# cannot run any applications on windows 98



## shayan (May 8, 2001)

Hi,

my windows 98 system just crashed. now when i boot up it gives me a prompt saying "cannot locate Windos.exe, this file is needed to run programs of the type applications". i downloaded Windos.exe from microsoft's web page, and now when i try to run any applications it says "Cannot find the file 'C:\program name' (or one of its components), make sure the path and file name are correct and that all required libraries are available." Can someone help me restore my system, so i can access my applications?

Thanks


----------



## Bryan (Jul 3, 1999)

You have a Sub-Seven Trojan virus. There is no such thing as a file called windos.exe in Windows. The virus created it. Anyway, go  hereand download the .zip file HKEd suggested. Once it's downloaded, unzip it and run Fixexe08.com on the PC. That should get you going with running programs. Then be sure to read the Readme.txt file that's included in the .zip file. That will explain what to do with the other tools in the .zip file, to clean up the rest of the virus. You need to follow through and clean it up. Just because your programs work again doesn't mean your done.

Let us know what happens.

BTW, once you get your applications functioning again, if you need help cleaning up the virus, do this

Start>Run, key in msinfo32 and press enter. In the Left pane, double left click on "Software Enviroment" then do the same on "Startup Programs". Now you should see your startup programs in the left pane. Click on Edit>Copy. Now come here and click on "PostReply". Right click in the reply window and select Paste.

[Edited by Bryan on 05-08-2001 at 11:00 AM]


----------



## shayan (May 8, 2001)

well, i did what you told me to, and some of my applications have started working. i still cannot run my CAD applications and MSOffice applications. When I try to run applications such as Corel Draw i get an error messages that says "Key: "HKEY_LOCAL_MACHINE\SOFTWARE\Corel\CorelDraw\9.0" Value: "ConfigDir" not found in registry."

and for when i try to run word, it says that it needs to reinstall "data1.msi" from the office 2000 premium CD-ROM. 
Also, I tried running "msinfo32", but i got an error message saying "Cannot find file MSinfo32 (or one of its components), Make sure the path and filename are correct and that all required libraries are available"

thanks


----------



## Bryan (Jul 3, 1999)

In that download you should have also gotten Startuplog.com. Run it and then copy/paste the results to a post here.

BTW, that virus you had is nasty and can destroy other applications. That's why your having the problems with those programs. Have you used your antivirus program to scan your system and do some clean up from the virus? It won't completely clean it up since that virus is pretty damaging but it's a good idea to scan your system and see what it can cleanup. Do you have an up-to-date antivirus program?

If not, get  this free one.

[Edited by Bryan on 05-08-2001 at 12:39 PM]


----------



## shayan (May 8, 2001)

My computer just froze up again, and when i restarted it its askeng me to insert a system disk. What happened? I ran all the stuff you told me to.


----------



## Bryan (Jul 3, 1999)

Your infected with one of the worst viruses you can get. Expect anything and everything to happen. I'm not exactly sure how bad your situation is since I'm not in front of the PC, but it's sounds extremely bad from here.

Prior to your first posting here, had you run your anti-virus program to clean any of the virus up? Do you have an up-to-date antivirus program? You need to run one and scan your system. Can you get into Windows yet or are you still getting that error at startup?

BTW, was there a diskette in the floppy drive when you booted up? That will cause the error message you got at the reboot.

[Edited by Bryan on 05-08-2001 at 12:30 PM]


----------



## shayan (May 8, 2001)

i got into windows, but i don't have an antivirus program. i tried getting innoculateIT but CA's server was down. what should i do next?


----------



## Bryan (Jul 3, 1999)

Try the link for the AV again, it's works fine from here.


----------



## shayan (May 8, 2001)

it still says cannot find server when i try to download after registering. is ther another free program i can try?


----------



## Bryan (Jul 3, 1999)

Try this trial version

http://www.antivirus.com/pc-cillin/download/


----------



## Bryan (Jul 3, 1999)

Shayan, I don't much more time right now since I'm working but I've asked someone else to come along and help you continue cleaning this thing up. Hopefully they will jump in or someone else will jump in and get you through it. I'll check back later ...

Be sure to post what you have after running the AV program.


----------



## shayan (May 8, 2001)

i'm still downloading the AV software, but is there anything in particular i have to do after i run it on the computer?


----------



## shayan (May 8, 2001)

Ok. 

thank you very much for all your help Bryan.


----------



## WhitPhil (Oct 4, 2000)

shayan:
First, if the windos.exe file(that you downloaded from MS) is still on your pc, delete it. It is a self extracting ZIP file, that MAY be getting in the way.
The EXEFIX program should have corrected the problem with programs not running, and should not have affected (negatively) any other apps.

