Solved

"Operating system not found"

Posted on 2000-04-26
23
272 Views
Last Modified: 2013-12-29
Hello everybody.

I'm asking you this question for a friend. His problem is that when he started up his computer today, the computer just produced the line "Operating system not found" and then stopped booting. We then tried to start it up with a diskette which worked just fine. But when we took a look at C: it was empty exept for a few files and was the size of a diskette. We then took a look at the partitions using fdisk (since we couldn't access h:), fdisk said that there weren't any partitions on the HD. After this we decided to format the HD and start all over again. We installed Windows 98 without any problems, and my friend then began reinstalling his programs. During this process he restarted the computer several times without any problems. But when he started the installation program for winzip the computer suddenly froze and when he restarted it the problem was back again.
So what could be causing this? Could it be the CIH virus, that was the best we could come up with.

Please help me to help my friend

Robert -Sweden
0
Comment
Question by:Robert_
  • 8
  • 6
  • 2
  • +5
23 Comments
 

Expert Comment

by:Jalen
Comment Utility
Its not the CIh virus that is doing that, defiantely another virus that is rewriting the boot sector. My advice to you is to only install programs from a trusted CD source and FIRST thing after you install Windows, Install a virus scanner, then update it from the net, THEN install the rest of the cds and disks....also, in the bios config of the computer, before you install windows, set the Virus Warning to ON, and that way it is harder to modify the Boot sector (Names for the settings may vary)
0
 
LVL 14

Accepted Solution

by:
smeebud earned 100 total points
Comment Utility
Jalen said, "defiantely another virus that is rewriting the boot               sector".

This is April 26 ya know. The day that CIH hits. And it hits in many forms.

By all means go to
http://www.symantec.com/avcenter/kill_cih.html

and get this virus killer.
then
Fdisk. format and start over.
You may even have to re flash your Bios.

Regards, Bud
http://www.geocities.com/budallen98_98/
Bud's Win95 Win98 Tips and Troubleshooter
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
Hi Robert,

Sadly, that is the classic ending after an CIH attack, the exact same thing happened to two friends last year, it's too late to fix your drives, if it is indeed CIH, the drive is dead for sure.

Sadly, as for Bud's links to CIH killers, it's a wee bit too late for them, but not a bad idea to download and put on your pc for the next time.

Depending on where you got your pc, and how old it is, you may be able to get a replacement drive, ie., if its a Dell, that you are leasing or on installment purchase, and they pre-loaded Anti-Virus software on it, that DID NOT detect CIH, you should be able to talk them into sending you a new drive. They did for both of my friends, with really not too many questions.

Best thing, is they actually sent a technician to their house to install the new drives, set-up, configed and happy pc again.

sorry,

nfroio
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
>>Fdisk. format and start over.  You may even have to re flash your Bios.

I tried that on my friends, and trust me, if you have the same, Taiwan Original Version, of CIH, that drive will never come back to life. It killed the drives beyond repair.

But, as Bud noted, there are a few variation on the CIH theme, so, maybe I am being a wee pesimistic, give a burl, and let us know, if you can somehow get the name of the virus, ie. CIH verison, could you please let us know, I would be interested.

Thanks,

nfroio
0
 

Expert Comment

by:scottem
Comment Utility
I think you may want to make an up to date rescue disk/anti- virus disk from your computer to use on his computer and get rid of any virus before you bother trying to reinstall anything. Make sure you write protect any disks you use and scan any disks you have already used on his machine.  The virus could be located in winzip.exe installation file, or may have been activated by it some how. So I would check that file also, you can run scandisk from a floppy also, after you  run virus disk from dos prompt.
 If you activate virus protection in setup it will probably not allow to install windows or run virus program from floppy, because it will not allow you to read/ write to boot sector of hard drive. And if try to it will come up with error" access denied "or something like that. Another thing to make sure of is that setup/cmos is recognizing the correct parameters for the hard drive, cylinders, sectors and heads.
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
FYI - CIH is activated, generally only on April 26 of any year, it's trigger is any *.exe file being activated, or anything that writes information to the system BIOS, basically, anything that you do with your pc on 4/26 will kill it if infected.

Best thing to do, forget about it today, leave PC off or as is, and attack it tomorrow, it would be a dang shame if a format - fdisk, etc. worked only to reactivate the virus and really kill your system

nfroio
0
 
LVL 17

Expert Comment

by:rayt333
Comment Utility
Check out this download and see if it will help:
Win95.CIH virus cleaning program
http://www.pspl.com/download/cleancih.htm
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
I knew that alot of CIH questions were going to come in today.....
0
 
LVL 17

Expert Comment

by:rayt333
Comment Utility
nfroio
I had forgotten all about it until these questions about it. And my sister lost all the data on her business computer last year. With that program we did save the HD but all the data on it was lost. She did have a backup that was only a week or so old, so all she really lost was work from the last week or so.
0
 
LVL 12

Expert Comment

by:Patricia Siu-Lai Ho
Comment Utility
Robert, if the computer is being attacked by CIH on April 26, change the CMOS/BIOS date to earlier good date e.g. April 10. Fdisk and install the operating system win98. Then install the other softwares. After that passing through the real date April 26, e.g tomorrow April 27, go to change the CMOS/BIOS date from April 10 to April 27.

This is the one of the method suggested by the CIH originator. See if that solved!      pslh
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
I was reminded by one of my friends whose PC was devasted last year, hard drive absolutely crushed, I tried everything I could think of, fdisk, format, low-level utils, ghosting, nothing worked, it was just plain dead.

