Desktop and Finder partially paralyzed--HD Full or Virus or ?--on G4 15" Powerbook

[brobison]

Man I hope someone can come to my aid!

Here is what happened to interrupt the flow of my hard-working, productive g4 15" Powerbook status quo... and then what happened/is happening as a result (which some might see as simple Karmic retribution)(but help with the advice anyway):

I was doing some data-spring-cleaning by consolidating my music library from some too-many DVDs to a better organized few DVDs using my laptop and its internal 80 gig HD to do the copying and moving etc.

I saw that my hard-drive was getting pretty close to full and thought I'd better hurry and burn everything back off to DVD and reclaim the space for actual work... at that moment I accidentally dragged-and-dropped the wrong folder onto my desktop...Wrong=the folder jam-packed with the most questionably obtained MP3s and JPGs and MPEGs (in college, from newsgroups, not virus-scanned)

I saw that the amount of memory taken up by the folder wasn't going to be more than the amount of space I had left, and didn't know how to stop the process anyway, so I just let it do its thing... kind of figuring OSX wouldn't let all this copying-to-desktop happen if it was going to be dangerous to its own continued functioning...at least not without a warning pop-up which would also allow me to quit the whole thing. ANd I'd just delete it as soon as it finished.

Now my hard-drive is VERY FULL. And I just read here that OSX needs 1.5 gigs to do anything... or else I am "hosed" I don't want to be hosed. And more specificly I don't want a project I have spent the last two months working on and the last three weeks without any substantial backing-up of to be hosed. Even if it is my own stupid fault.

So, here is what is happening now. The finder is almost always in spinning beach ball mode, turning back into a pointer for maybe 2 seconds of every minute. I can't select anything via the mouse/trackpad or with keyboard shortcuts. At first that meant I couldn't even delete the offending files.

WHat seems weird though is that I can open any of the applications that happen to be in the dock. So I opened Photoshop and can sometimes move a few jpegs to the trash with Photoshop 7's Browser Window. But only if I do less than 50 or so at a time. But then for the longest time I couldn't empty the trashcan. And now I sometimes can, sometimes can't.

Another Ap. in the dock is Activity Monitor and what it shows is the Finder using up almost all of the CPU... But the real memory hog seems to be "kernel_task" Process ID "0" which is seemingly innocent enough using only 3.0%of the CPU but it has 43 "threads" when all other active processes have 2 or 4 or some other small number. Also it has the biggest descrepency between Real Memory and Virtual Memory being used. Kernel-Task is using 60MB of Real Memory but 661.57 of Virtual Memory. FOr all I know that os perfectly normal. But still, somewhere in these last few days I became convinced the problem was due to some snippet of MALWARE buried in one of those old newsgroup files that was now out to do me in for my sins. And I think I came to that conclusion after looking at the activity monitor's information and trying to figure it all out. Under the activity monitor's Network section it said (can't remember where 3exactly now) that I had some process using PORT 101... and I noticed trhe Packets In/Out and Data In/Out had plenty of activity even though I was not on the internet at the time, but my Airport was On as was my DSL... so maybe I was on the internet!

Ok. See why I had to get on a forum and get some advice quick.... I'm getting crazy-paranoid! That's for PC-users! So I could easily bore you all with more details, but I will stop until someone tells me which details are the ones most relevant.

Solutions I have already tried. I booted from my Install CD and ran Disk Utility and fixed permissions until they were and Repaired Disk until it was. The items that had to be fixed were two instances of the USER being wrong (./private/var/at/spool was a 1 instead of a 0 as was ./private/var/at/jobs and one of a set of permissions being set wrong (./private/etc/slpsa.conf can't read my own writing on that very last part could be different).

Afterwards I still couldn't do anything. Also I booted up in Terminal Mode and tried to RM a few of the files using what I remember of UNIX from way back in the day, but even though I was able to navigate to the proper folder and type in the proper wildcards to do the exact deleting I most wanted to do... the answer came back that I was in a READ-ONLY mode... so no luck there.

ANyway. Please Help. THe final piece of info is the one that may make someone just say that I'm hosed--which is that the specifics of my HD Space usage vs. Space Free and it is: 74.31 GB Used, 219.76 MB Free.

If you've read this far, thanks. If you can help me not lose all the work of the last few weeks thanks even more.
-Bill Robison, brobison :cry:

[yellow]

But the real memory hog seems to be "kernel_task" Process ID "0" which is seemingly innocent enough using only 3.0%of the CPU but it has 43 "threads" when all other active processes have 2 or 4 or some other small number. Also it has the biggest descrepency between Real Memory and Virtual Memory being used. Kernel-Task is using 60MB of Real Memory but 661.57 of Virtual Memory. FOr all I know that os perfectly normal.

kernel_task and it's threads are all the pieces/parts that the OS starts at boot. It's completely normal for it to have many threads. Also, don't rely on the memory stats of the Activity Monitor. They aren't accurate. I have 1.1GB of swap files. According to the AM, I have 6GB of "virtual memory". Whatever, AM.

I think part of the real problem here is that you really, really, need to get an external HD and offload some of your data onto it. The more full, err.. fuller, an HD gets, the slower it operates.

[yellow]

hostname 101/tcp NIC Host Name Server
hostname 101/udp NIC Host Name Server

I doubt you have a "virus" or "trojan" or any other malware. Most likely, that network activity you were seeing was between you and your router. If you really think you've been compromised, you have no alternative but to erase the hard drive and completely reinstall the OS. That is the ONLY way to make sure that there's no leftover evil floating around in your filesystem.

[yellow]

You should NOT, I repeat NOT, repair privileges when booted from the CD. Repairing Privs looks at the BOM archive in /Library/Receipts/. The /Library/Receipts/ directory on your CD is woefully out of date in comparison to those on your disk. Use Disk Utility booted as normal to repair permissions, or "sudo diskutil repairpermissions /" in the terminal.

As I got to end of this, I saw that you had 200MB of space left. That's the problem. Not nearly enough disk space, and it will negatively impact everything you do on the Mac.

If you were booted into Single User Mode and trying to remove things, you need to mount the disk as writable first, with:

mount -uw /

Then you can remove things. PLEASE don't remove things that you aren't 100% sure can be removed. There's no undo for 'rm'.

[brobison]

Thank You everyone for your advice and time. I solved the thing the night after I wrote my plea by slowly deleting images from my desktop via the browser that comes with Photoshop 7.0. At first I could only delete a few images at a time before I had to reboot. Eventually I figured out that I just needed to make the PS 7 browser's window super-small so that the thumbnails it felt obliged to draw were the smallest thumbnails possible. Once I figured that little trick out the process moved along at a fair enough clip... until finally all that was left of the massive-numbers of mistakenly copied to the desktop files were the MP3s and MPEGs (which I couldn't even see via the PS 7 browser) and about 5 corrupted Jpegs that couldn't be deleted with the PS 7.0 browser. By then however the actual desktop/finder was able to function and I deleted those rotten files from there.

I see from the responses above though that had I not figured out the Photoshop trick I could've used the solution of booting up in single user mode and mounting the disk as writable first with the command: mount -uw /
And for that tip I thank you very much.
-Bill
ps I will now implement a back-up policy so that if anything like this happens again I will not need to freak-the-hell-out.