[spyke31]

Hello All! I have been working on troubleshooting my computer the last two days! Gertrude--as its being called--has refused to listen to most commands, pleads, and bribes thus far. Two days ago, I was battling the ruthless grandcasino.com pop-ups and ended up doing a system scan to delete cookies, tmp files, and *.pif's that had accumulated. Since then--Win 98 has gone berserk! Upon attempting to boot up without any CD's or 3.5's inserted--the computer will run through the typical startup messages, but partway through, displays the Error message "Invalid system disk; replace disk & press any key". The error message repeats, ad infinitum. On to the next step.. If I use the 3.5 Rescue Disk--the computer will begin to load, but hangs when it gets to the "Analyzing hard disk subsystem". If either the Win 98 or Fix-It Utilities CD is used, I can get to the Win 98 Startup menu or the Fix-Utilities menu. Through those--I can make journey over to DOS.
Once in DOS--I have been able to check my drives--they all seem to have been re-assigned. A: used to be my 3.5, but is now my Master CD-ROM drive. B: is now the 3.5 floppy. C: remained the hard drive. I have not yet found out where my slave CD-R/RW drive was assigned. I am able to access A:, B:, and C:--sorta run *.exe's and stroll amongst the directories. When attempting to be snazzy and load C:\windows\win...the lovely Gertrude stomped her foot and said that the "himem.sys" file was missing. Even though I saw it in teh windows file--I copied a new one from the Win 98 CD to ensure it was not corrupt. The computer is still not recognizing it. According to ScanDisk--which will not run either--I do not have an Extended Memory driver loaded on my computer. I attached teh suggested "device=c:\windows\himem.sys"...but its still not working. Does anyone have any sort of suggestions? Might this be the works of a boot sector virus? Is there anything I can do short of reformatting?? I'm currently accessing teh internet via my partner's computer--across the room from my puter. Any help that can be offered would me greatly appreciated!! My email is spyke31@sbcglobal.net Thanx!
Spyke31

[Sampson]

You could have a hard disk failure, but it sounds like your registry has become corrupted. You will first want to get into your bios to see if it is recognizing all of your drives. If it is recognizing everything, then, whatever virus you picked up has not infected it. If it is askew, replace the battery. If it is still not seeing the drives properly, you may have to flash the bios. My guess is that you won't have to go to those extremes.
To fix the registry is way too complex because you don't know what parameters have been altered. Also, there are a variety of .ini files that may also have new lines of code in them from the virus. Finally, you don't know if this virus has caused sectors on the hard disk to become corrupted.
The only way you will have confidence in your computer is to clean install windows. This means formatting the hard drive and reloading the operating system.

[spyke31]

Thanx for the reply! I think I follow pretty well--but I want to make sure. Once in BIOS--exactly how do I know if all the drives are being recognized?
"If it is askew, replace the battery."-- Are we talking the battery within the tower? How does replacing that help get out of the evil clutches of a boot sector virus?
"..may have to flash the BIOS.." This one is a new one. I know BIOS has a line about something with both "flash" and "bios" in it--i'm just not all that sure what it means.
The last line--about only way to be confident knowing the system is clean is to reformat--Was that you're summing up recomendation? I'm trying to figure out what all is possible BEFORE resorting to the starting from scracth deal.
UPDATE-->
I attemped to run the windows setup utility-- (C:\CABS\setup)--to install on top of what's running now. Instead of telling me the Himem.sys files were missing, it displayed "Please wait while Setup initializes. Windows Setup requires 'largest executabe program size' to be at least 442368 bytes to run." huh??
Also--I noticed that in my C: drive there was a "letter.bat" file. I don't remember seeing it before and I'm not sure what it does. Is that something to keep on the drive?
Lastly.. my autoexec.bat file types as the following:
@echo off
xbios /P- /Z /I /M /V=Z
substtoz VDisk
letter%RAMDRIVE%

This is completely different than what the autoexec.bat file displays from the Win 98 CD. Should I delete it and copy the autoexec.bat from the CD?
I believe those are the last of the questions for now. If you happen to be online and reading this--my MSN screen name is nostophobic@hotmail.com Feel free to send an instant message!
Thanx for the assistance!
~Spyke

[Sampson]

I was under the impression that you believed that this difficulty came from a virus. I should learn to be clearer.