So far, this week, I have seen about 6 questions that were directly or indirectly related to CIH< the gift that keeps on giving, year after year and apparently, year after year...>

<sigh> I think that I will busy over the next couple of days fielding calls from friends whose PC's come up either totally dead, or OS not Found.

Maybe next year, EE can post a warning on the main page starting around 4/20 to inform users to check, and innoculate their systems against CIH, because this little bugger seems to not be going away.

0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 5

Expert Comment

by:nfroio
Comment Utility
pslh,

That's does work. CIH is easy to fool, but for Robert, as long as he did not turn on the infected PC today, it will  not be necessary.

If he turned his pc on today to readjust the system time and date via the BIOS today, he will hose himself, cuz in order to get to the BIOS, you have to launch an executable file, and you will be writing to the BIOS, both of which are how CIH kills systems.

But that is a great point, I completely forgot about that route. Wish it came up yesterday, I know a couple of folks who cannot work today because they fear they CIH and I advised them to not use that pc,

oh well, not a bad excuse for not working though, hehehehe.

nfroio :-)
0
 

Expert Comment

by:scottem
Comment Utility
You are only asking for trouble if you do not run an up to date virus program and scan your system every so often. And I would be very careful about believing that the CIH virus will only bother you on a certain date, there are different versions of it and some of them do not give a hoot what day it is.
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
For future, think on this when building/rebuilding a drive: Partition disk to have O/S - programs on c: and data 'you care about' on d: of same drive. As I've said before in this forum, there are numerous reasons to separate code from data this way.

Without addressing this specific virus or strain, I have found in past that the 2nd one, d: is often easily restorable iff you can redo the fDisk piece to say exactly where it begins.

My assumption is that many of these begin their overwriting at one edge of disk, progress in sequence, and then fail before hitting the partition divider, for one reason or another.  Some actually only attempted an exact 256 sector count, knowing the keys to filesystem were an effective wipe, just like erasing first character of a filename was an effective delete in days of yore.

If there is a CMOS varint that so-called destroys either the chip or the drive, esp H/W, on this I would like to hear more, as A/V companies had told me 'no such thing.' I do not understand hd failure, but since incorrect flash is said to be a breaker, I'd suspect more vulnerability there in the CMOS piece.

Nice to hear that at least one, Dell, actually cares more about people than lame excuse fine print. I'll remember that.
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
SunBow:

From what I have read, and had first hand experience with, the original Taiwan Origin Win95CIH.exe virus, is a total hardware and software killer.

The Orig., Win95CIH.exe virus, is activated by any *.exe, and most importantly, anything that write to the CMOS or BIOS, the vairent that killed my friends' PC's (Both got infected from the same source - a burned graphics cd), was particularly nasty, it not only destroyed every bit and byte of data on the hard drive, it actually knocked the hard drive out completely, and bellieve me, I tried everything that I could think of to recover at least the hdd itself, as I gave up on the info as soon as I researched CIH, I tried to format the disk, it appeared to work, only to go into fdisk to see that the disk was now a 1.38MB paperweight. I then downloaded a low level util. and tried that, seeing as the drive was probably dead anyway, and nada, nothin', just dead.

Thankfully, as I stated, they both had new DELL's that they were still paying for, and that DELL had pre-loaded Anti-Virus software on, which, did not catch the virus. DELL really stepped up and not only gave them new hard drives (10GB - WD Caviars), they sent a tech. to their houses to install and re-config. I say good job DELL, and ick!< that CIH is a nasty one!

 
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
I suspect still the HD ok, just the tools we little folk get are too dependent on M$ pre-sunctionality. But will note to look on it more some day. THis CIH.

On Dell, to add words on them, they were once going through a period of blame for 'not support' users.  In EE, I had contact w/ one who bought a Dell and had all the Customer Complaint issues noted in news. Like the worst support imaginable. Once problem was resolved, the comeback I heard was "I still recommend them as they really are good at service". So IMHO, I see in EE now 2/2 reasons to keep that company on my list for possible future platforms.

If I had time some weekend, my curiosity is such I would not mind buying cheapo HD just to see if it really does blow.  But, maybe that was me in another life. Maybe, don't throw out that old old PC just yet, consider use it to test the 'graphics CD' or whatever before running on machine you depend on.
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
Robert_ , is friend still down? Now we are after the 26th, so, any status? Or is it all blown?
0
 
LVL 1

Author Comment

by:Robert_
Comment Utility
I'm happy to say that my friends PC is up and running again, I guess he was lucky, the HD seems to be working as it should. I'll ask him to decide which one of you I should reward the points to, be patient you will get your points! Thanx to all of you for taking the time to answer a question that you've probably heard a dozen times before. Now we know what the problem is, so we can avoid it in the future.
0
 
LVL 5

Expert Comment

by:nfroio
Comment Utility
Guess that it was not CIH, or a really nice version of CIH at least.....

Is all of his info still there??? Apps and data???

WOW!!!

nfroio
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
I try to put the data stuff on d: partitioned as a defense for the likes of this.
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
> when he started the installation program for winzip the computer suddenly froze

Was this a bad copy of winzip you had?
0
 
LVL 1

Author Comment

by:Robert_
Comment Utility
Hi again everebody!

Thanx for all your help. We had to format the PC so sadly all his work is now lost, but hey, **** happens right!? At least the PC survived, the BIOS seems to be untuched (pew!)

Thanx again.

(it's a bit sad that can reward the points to one person only)
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now