Dear listers,

I am currently dealing with a very weird and nasty system trouble that completely prevents me from booting into windows, neither in the normal nor the safe mode.

I have been running Win98 SE on my Compaq 18GB desktop for about 5 years with no major problems except one time when I could not boot due to a corrupted himem.sys file ("non-system disk" error at boot, after uninstalling Microsoft Excell), however it was fairly easy to solve and I had no boot troubles for the last 2 years. A week ago, this time without running into anything "suspicious" that I can remember, I noticed that my PC suddenly slowed down dramatically at start up. Eventually, I could no longer boot normally as the system froze half-way or at best hanged up shortly after the windows loaded. Before start up I started getting the "your hard drive detects imminent failure etc" error message from SMART.. I then managed to get in safe mode, where I discovered that out of nowhere there was a heap of weird files and folders stored in the C:\My Documents folder. The folders were named such as "ectX.Dir.ect", "nDetails_D", etc, with lots of files with names like

rosoft P.lus
llows th e m
ft Direc tXa
rectXapp lic

etc. I had also a few files like "aaaabbbb" and "bbbbccccc", with no attributes, in the C:\ and C:\Windows paths. The funny part is that most of the files are reported with disorganized futuristic creation dates ranging from the years 2010 to 2050 (despite that my PC clock is working fine), and have a windows reported size from 0 kb, to 1 to 5 terabytes , with a total of about 50 terabytes for entire folder, even though the Windows and DOS reported size of the drive C states the usual "500 MB out of 18GB free", as was the case before the crash. I managed to delete all suspicious files (wich had no attributes) from the other places except My Documents folder, save for a single large exe file. After restart, I could no longer boot even in the safe mode. Instead, I ended up with a Windows start up menu, with a message that Windows detected a serious registry error and that I should choose the "command prompt" alternative and run Scanreg. In the beggining Scanreg was running very slowly, reporting that it was "recovering the system files", and after completion I usually got the "Windows protection error - restart your computer", and the Windows keeps on detecting the registry corruption. I can no longer complete Scanreg - it keeps crashing before completion. I attempted deleting the files and the entire My Documents folder both from DOS and ebcdlite emergency disk, to no avail. When I try deleting the suspicious files I keep getting the "failure reading Drive C" error, even though I can copy and delete any other files\folders. I strongly suspect that these strange files are responsible for the disruption of my hard drive, and further that it might be some sort of virus at work. I wonder if there is any utility specifically designed against the virus, or if it at least can be identified. I tried running the latest updated Kaspersky version within the Bart CD, but it cannot recognize the files on C:\. The few of the suspicious files that I managed to copy to my USB drive were not recognized as infected by Kaspersky. However, I have a laptop with an internet connection and an external USB drive so I am able to try anything that might work in the DOS mode from a boot CD. Any help greatly appreciated!

Thanks for your time,

Alex

Hi Alex, welcome to the PCHF

My first guess is the reason your computer has suffered so greatly is because Microsoft no longer release security releases for Windows 98.

That being said, you might want to follow the prework link in my signiture and post the resulting logs back here.

Sound like it maybe a corupt hard drive. But if you think it is a regisrty problem try in dos mode scanreg /restore and try put a previous registy back. But first in dos mode run chkdsk /r and see if it fixes any problems with your hard drive then do the scanreg /restore. Let me know how you go

P.s before you start do an fdisk /mbr to reright your boot records just incase it is boot sector virus

Hi madmatt,

Thanks for your reply. I tried everything you suggested, here`s what I got:

* fdisk /mbr - the command was apparently executed with no additional messages. It does not seem to do anything.

* chkdsk /r - nothing happens; a message pops up saying that I should try Scandisk instead. Typing Scandisk, the program launches but halts at 0 to 1%. When I choose "cancel", a Win98 image briefly appears, followed by Scanreg (still in the DOS mode). Scanreg automatically "backs up" and "restores" the system files, then a "Windows protection error" pops up (black screen). If I ran Scandisk directly at the command prompt, it completes the restore process but immideately "disintegrates" and I end up with C:\ DOS prompt above the "Microsoft Scandisk" heading. If I retype "Scandisk" again, the system crashes; typing "win" starts the whole process all over again.

Where do I go from here?

GaRHaR,

Thanks, but I am afraid I can`t use HijackThis in DOS mode. The trouble is, I simply can`t boot into Windows under any circumtances. I wonder if there is a way of deleting these odd files because I feel that I won`t be able to boot as long as they are there. They are most certainly the reason my syistem is so extremely slow and halting in the first place.

I wonder wich viruses\adware are known to generate extremely large files with random names and creation dates? I am aware that there are specific DOS utils that target a particular virus (I have used several previously), but I have currently no idea what sort of virus I may be dealing with.

Hi sorry to take so long to get back to you I was just thinking do you have another pc you can use to plug the hard drive of the crashed pc into as a secondary hard drive for cleaning or so we can run some diagnosics on the crashed hard drive? The Antivirus would have to be up to date on the pc and would also need to have some spywhere/malwhere removal software. This would be the easiest way of sorting out the drive.