Also, for the Sub7 trojan to have disappeared (leaving you the Windos message), it would appear that you are already running an antivirus, and it has quarantined the file.

When you ran EXEFIX, did it report that everything had completed correctly?
When you get to it, run the StartLog as Bryan requested, and post the contents of the StartUp.log file, that will be on your desktop, back here. This will show all programs being started at boot time.

Did you also run the Edit_SI and Edit_WI programs?


----------



## shayan (May 8, 2001)

yeah, i ran the exefix file after deleting windos.exe file and it said everything was corrected. i also ran the edit_si and edit_wi programs and there were no problems there either. i was able to download CA's inoculateIT and while I was running a scan on my hard drive the computer automatically restarted and instead of going into Windows it began asking me for a system disk (again!). i don't know why its doing that even after i ran exefix?

Here is the startup.log file that you requested:---------- C:\WINDOWS\desktop\StartUp.txt

Start-Ups checked at 05-08-2001 11:11:04.01a 
__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log for Windows 95/98 - Freeware by rmbox 
__________________________________________________________________________ 
__________________________________________________________________________

Comments:

This is a log of all the programs on your computer that 
are starting automatically every time you start Windows. 
Using this log can be a quick way to spot trojans.

Please Note:

This program does not make any changes to your PC. 
It generates and places a text file on your desktop. 
It does not leave any other files on your computer.

__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log Index

1. HKLM Run 
2. HKCU Run 
3. HKLM RunOnce 
4. HKCU RunOnce 
5. HKLM RunServices 
6. HKLM RunServicesOnce 
7. WIN.INI file 
8. SYSTEM.INI file 
9. AUTOEXEC.BAT file 
10. StartUp folder 
11. All Users StartUp

__________________________________________________________________________ 
__________________________________________________________________________

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"LexmarkPrinTray"="PrinTray.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"SaveNow"="C:\\PROGRA~1\\SAVENOW\\SaveNow.exe"
"WinampAgent"="\"C:\\PROGRAM FILES\\WINAMP\\WINAMPa.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

(Registry Path) 
(Start-Ups)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

(Registry Path) 
(Start-Ups)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"RNBOStart"="C:\\WINDOWS\\SYSTEM\\RNBOSENT\\SENTSTRT.EXE"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - C:\WINDOWS

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

run=

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - C:\WINDOWS

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - C:\ (Root)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

*(File not found - c:\autoexec.bat)*

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - C:\WINDOWS\Start Menu\Programs\StartUp

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\America Online 6.0 Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Acrobat Assistant.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Corel Registration.lnk

========================================================================== 
__________________________________________________________________________

11. All Users - C:\WINDOWS\All Users\Start Menu\Programs\StartUp

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

- End -


----------



## WhitPhil (Oct 4, 2000)

Ok, I see nothing out of the ordinary in the Startlog.

?????'s
1. If you do a Shutdown > Restart, do you get the System Disk error?
2. Can you post back exactly what the message says?
3. Did you get the antivirus run to complete?
4. Do you other apps (CAD&Corel) still fail to run? But, everything else seems to be ok?
5. Have you recently downloaded and installed, (or installed something sent to you), that could possibly have contained the Trojan? From any "strange" sites? Or "warez"?
The key being recently. Like, within the last 5 days.
6. Look in the \windows folder for a file called WININIT.bak. If it is there, open it in NotePad and post back the contents.


----------



## shayan (May 8, 2001)

Yeah I downloaded a warez file a few days ago. I still cannot get into Windows. I get an error message at start-up that says: "IVALID SYSTEM DISK, REPLACE THE DISK AND THEN PRESS ANY KEY" but there's no disk in the a: drive.


----------



## WhitPhil (Oct 4, 2000)

*IF* the download you did was less than 5 days ago, do the following:

Boot to DOS (command prompt) and enter

Scanreg /Restore

and choose a date prior to when you did the download. You can also use the date of the day that you did it, since the backup of the registry occured prior to you doing the download.

This will restore the registry to before your download/install.
The side affect is, that you will need to reinstall any other software that you installed since that date.

Other suggestions: 
Get an antivirus in place and either run it all the time, or scan every file you download.
Also, download and install the ZoneAlarm firewall. In case another trojan manages to sneak past you, the firewall will stop it from calling home.

And BTW, change all of your passwords. Since you had Sub7 installed, you may have had someone on the net inside of your PC. The only way I can think that Windos.exe disappeared, was that this person,while in your PC, deleted it, thus causing the hang and subsequent error message.