My first recommendation was to see if the virus had infected your bios. If you can go in there and see that it knows the drives are there, that is, that there is an A:\ and a CD and a C:\ drive, it is probably fine. But, if the Bios does not see these drives, it may not necessarily be a virus, it maybe that the battery that powers the bios when the computer has shut down is low and therefore the values (drive A:, C:, and D:) are not being held. Hope that is clearer.

When you attempted to run the setup utility for Windows and got the message that "largest executable file" this generally means that your hard disk is too full to run windows.

To find out what is in letter.bat, from the Dos prompt you can issue the command "type letter.bat" or you can bring it into the Dos editor by typing "edit letter.bat" and look at its contents. In Windows, bring up Windows Explorer and right click on the file and choose edit. Then, tell us what commands are being given.

As for your autoexec.bat file, it looks like a series of commands to create a Ramdisk which uses some of your Ram to emulate a drive, like adding a drive E: which is not a physical drive but which the computer thinks is a physical drive. When a computer has a lot of Ram, one can create this drive, which can hold files like a regular drive, but it is very fast. However, this depletes the amount of Ram that windows has to work with and can cause it to crash. Some people use the Ramdrive to hold the Temp files for IE to speed it up on the internet.

It looks to me that these changes seem to indicate that your hard disk is too full. W98 needs at least 1.5 megs minimum to run. Also, the changes to the Autoexec.bat (and probably config.sys) are things that a virus might do (though not very likely). It seems more like something a friend might do to make your computer go faster. Have you let a friend tinker with your machine lately?

[spyke31]

Nope--no friends have tinkered with my computer--i'm the only "tinkerer" in the house! Let me see if I can address all the lil parts and peices. My partner acts like even adding a program to her computer will end in her computer becoming inoperable and makes me do anything that requires more than a double click on hers.

--> BIOS: I've been in BIOS a couple times--reordering what gets booted and when to see if it helped a couple times. After each unsuccessful attempt, I made sure to restore default settings. (Don't want to change too much too quick). I'm not understanding how to make sure the computer is recognizing that A:, B:, and C: (and somwhere my CD-R/RW rom) are alive and kicking. I've been able to access a:/b:/C: from Dos and see the directories--but as far as seeing something in BIOS that actually states they are present...I must be missing something. The settings do have my two IDE's listed as Secondary..and nothing as Primary IDE's. Additionally, when attempting setup--I have the "view system messages" enabled and I always see that it lists 2 drives as being present.

-->Memory being full.. When I tried the fdisk/mbr command yesterday, I had it display the Partition information. It stated that there was was one C: partition, status was listed as active, under type it said it was Primary/DOS, the volume label was Gateway (this didn't show up the first time I ran it), it listed 12943 Mbytes, system is FAT32, and usage 100%. When I attempted to run Scandisk--it told me that an extended memory driver was not loaded on the system and could not proceed. I was sorta wondering if this is why the computer is saying the usage is 100% or something. Either way...I don't know what driver to look for to make sure the extended memory driver is loaded. Do I need to copy the FAT32 files over from the Win 98 CD?

-->Letter.bat : I had run the "type letter.bat" command earlier. (Remembering my so-much-easier-experiences reading code on XeMacs in java classes). I've been reading all bat and sys files for the fun of it--makes me feel like i'm doing something! lol At this moment, my computer is running scandisk--it decided to work this time--and is checking scanning the physical disk, so i can't run it and copy what it displays. I do recall that there were lines about NOCD...something about VDisk...and then the quit command at the end. (I know that probably gives you no info whatsoever, but I'll be sure to run it and copy it down whenever scandisk decides to complete--its at 56% right now. It says there are 1,655,000 clusters....and approx 950,000 have been examined.. So far it lists 0 as bad. (Thats good...i think).

Okay...I believe that concludes this hours updates...
Thanx again for the replies and your help!!
~Spyke

[spyke31]

Contents of "letter.bat"
After using "type letter.bat"...the following is what was displayed:
%DESTPATH%fileset.exe%DESTPATH%
del%DESTPAT%fileset.exe
if exist a:\fdisk.exe copy a:\fdisk.exe %DESTPATH%
if exist a:format.com copy a:\format.com %DESTPATH%
%DESTPATH%
if exist APICD0 goto HAVECD
LOAD ASPI /c
: HAVECD
if not exist ASPICD0 goto NOTHAVECD
REM Here's where we set the CDROM drive letter
SET CDROM=X
A:\NWCDEX /D:ASPICD0 /L:%CDROM%
:NOTHAVECD
RDRINT13 /V=O
mouse
CALL a:\ER.bat
cls
echo Your RAM is %DESTPATH%
if exist ASPICD0 goto NOTHAVECD2
checo Your CD-ROM drive is %CD-ROM% :\
:NOTHAVECD2

