drive.  This would rebuild your directory.  For this I reccomend Disk
Express II, it has always worked wonders for me.

-
 -------------------------------------------------------------------------------
Name:           Christopher T. Anderson (Chris)
Mail Address:   Computer Services Annex  Electronic Addresses:
                University of Georgia          Bitnet: CAnderso@uga
                Athens, GA 30602             Internet: CAnderso@uga.cc.uga.edu
Telephone: Work (404) 542-5162               EasyLink: 74730.3306@compuserv.com
           Home (404) 549-8958         America Online: CTAnderson

                             C A R P E   D I E M ! ! !
-
 -------------------------------------------------------------------------------

norman@cs.st-andrews.ac.uk (Norman Paterson) (05/07/91)

billj@uop.uop.edu (Snugglupagus) (vol 4 issue 74): we have noticed a
similar effect but only on the 800 kb floppies.  It seems that the
disc is fragmented and the missing space is recovered by drag copying
the old floppy to a newly initialised floppy.

I don't know if the hard disc software is more intelligent - I'd hope
so!  But you might try connecting up a spare hard disc, initialising
it, and drag copying the old one onto it, to see if your space
reappears.  Effectively you are compacting your disc by this method.

Norman

keir@vms.macc.wisc.edu (Rick Keir, MACC) (05/08/91)

billj@uop.uop.edu (Snugglupagus) writes...

>- - the mac has a 40 meg hard disk
>- - there is only about 16 meg of software installed
>- - both the finder and mactools report 38 meg used, 2 meg free

This is fairly common in the Mac labs here.  Run "Disk First Aid"
(from Apple, the free thing) and tell it to fix the drive.  Your
students have probably been having programs crash frequently, so that
you have unused space which is neither in a file nor free.  (What DOS
refers to as "lost" space -- D.F.A. will just say "fixed").

Important:  Disk First Aid is NOT the same thing as "First Aid
HFS", although half the people I tell about these programs seem
to want to use whichever one I *didn't* mean.  Both programs are
good but they do different things.  Use Apple's to recover lost
space from your hard disk

geoffb@eleazar.dartmouth.edu (Geoff Bronner) (05/08/91)

billj@uop.uop.edu (Snugglupagus) writes:

>recently, we've come across a problem with one of the macs in our lab.
>we really don't know if it's a virus or not, but it does act something
>like one.  anyway, here are the symptoms:
>- - the mac has a 40 meg hard disk
>- - there is only about 16 meg of software installed
>- - both the finder and mactools report 38 meg used, 2 meg free
>what we really want to know is: is this some sort of new virus, or is
>our mac just confused?

I think it is confused. I have seen a similar problem with MacIIcx's
with 80MB drives. They thought they had 56MB instead of the actual
amount (around 30). This occured on several machines in a public
cluster of 17 identical cx's.

Solution: about 50% of the time I was able to fix the problem by
simply re-building the desktop file. In the other cases, tranferring
the entire disk to another hard disk or tape and then putting it back
also worked. This implies that fragmentation may have been the cause
and I have seen similar cases where using Disk Express or a similar
utility also helped.

- -Geoff Bronner '91
 Student Consultant, Dartmouth College Computing Services

- --
 geoffb@eleazar.Dartmouth.EDU

 "Congress shall make no law...abridging the freedom of speech,
  or of the press..."

pandy@vipunen.hut.fi (Pandy Holmberg) (05/08/91)

billj@uop.uop.edu (Snugglupagus) writes:

- -> recently, we've come across a problem with one of the macs in our lab.
- -> we really don't know if it's a virus or not, but it does act something
- -> like one.  anyway, here are the symptoms:

- -> - - there is only about 16 meg of software installed
- -> - - both the finder and mactools report 38 meg used, 2 meg free

- -> what we really want to know is: is this some sort of new virus, or is
- -> our mac just confused?

	I wouldn't blame it on the machine....

	I think that perhaps the directory information on your disk
	has been damaged and thus the computer can't use all the
	space that really is free.

	Therefore I suggest:
	Copy the 16 megs of software to floppies and format your hard disk.

	In the future:
	It's good to format your HD every once in a while. Not only
	does it give you more space, but the HD becomes much faster.

- --
                    Tsaukki says
                              Pandy

- --                                  ,
"La nostalgie n'est plus ce qu'elle etait."
				- S. Signoret

===============================================================================
              Andreas "Pandy" Holmberg          Email:  pandy@hut.fi
     Helsinki University of Technology          Finger: pandy@spiff.hut.fi
===============================================================================

maimer@kuhub.cc.ukans.edu (05/09/91)

CANDERSO@uga.cc.uga.edu (Christopher T. Anderson) writes:
>> recently, we've come across a problem with one of the macs in our lab.
>> we really don't know if it's a virus or not, but it does act something
>> like one.  anyway, here are the symptoms:
>>
>> - - the mac has a 40 meg hard disk
>> - - there is only about 16 meg of software installed
>> - - both the finder and mactools report 38 meg used, 2 meg free
>> - - disinfectant can't find anything, and neither can virus detective
>> - - there are no hidden files anywhere on the disk (if there are, neither
>>   mactools nor resedit can find them)
>> - - the "virus" hasn't spread to any of our other macs
>>
>> what we really want to know is: is this some sort of new virus, or is
>> our mac just confused?"
>
> This problem is not necessarilt indicative of a virus, but an
> otherwise corrupted Directory (or possibly Desktop).  You could try
> rebuilding your Desktop, but probably should defrag/optimize the
> drive.  This would rebuild your directory.  For this I reccomend Disk
> Express II, it has always worked wonders for me.

It could also be damaged extents tree or some arcane part of the disk
like that.  If rebuilding the desktop doesn't help, consider running
Norton's Disk Doctor (part of Norton Utilities for the Mac).  This has
found problems with several of our drives which kept them from
optimizing (the damaged area said part of the disk was in use when it
wasn't really and so the optimizer couldn't find the file to pick up,
got confused and said the h*ll with it and woiuld quit).

           |\   \\\\__       Tony Maimer                __
           | \_/    o \                                /  |
            > _   (( <_                               /   |
           | / \__+___/  maimer@kuhub.cc.ukans.edu   /o   /_/|
           |/     |/                                <  ))  _ <
                                                    \     \ \|
                                                     \    |
       +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++