The message you are now getting about a System Disk, may indicate a boot sector virus, or something else.
Try the Scanreg first, and see if you continue to get the error. This error may occur while you are trying to boot to DOS.
In case, do you have a Boot Disk available?

[Edited by WhitPhil on 05-08-2001 at 04:35 PM]


----------



## shayan (May 8, 2001)

ok, but how do I get into DOS, when all i get is the error message at start up?


----------



## Bryan (Jul 3, 1999)

Restart the PC and right after you see the drives recognized on the screen but before the W98 splash screen, start tapping the F8 key. You should get a startup menu with 6 options. Take the option for "Command Prompt Only".

Sounds like you making some progess and your in good hands. I'll check back later when I'm home from work. Good luck and thanks Whitphil ...

[Edited by Bryan on 05-08-2001 at 04:43 PM]


----------



## WhitPhil (Oct 4, 2000)

At bootup, hold the ctrl key and try to get to a boot menu, and choose command mode only. (the same way you would get to safe mode)
If this doesn't work, do you have a boot disk?
If not, you will need to create one from http://www.bootdisk.com

Then boot up using the boot disk.
Then try entering the following:
C: {enter}
Scanreg /Restore {enter}

If you get the error again, then before doing the next steps, need some info your disk setup. 
How many? Sizes. Any special overlay software being used?

***Ah, Bryan. Glad to see you are back. I think the more minds the merrier, is the case here.


----------



## Bryan (Jul 3, 1999)

Not for long though. I'm off for my hellish commute home .... I'll check back later and thanks again for jumping in to help ...

BTW, WhitPhil and I are saying the same thing as far as getting to the Startup menu. Both methods work. I just prefer the F8 method because I'm use to it..

Actually, F8 works for W95 and W98 and Ctrl works for W98 and ME. MS just wanted to keep us guessing.

[Edited by Bryan on 05-08-2001 at 04:48 PM]


----------



## shayan (May 8, 2001)

i still can't get into windows, i get the same strt-up error message. i tried the F8 method and it didn't work. even when i tried to boot from the floppy, it didn't work. what do i do next?


----------



## shayan (May 8, 2001)

i have a single 3.1 Gig SCSI hard drive. there's no special overlay software that i know of.


----------



## WhitPhil (Oct 4, 2000)

When you boot from the floppy, does the PC actually read the drive? Ie: does the light come on or does the drive make a noise?


----------



## shayan (May 8, 2001)

well, i was able to boot up, but the 
c:\scanreg /restore command didn't do anything. I get a "Bad command or filename" response. I still can't get into windows with the 
C:\Win 
command


----------



## shayan (May 8, 2001)

I've tried booting up again, but the scanreg command still doesn't work. also when i check the C: directory it has some wierd volume name and has no Windows directory. what has happened to windows?


----------



## WhitPhil (Oct 4, 2000)

OK. So you are now up running on a boot disk?
If you do a DIR of C:, what IS actually there? 
Any errors when you do the dir?
How much free space?

[Edited by WhitPhil on 05-08-2001 at 05:56 PM]


----------



## shayan (May 8, 2001)

Yes I can access the C:\ drive. All my directories are there. But there is no Windows directory that should normally be there. When I type in C:\dir at the command prompt this is what I get

The volume in drive C is S]HMLOG)DIT
Volume Serial Number is 1854-1900
Directory of C:\

then 15 directories and 3 files 
Autoexec.bak
Scandisk.log
Shortc~1.Pif

21,001 bytes
1,272,049,664 bytes free


----------



## WhitPhil (Oct 4, 2000)

So, there is no Command.com?

Try entering
DIR /A

and see if any more files/directoris appear.

On your 3.1GB drive, is 1.7GB free sound right??


----------



## shayan (May 8, 2001)

no there is no command.com. and even with dir/A the same file appear. i should have about 1 Gig free on my computer.


----------



## WhitPhil (Oct 4, 2000)

Hmmm, sounds like your visitor deleted the windows directory. (mine is about 700Megs)

So, a couple of options.
FIRST, don't add/copy/delete or do anything with the C: drive. As long as it was "just" a delete, then it "may" be recoverable with an Undelete program. (which we'll have to try and track down).

If that doesn't pan out, you are looking at reinstalling everything, windows and programs. Since all the \system files (and registry) are also gone. And I guess, if you are going to do that, you might as well start at square one, and start with a reformat. (after copying off and saving personal files, etc).