I'm starting to think it came from the rescue disk...maybe??
~Spyke

[Sampson]

You are probably right. It looks like (from the autoexec.bat) a ramdrive was created and two files (fdisk for creating a partition on a hard drive and format to format the hard drive) are copied to it. Then, it assigns software to work with your CD rom (if it exists), invokes the mouse software and calls up the ER.bat to finish what it wants to do. So, it looks like it is part of the crash disk procedure to clean install whatever is found in ER.bat.

[spyke31]

I've started resembling the little grey smiley over the past couple days. I thought I was making some progress last night. I was <finally> able to get a boot disk to run and appear to function from DOS. It booted back to A:\ so all looked innocent enough. I was able to run scandisk--no disk errors reported--and then run Win 98 Setup from CABS. Herein lies the new battlegrounds. Earlier...whenever I tried to run C:\CABS\Setup it would hang at the initial "system preperation". Gertrude--my computer--was able to push through that and--with a full cheering squad on the sidelines--looked as though she was going to complete a beautiful 9.9 install. However...she must not have had her full breakfast of vitamins and minerals--because she started stutter-stepping and stumbling about 1/3 into the installation. I began receiving error messages alternatingly reporting that Drive E: and Drive A: were not functioning. I would hit Close--it wouldn't register...so I'd try Cancel--the computer went on with its business. Upon completing installation, it rebooted...but now has decided it is illiterate and cannot read drive A: What's going on here? When will the little hamster that runs the wheel that powers the system return from vacation?
~Spyke

[Sampson]

Do you have a physical drive E:\ or is that the Ramdrive? How much Ram do you have in that machine?

[spyke31]

Welp...I'm trying to remember what drive letters were assigned to everything pre-crash. A: was the 3.5, C: was hard disk of course, D: was primary CD-ROM, and I can't remember what my CD burner drive was assigned to. It was either E or F. As far as system specs...its is an Intel 450 MHz P-III with 512K cache, 256MB 100MHz SDRAM, 16MB nVidia RIVA TNT AGP Graphics, 13.5GB 7200 RPM Ultra ATA hard drive with UATA 66 Controller...those are the basics...
Its not really letting me do a whole lot now. Still going on about drives and then jumpts to %Your Ram%...with another error message about the config.sys file.
I thought I was making progress...not any more..
AAGGHHH!!!
~Spyke

[Sampson]

You really need to see what is in your Autoexec.bat, Config.sys, Win.ini. You should be able to get to them through Dos. You can look at the bootlog.txt (hidden file in your root directory) to see where the failure first starts as Windows is cranking up. By the way, what was in the ER.bat?

[spyke31]

I have never felt more like a newbie in my life as I do now with this computer! Anyhow...I looked at all the files you asked about. They all display as the following:
Autoexec.bat
@echo off
xbios /P- /Z /I /M /V=Z
substtoz VDISK
Letter %RAMDRIVE%

Config.sys
DOS=HIGH,UMB
DEVICEHIGH=ACTCD.SYS /D:ASPICD0
LASTDRIVE=Z
BUFFERS=40
FILES=40

ER.bat
@echo off
Rescue /ve:32
MODE CO80 25

Actcd.sys-->gives some funky looking characters and the system beeps
Win.ini-->text is too long for me to get the first screenful of it and DOS is not recognizing and switches or the edit command

Last night, I was able to do a boot where it asked before initiating any drivers. I had it ignore any lines that booted to A:. That allowed me to get to Windows--but today I'm still having problems getting it to boot up. This morning--all it wanted to do was hang right after telling me the IDE Bus Master was confirmed.
That's all I have for now! (Sampson...I'm soo wishing you lived close to this area! I'd have ya troubleshoot this machine in person! lol)

[EnigmaOne]

Originally posted by spyke31:

Quote:

I have never felt more like a newbie in my life as I do now with this computer! Anyhow...I looked at all the files you asked about. They all display as the following:
Autoexec.bat

