Hardware problem or security problem? (a little long)

[sanduku]

Hello All

I am dealing with what seems to be a dying hard drive. I am using OSX 10.4.11 on a PowerPC G5. I am the only user of the machine. Last week, I started having a problem with the computer running extreeeemly slow in my main account: taking 15 minutes or more to log in, and some 45 seconds between mouse click and a response when clicking on menu items (e.g., the 'About My Mac' item). When the computer is hung up on such things, I cannot do anything else with it, such as logging in from another computer using ssh.

However, when I am not logged in on the main screen, I can log in to it from any other computer via ssh and there are no problems with delays or anything else. When I log in to my computer from a different account (one of several dummy accounts I made for various reasons) there are no signs of delays or odd behaviour either.

When I log in to my computer via ssh, start 'top', and then log in from the console, the computer hangs (or runs veeery slow), but the remote screen running 'top' shows no inordinate processor activity.

I ran DiskWarrior, which identified several file structure problems that I immediately fixed, but that did not solve the problem of the computer running so slow when I log in via the user console.

When running the Apple Hardware test, I quickly got the error 2STF/8/3:A, which I believe indicates a faulty drive.

As the problems only seem to exist in my man account, I went as far as to delete that account and create a new one with the same name. Here is the funny part: when I create a new account with any random name, I get a fully functioning account with no apparent problems. When I delete my main account and create a new one of the same name *from scratch* (without restoring any of my user data) I get the same problems of the computer running unreasonably slow.

This last part puzzles me. If this were entirely a disk problem, then should the strange behaviour be there regardless of what account is being used? If it was my main account having crucial login information in the damaged part of the disk, would not deleting and recreating the account from scratch move it to some other area?

I am wondering if there is something else corrupted somewhere in the OS that is specific to my user account. Is this flagging a security issue that I need to be aware of?

I am already in the process of replacing the faulty drive (the computer only has one drive), but I am curious as to why all the problems are only associated with one user account, and apparently not connected with the contents of that account.

Any information would be appreciated.

 

[Mikuro]

That's an interesting problem. The only idea I have off the top of my head is that some background process — either part of the system or something in /Library — is doing something with absolute file paths pointing inside that account's Home folder. That could explain why an empty account with the same name would still have the problem, and why other accounts do not (assuming the errant background program stops doing its thing if it can't get read access to the directory/file it wants).

Have you checked the logs in Console.app for anything unusual?

 

[sanduku]

If it was a background process that was freezing everything, wouldn't that have shown up using 'ps' or 'top'?

I haven't seen anything obviously unusual in the console.app logs, but I'm not sure what is supposed to be usual in many parts. I will keep looking, but any hints of what to be looking for would be helpful.

 

[Mikuro]

Well, this is only a guess, but I think it's possible that if it were in fact a problem with the drive, your whole system might lock up waiting for it without any process using a lot of CPU time. That theory assumes that A) There's something making the drive horribly unresponsive, and B) The problem only manifests when some system-wide process has access to an absolute path in your user's Home folder. A bit of a stretch, perhaps, but it's the best I can figure.

I've also had problems in the past that were caused by processes constantly loading and then terminating almost instantly. They wouldn't show up as hogs in Activity Monitor or top, at least not consistently, since each process's lifespan was so short. If you're having a problem like that, you might see something if you sort top by PID and set it to refresh very frequently. You could also look for anything in Console's logs printed by launchd, which I think is what handles the loading a lot of automatic background processes.

If you open Disk Utility, what does it say the S.M.A.R.T. status of your drive is?

Oh, and of course there's the usually-pointless advice of repairing permissions (in Disk Utility). I'd be remiss not to mention it, since it does sometimes fix some funky problems.