If there was REALLY important stuff under windows, like your email, that you REALLY want to recover (and we can't find an undelete that works), you will need to take your PC to a Data Recovery service and let them try to recover your drive.

So while you ponder, I will try and ferret out an undelete. 
If anyone is following this, and knows a good program ....

I have posted a request at Virtual Dr for info. You can follow the progress here.
http://discussions.virtualdr.com/Forum2/HTML/042319.html

[Edited by WhitPhil on 05-08-2001 at 06:29 PM]


----------



## shayan (May 8, 2001)

if my windows directory is deleted, then can i simply reinstall windows 98 and still keep all the directories that already exist on the hard drive? I tried running the windows 98 setup program from the cd-rom, but during scandisk i got a message saying that
"The C:S]HMLOG).DIT file or directory is damaged and is currently unusable. Choose fix it to have scandisk to repair the file or directory. "

Should i let scandisk fix it?

Also another question, if the windows directory is deleted, then how come i only have 1.2 Gigs free (i normally had about 1 Gig free?)

thanks for looking for the undelete program for me.


----------



## WhitPhil (Oct 4, 2000)

You do not want Scandisk trying to "fix" the drive. At least not yet.
As well, you do not want to be trying a Windows install UNLESS you are willing to give up on trying to do an undelete.
When you delete a file, the "deletion" happens by windows just marking the file as not being there. The file is still out on the harddrive in clusters, that are NOW marked as being available to be used.
If you start copying files to the disk, windows may use one of these clusters for the file. Thus, clobbering the information in it that was "deleted".

You will not be able to just reinstall windows, because you have lost the \system directory which contained files installed by some of your apps, any other directories that were installed by apps under \windows, but more importantly the registry has been deleted. Which will cause you to reinstall ALL of your programs.

That's why I threw out all the options. If you have all the install disks and all of your data backed up, the easiest (and perhaps best way) may be to reformat/reinstall.

Although, even if you do decide that, trying an undelete would prove whether it can be done.


----------



## shayan (May 8, 2001)

I would rather do an undelete, since i don't want to lose what's left on the hard drive. Also backing all this stuff up would be a pain, so i think i'll try the undelete option. Is there an undelete program available i can use?


----------



## Rollin' Rog (Dec 9, 2000)

shayan, I though the possiblity of a boot sector virus was worth considering, wonder if you can do the command chkdsk from a DOS prompt and report how many total bytes memory is shown? Less than 655360 indicates corruption.

Since you were able to manage a normal boot just a while back and run rmbox's startup utility, which showed no evidence of a trojan, it puzzles me how any activity could have taken place since then, unless there was a delayed payload from some other virus, not evident in the startup profile.

Could be just a coincidence and you are suffering from SDD (Sudden Drive Death).


----------



## shayan (May 8, 2001)

After i ran EXEFIX, everything appeared normal. Then after i downloaded and ran inoculateIT, the system restarted by itself and began giving me the "invalid system disk..." message. Since then I have been unable to boot into windows at all, amd the c: drive doesn't show a windows directory anymore! I ran chkdsk on the C: drive and this is what i got:

3,242,954,752 bytes total disk space
1,272,049,664 bytes available on disk

4,096 bytes in each allocation unit
791,737 total allocation units on disk
310,559 available allocation units on disk

655,360 total bytes in memory
563,984 bytes free


----------



## WhitPhil (Oct 4, 2000)

Rog:
If the virus is in the boot sector of C:, then booting to A: and doing a CHKDSK won't show it. (I think).

I'm at a loss in regard to the undelete. I tried some tests with Norton trying to undelete directories that I had created and deltree'd, and it could not restore them.

SO, 2 options, I think:
1. Reinstall Windows and reinstall all programs
2. Backup all files. Then do number 1
3. Take the PC to a Disk Recovery company and get an estimate for repair.

One last few things we can try.
1. Do 
SYS C:
from the A: drive
This will put the system files back (and potentially clobber some of the recoverable clusters)

2. Do
FDISK /FBR
from the A: drive

This won't affect the content of C:
Try rebooting after doing both 1&2

3. If you intend to do a reformat, after backing up your data files, run Scandisk with automatically fix TURNED OFF, until you can see what scandisk finds, and how it "thinks" it is going to fix it. 
As long as you don't select automatically fix, and as long as you don't let it fix anything, you can run Scandisk and see what it finds on the drive.
But if you intend to try to recover any of it, as I said, don't add any more files, or let Scandisk do anything to it.


----------



## Bryan (Jul 3, 1999)

My advise for what it's worth would be sys c: then fdisk /mbr and see what you have from there. I can't see how it could hurt at this point.