@echo off
xbios /P- /Z /I /M /V=Z
substtoz VDISK
Letter %RAMDRIVE%

Config.sys
DOS=HIGH,UMB
DEVICEHIGH=ACTCD.SYS /D:ASPICD0
LASTDRIVE=Z
BUFFERS=40
FILES=40

ER.bat
@echo off
Rescue /ve:32
MODE CO80 25

Actcd.sys-->gives some funky looking characters and the system beeps
Win.ini-->text is too long for me to get the first screenful of it and DOS is not recognizing and switches or the edit command

Last night, I was able to do a boot where it asked before initiating any drivers. I had it ignore any lines that booted to A:. That allowed me to get to Windows--but today I'm still having problems getting it to boot up. This morning--all it wanted to do was hang right after telling me the IDE Bus Master was confirmed.
That's all I have for now! (Sampson...I'm soo wishing you lived close to this area! I'd have ya troubleshoot this machine in person! lol)

This looks, to my eye, like the contents of the config.sys and autoexec.bat files from a MaxBlast (?) CD-ROM boot image. Letter.bat is certainly present on the MaxBlast3 CD.

In the root directory of your C: drive, your config.sys file should look something along the lines of this:
DEVICE=C:\WINDOWS\HIMEM.SYS
DEVICE=C:\WINDOWS\EMM386.EXE

For all intents and purposes, your autoexec.bat file can be empty.

The essential question remains:
How did these files get on the root of your hard drive?

Do you have a MaxBlast CD in the CD-ROM drive (one possibility)?
Did you copy the files from a MaxBlast CD-ROM (another possibility)?

I'm curious as to the contents of your C:\ directory. Do you think you can post a directory listing here?
If the file COMMAND.COM has a size/date/time of:
66,433 Bytes - Friday, July 21, 2000 5:44:00 PM
instead of:
93,890 Bytes - Friday, April 23, 1999 10:22:00 PM
then you are most certainly dealing with your root directory startup files having been overwritten by those from a MaxBlast CD-ROM.

Compare your root directory contents against something a bit more typical for a windows 98 machine:

Code:

_Volume in drive C is TRASH-OS   
_Volume Serial Number is XXXX-XXXX
_Directory of C:\
_
ADABAS_________<DIR>________06-25-04__2:48a_Adabas
INSTALL________<DIR>________06-15-04__3:35p_Install
MATROX_________<DIR>________04-27-04__2:26p_Matrox
MYDOCU~1_______<DIR>________04-27-04__2:27p_My Documents
PROGRA~1_______<DIR>________04-27-04__2:27p_Program Files
WIN98__________<DIR>________04-27-04__2:29p_win98
WINDOWS________<DIR>________04-27-04__2:29p_windows
WUTEMP_________<DIR>________04-27-04__2:26p_WUTemp
AUTOEXEC_BAK___________377__06-25-04__2:49a_autoexec.bak
AUTOEXEC_BAT___________511__07-06-04__6:45a_autoexec.bat
BOOTLOG__PRV________53,286__04-16-04_10:20p_bootlog.prv
BOOTLOG__TXT________51,361__04-16-04_10:23p_bootlog.txt
COMMAND__COM________93,890__04-23-99_10:22p_command.com
CONFIG___SYS____________59__06-12-04__6:32p_config.sys
DETLOG___TXT________72,670__04-16-04_10:07p_detlog.txt
FETNDI___LOG_________9,992__05-17-04_11:39p_fetndi.log
IO_______SYS_______222,390__04-23-99_10:22p_io.sys
MSDOS____---_____________9__04-16-04__9:58p_msdos.---
NETLOG___TXT_________7,081__04-16-04_10:18p_netlog.txt
SCANDISK_LOG_________7,312__07-02-04__3:10a_scandisk.log
SETUPLOG_TXT_______104,753__04-16-04_10:13p_setuplog.txt
SUHDLOG__DAT_________5,166__04-16-04_10:05p_suhdlog.dat
SYSTEM___1ST_______516,128__04-16-04_10:05p_system.1st
WIN386___SWP___536,870,912__07-06-04__6:45a_WIN386.SWP

(Underscores added to preserve output format)

Also, type 'ver [enter]' at the C:\_ command prompt. If you receive:

Code:

Caldera DR-DOS 7.05
Copyright © 1976, 1988 Caldera, Inc. All rights reserved.

as an output, you've definitley found your problem.
You'll then need to restore your command processor (and possibly all initialization files) from a startup disk [file editing required] or another working installation of win98 [preferred source].

Maybe this will help you on your way to a fix.