[Edited by Bryan on 05-08-2001 at 08:23 PM]


----------



## shayan (May 8, 2001)

i did 
A:\sys C: and
A:\fdisk/fbr --which didn't work. But the system files got copied. i restarted the computer, and got the windows 98 splash, but then it went back to the command prompt, and there's still no windows directory--the same old stuff.


----------



## Rollin' Rog (Dec 9, 2000)

The chkdsk showed the parameters of c: .... but in any case I agree with all the options suggested, well presented.


----------



## Bryan (Jul 3, 1999)

Try this, boot to your windows boot disk

extract /a a:\ebd.cab edit.com /L a:\
extract /a a:\ebd.cab attrib.exe /L a:\ 
attrib -h c:\msdos.sys
edit c:\msdos.sys

What's in your msdos.sys file? Do you just see something like ;W98EBD or is it full of a bunch of other stuff?

BTW, sorry I justed edited the commands. I originally posted them incorrectly from attrib on down through edit and you really don't need to do the attrib -h command but it won't hurt either.

[Edited by Bryan on 05-08-2001 at 08:43 PM]


----------



## Codemaster (May 5, 2001)

As for the virus scanner if you don't want to download anything try this: its an online virus scan: http://housecall.antivirus.com/housecall/start_pcc.asp


----------



## shayan (May 8, 2001)

after doing each of the first two steps i got the messages
"no matching files". Then attrib -h msdos.sys resulted in
"Not resetting system file A:\msdos.sys"
and editing Msdos.sys shows that msdos has
";SYS" as the only line in it


----------



## Bryan (Jul 3, 1999)

Try this one more time

extract /A A:\ebd.cab Edit.com /L A:\ 
edit c:\msdos.sys


----------



## Bryan (Jul 3, 1999)

Let's make this easier. Are you posting on a W98 PC right now or any Windows PC? Start>Find>Files, key in Edit.com and press enter. Now insert your W98 bootdisk. Right click on edit.com and select SendTo>3 1/2 floppy. That will add edit.com to the boot diskette. Now put the boot disk in the bad PC and boot to it

edit c:\msdos.sys

BTW, try this command and see if you see the Windows directory

dir c: /p

[Edited by Bryan on 05-08-2001 at 08:56 PM]


----------



## WhitPhil (Oct 4, 2000)

Rog:
If the virus is in the boot sector of C:, then booting to A: and doing a CHKDSK won't show it. (I think).

I'm at a loss in regard to the undelete. I tried some tests with Norton trying to undelete directories that I had created and deltree'd, and it could not restore them.

SO, 2 options, I think:
1. Reinstall Windows and reinstall all programs
2. Backup all files. Then do number 1
3. Take the PC to a Disk Recovery company and get an estimate for repair.

One last few things we can try.
1. Do 
SYS C:
from the A: drive
This will put the system files back (and potentially clobber some of the recoverable clusters)

2. Do
FDISK /FBR
from the A: drive

This won't affect the content of C:
Try rebooting after doing both 1&2

3. If you intend to do a reformat, after backing up your data files, run Scandisk with automatically fix TURNED OFF, until you can see what scandisk finds, and how it "thinks" it is going to fix it. 
As long as you don't select automatically fix, and as long as you don't let it fix anything, you can run Scandisk and see what it finds on the drive.
But if you intend to try to recover any of it, as I said, don't add any more files, or let Scandisk do anything to it.


----------



## shayan (May 8, 2001)

i tried what you said, but the edit msdos.sys command shows that the only thing in the msdos file is ;SYS

also, dir c: /p still doesn't show a windows directory


----------



## Bryan (Jul 3, 1999)

If you still don't see the Windows directory then I guess I'd goto Option 1 and reinstall Windows like WhitPhil suggested. I was kind of hoping it was there but you weren't seeing it and the empty msdos.sys file you have as a result of the sys c: would have caused it to boot to a c: prompt.


----------



## shayan (May 8, 2001)

ok, so i guess i'll just have to backupmy files and reinstall windows 98.


----------



## Bryan (Jul 3, 1999)

Out of curiousity, when you do the

dir c: /p

What directories are listed if you feel like posting their names?

[Edited by Bryan on 05-08-2001 at 09:22 PM]


----------



## Bryan (Jul 3, 1999)

This will be easier for you to read

dir c: /p /ad

The reason I'm asking is maybe the virus just renamed the Windows directory. I think it's worth a look before you reinstall.

[Edited by Bryan on 05-08-2001 at 09:26 PM]


----------



## shayan (May 8, 2001)

here are the directories:

Program files
My Documents
Corel Draw
TurboTax
DIR00000
DIR00001
DIR00002
DIR00003
DIR00004
DIR00005
DIR00008
DIR00009
DIR0000A
DIR0000B
DIR0000C
and the following files:

Scandisk.log
Autoexec.bak
Command.com


----------



## Bryan (Jul 3, 1999)

Well, they are all directories created by scandisk. WhitPhil and/or RollinRog, any comments or suggestions? Does anyone thing scandisk has any chance at fixing it?

[Edited by Bryan on 05-08-2001 at 09:46 PM]


----------



## Rollin' Rog (Dec 9, 2000)

Definitely a question for Whitphil , but it looks like the remnants of past scandisk "fixes" -- an indication that the drive itself has been, and probably will continue, having serious problems. You might check for a diagnostic utility at the manufacturer's site.


----------



## WhitPhil (Oct 4, 2000)

shayan:
Did you run a Scandisk after all of these problems started?
If so, this is one of the nasty sideaffects of using the Automatic Fix option.
Scandisk found some problem in the directory structure and "fixed" it. 
I have only ever seen one other machine in this state, and did not touch it, because the information was extremely important on it. They took it to Data Recovery people, and they managed to recover the system. 

You can try doing a DIR of each DIRnnnn directory and see if you recognize what it really should be. In this way you might be able to recover some files. But, I think what you will find is that Scandisk has turned all (most/a lot) of subdirectories, into main directories. (the DIRnnnn's)


----------



## Bryan (Jul 3, 1999)

Well, my advise is, if you really, really, really need the data, then stop right now and take it to a shop that does data recovery and see if they can do anything with it.

If you don't really, really, really need the data, then fdisk, format and reinstall Windows.. you've got a real mess.

[Edited by Bryan on 05-08-2001 at 09:57 PM]


----------



## Bryan (Jul 3, 1999)

I've never really paid attention to the contents of a scandisk.log. Out of curiousity, does anyone know if the log will give any clues as to what was what before it was "fixed".


----------



## WhitPhil (Oct 4, 2000)

Something strange occuring here. Is it all trojan related, or is a failing harddrive part of it.

Windos.exe is deleted (normally because of an AV quarantining it. In this case, no AV)
The PC hangs
On reboot, the missing Windos message
Download and run exefix
*** at this point, there IS a registry that has been fixed and continues to allow things to run, AND there IS a \windows directory.

Now, some other apps start to get errors.
Then PC can no longer boot, asking for system disk.

** at this point the windows directory is gone along with command.com and msdos.sys

So, what has happened between the two points?
Now, it would seem that a Scandisk has been run with Automatically fix errors, which has created all the DIRnnnn because it found directory structure problems.

BUT, did the Trojan do it? 
Hmmmmmmm!!

[Edited by WhitPhil on 05-08-2001 at 10:07 PM]


----------



## Bryan (Jul 3, 1999)

I can't believe it did and if it did, I'd like to meet the person that wrote that code.


----------



## Rollin' Rog (Dec 9, 2000)

It might have been created after the InnoculateIT crash, if the system rebooted and scandisk ran then.

Norton had a similar issue:

Dir00001


----------



## WhitPhil (Oct 4, 2000)

Bryan,
Yes. Good catch.

The Scandisk log, if it is the one that did the damage, will indicate what it "fixed". (as long as the option is append not replace)

This is why I do not trust any software running that asks if I would like it "automatically fixed"!!


----------



## Bryan (Jul 3, 1999)

It's funny you found that Norton's article, I was just reading it about 5 minutes ago.


----------



## Bryan (Jul 3, 1999)

What's the easiest way to post the contents of the scandisk.log file so we can see it? Copy it to a diskette, open it on a functioning PC and copy/paste it's contents to a reply here? Does that sound good or is there an easier way I'm missing?


----------



## shayan (May 8, 2001)

no the trojan didn't do the scandisk part. i ran scandisk before everything and that's when i think the autofix occurred. i really have a lot of CAD designs and technical papers that are bretty big files (5 Megs plus each)that I need to get off this computer, so i would really like to be able to recover the system. I guess i'll just have to take it into a data recovery shop or something. but do you think they'll be able to recover anything?


----------



## Bryan (Jul 3, 1999)

Since I'm not even close to being a scandisk expert, I'll ask the question. If it can be determined what DIR00000s are what, can they be renamed and have any shot of making any progress towards anything that's workable? I assume there's probably much more to it but I figured it was worth asking.

[Edited by Bryan on 05-08-2001 at 10:34 PM]


----------



## shayan (May 8, 2001)

I know what each DIRXXXXX contains, and when i did have windows working after running the EXEFIX file, i was able to run all my applications from these directories, except for MSOffice applications, and CAD and graphics applications.


----------



## WhitPhil (Oct 4, 2000)

You can probably attempt some of that, but I'm not sure what the results would be. The fact that there are DIRnnnn's indicate directory damage and the potential of missing data. So even after all the renames, there still could be things missing

I think I would try to save what I could from the DIRnnnn folders before deleting them and do a reinstall of windows. Then, instead of backing up all of your data, you could just leave it where it is, and do reinstalls of all of the software. (ie: don't reformat, just reinstall).

BUT, the very first thing to do, is a SCANDISK Thorough (with Fix off, of course), to check out the status of the harddrive. If all is well, do all the reinstalls. 
Then, get your files backed up, get an AV running, and install a firewall. 

Or, as stated before, if the data here is really critical and you can't back it up, stop now, take the PC to a recovery company and get an estimate to recover.


----------



## Kento (Aug 2, 2000)

Just got here. Man what a mess you have. Just goes to show how important it is to have an antivirus program that scans emails and runs in the background. Anyway If you want to remove your hard drive and send it to a data recovery specialist then click the link. Ontrack has a great reputation and they may be able to recover your data. Give them a call and see what they say.

http://www.ontrack.com/datarecovery/


----------



## shayan (May 8, 2001)

thanks for the link Kento, i'll check them out. Also, thanks to Bryan and WhitPhil for all our help.


----------



## shayan (May 8, 2001)

hi guys, 

i backed up my files and tried a clean reinstall of windows 98. but after i ran setup, when the windows files were loaded, and the computer restarted, the whole system crashed! now everytime i startup it asks me for the system disk. after i restart with the system disk it says i cannot create a temporary directory. when i try to see what's in C:, it says C: is a virtual RAMdrive, and shows files like ATTRIB.EXE, CHKDSK etc. How can i reinstall windows98 clean and start the system up again?


----------



## Bryan (Jul 3, 1999)

I have a suspiscion that your hardrive is finished but wait to see what the others think. 

BTW, did you run Fdisk to delete and then create a new Primary DOS partition prior to formatting the hardrive?


----------



## shayan (May 8, 2001)

yeah i ran fdisk.

i tried booting up with an msdos system disk, but when i tried to check the C: drive with
c:\ at the A: prompt, it says that C:\ is an invalid drive.


----------



## Bryan (Jul 3, 1999)

Just to be sure, is this what you did?

Boot to the W98 bootdisk. Take the option for "Start with CDRom Support". Then at an a: prompt

fdisk 

Leave the default set to "Y" for large disk support and press enter. 

Now use the option to "Delete Partitions". Delete any and all you see listed. Now take the option to "Create a Partition" and create a "Primary DOS" partition. 

format c: /s 

When it's done insert your Windows CD and run setup


----------



## Rollin' Rog (Dec 9, 2000)

The BIOS and the physical connections for the drive are a couple of other areas to check in to. Is the drive detected at the BIOS level?

http://www.computerhope.com/issues/ch000229.htm

http://www.computerhope.com/issues/ch000047.htm

[Edited by Rollin' Rog on 05-09-2001 at 01:13 PM]


----------



## shayan (May 8, 2001)

i ran fdisk from the boot disk, and deleted the primary dos partition. when i tried to create the new primary dos partition, it says that primary dos partition already exists. should i still do format c:/s?


----------



## shayan (May 8, 2001)

great! now my escape key doesn't work anymore, so i can't continue with fdisk after i've deleted the partition. is there any other way to continue with fdisk?


----------



## Bryan (Jul 3, 1999)

If this doesn't work then I really think your drive is toast.

Go  here and download Zap.exe. Once it's downloaded, you need to run the downloaded file on a functioning PC. It will extract Zap.Com and Zap.Txt to a folder. Once that's done, copy Zap.Com to your W98 boot diskette. Zap.Txt is just a readme file that explains the process.

Now insert the W98 boot disk in the bad PC and boot to it. Then at an a: prompt type in

zap 0

BTW, that's a numeric zero

When it's done, run fdisk again and try to create the Primary DOS partition.

Then if you are able to create the PriDos partition, then run

format c: /s

[Edited by Bryan on 05-09-2001 at 02:35 PM]


----------



## shayan (May 8, 2001)

i did the zap 0 at the a prompt, and fdisk let me create a primary dos partition. but because my esc key still doesn't work, i can't exit out of fdisk. is there a way to save these changes and exit out of fdisk w/o ctrl-alt-del? because when i do restart the computer w/o exiting fdisk, there are no partitions on the disk anymore.


----------



## Bryan (Jul 3, 1999)

Does anyone have any idea why the ESC key won't work cause I sure don't .....

Do you have another keyboard you can try? I have no idea if any of this would cause it but is the Caps Lock key on? How about Scroll Lock?

[Edited by Bryan on 05-09-2001 at 04:04 PM]


----------



## Bryan (Jul 3, 1999)

BTW, I just got an email saying you want this topic closed, is that true? Just want to be 100% sure before I close it.


----------



## shayan (May 8, 2001)

no, i don't want this topic closed. also i don't have another keyboard. i can't understand why the esc keys stopped working--neither the caps or scroll lock is on.


----------



## Bryan (Jul 3, 1999)

Sorry but if it worked one minute and then the next it didn't, then my only guess would be the ESC key went bad on the keyboard. Maybe someone else will come up with something. Nothing you've done could have caused the key to stop working. At least not that I'm aware of. I've just never heard of anyone having the same problem.

BTW, how about trying the keyboard your using to post here right now or is it a laptop?

[Edited by Bryan on 05-09-2001 at 04:47 PM]


----------



## shayan (May 8, 2001)

both computers are laptops. so i can't interchange keyboards.


----------



## Rollin' Rog (Dec 9, 2000)

Have you tried typing and entering 'exit' ?


----------



## shayan (May 8, 2001)

no, maybe i'll try it.


----------



## Bryan (Jul 3, 1999)

How about after you create the partition, try selecting option 2, Set Active Partition. You don't normally have to do that but try it. Then if you have to alt/ctrl/del to get out, maybe the partition will still be there when you boot back up.


----------



## Bryan (Jul 3, 1999)

How about after you create the partition, try selecting option 2, Set Active Partition. You don't normally have to do that but try it. Then if you have to alt/ctrl/del to get out, maybe the partition will still be there when you boot back up. I just can't understand why not pressing the ESC key would cause the partition to disappear. I've never had an occasion to really think about the fdisk process since it is usually a pretty simple thing to do but I would have assumed the changes you made in fdisk were occurring when you make them and the ESC key simply exited Fdisk.

And one other thing, is it possible the BIOS is causing all of these problems. I know the BIOS loads the partition loader from the master boot record at bootup. Just a thought and any comments are welcomed. This whole thing is becoming more and more mysterious. Do you see the drive(s) consistently recognized on the screen at boot up?

[Edited by Bryan on 05-09-2001 at 07:10 PM]


----------



## john1 (Nov 25, 2000)

hi, When Rollin' Rog was helping me yesterday with my laptop i had trouble with the keyboard. i found that some of the keys were in different places. No idea why. im trying to think what you could try to show it, if its on a different button. dunno, just try other buttons.
best of luck,
john


----------



## john1 (Nov 25, 2000)

Hi, some laptops have a socket for a separate keyboard,
just a thought,
john


----------



## shayan (May 8, 2001)

do you think i could put windows 95 onto the c: drive instead? i know windows 95 doesn't need pre-partitioning, so after i format the c drive, i could simply run win95 setup from the cd-rom. then after win95 has loaded, i can upgrade back to win98 (fortunately have all the cds!)

but my esc key still doesn't work, and i haven't got another keyboard.


----------



## shayan (May 8, 2001)

thank you everyone for your help, but my windows95 idea worked. i've got my system up and running again! 

does anyone know where i can get a free version of a good firewall program?

thanks


----------



## Bryan (Jul 3, 1999)

Glad to hear you got it going again. I'd suggest you get  ZoneAlarm. The basic version is Free but you need to pay for the Pro version. The free version works just fine. That's what I and many others here use for a Firewall and it works great.

BTW, I hate to mention this but I hope you've installed the free AntiVirus program you downloaded earlier or are planning to buy one and install it. You really need one in addition to the Firewall.

And does your ESC key work now?

[Edited by Bryan on 05-10-2001 at 09:46 AM]


----------



## shayan (May 8, 2001)

i uploaded inoculateIT, and now i'll get zonealarm. my escape key still doesn't work though. oh well. 

thanks a lot for your help Bryan.


----------



## Bryan (Jul 3, 1999)

Your welcome, be sure to keep the AV programs patterns updated regularly. You find the option in Innoculate under I think it's Tools>AutoDownload or something like that. And you need to be connected to the net before you select it.


----------

