Solved

Win98se, major problem with programs that stopped running...

Posted on 2004-03-23
34
701 Views
Last Modified: 2013-12-28
Hello all,
I have a problem that occured just this instant. I am writing this message through my second machine.
When I booted my PC, my AntiVirus program found a worm called "Protoride.B" in the MsUpdate.exe file under c:\windows\start menu\programs\startup folder. I booted in safe mode and deleted the file, since the AV could not do anything with the infected file in normal mode.
Now that the file is gone, as soon as I boot Windows noramlly, I get an error that Windows cannot locate a file called "start.exe". I cannot run ANYTHING. I tried using the system file checker, but that too does not run.
Please guide me what to do...

Thanks a bunch.
0
Comment
Question by:liorde
  • 12
  • 9
  • 9
  • +1
34 Comments
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
Boot back into safe mode and

Sart > Run msconfig
Click on the tab marked "Startup"
unckeck all items except System Tray and Explorer.

If the problem no longer persists then one of the items in the starup is the culprit you just need to track it down.
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
If you find something listed in msconfig that points directly to start.exe then just disable that.
0
 
LVL 57

Assisted Solution

by:Pete Long
Pete Long earned 20 total points
Comment Utility
find where start.exe is being launched from
Using the Windows System Configuration Utility (startup)


Windows 98, ME, and XP have MSCONFIG

*****************
Windows 2000 doesn’t have msconfig but you can use it, if you...
Download the two files here
http://www2.whidbey.com/djdenham/Msconfig.htm
OR
http://www.perfectdrivers.com/howto/msconfig.html
************

If annoying programs are popping up every time you boot into windows XP or log in, you can disable them with the System Configuration Utility.

Press START > RUN > type MSCONFIG to launch

When the application starts you will need to click the startup tab.

This lists all the applications that will start when you boot up or log in, you can simply untick the ones you don’t want to start and reboot (if a problem occurs you can simply re-tick it)

Most programs launch from the following registry Key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Once you are sure you no longer need the application you can launch REGEDIT and go and delete a programs value from this key (DON’T DELETE THE ENTIRE KEY!!!)

Any software that is listed as "Common Startup" is being launched from the startup folder (click START >PROGRAMS >STARTUP to view them.  You can delete the Icons from here  <by right clicking it and selecting delete> to stop it launching.) This only deletes the shortcut; it does not uninstall the application.

*****Links*****

XP http://support.microsoft.com/default.aspx?scid=kb;en-us;310560
98 http://support.microsoft.com/default.aspx?scid=kb;en-us;281965
ME http://support.microsoft.com/default.aspx?scid=kb;en-us;281995


System32 Folder Opens When Logging on to Windows
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q170086

*****Start up Software*****

Autorun Software Downloads
http://www.bykeyword.com/pages/autorun.html

Startup Control Panel
http://www.mlin.net/StartupCPL.shtml
0
 
LVL 57

Expert Comment

by:Pete Long
Comment Utility
just knew that was gonna happen :)
0
 
LVL 32

Accepted Solution

by:
Luc Franken earned 30 total points
Comment Utility
Hi liorde,

Looks like your system has some more bugs.
Hope your system will allow you to run:
http://209.133.47.200/~merijn/files/HijackThis.exe
If so, please post the logfile.

Also, from safe mode, try "Start" => "Run" => type "msconfig" and press enter => take a look at the "startup" tab and uncheck everything except explorer.exe and systray.exe
Hopy your system will be able to boot into normal mode then and you're able to run hijackthis.

Greetings,

LucF
0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
Same feeling here Pete :(
0
 
LVL 57

Expert Comment

by:Pete Long
Comment Utility
evening Luc drop me an EMail when you get 5 :)
0
 

Author Comment

by:liorde
Comment Utility
Hi Lucf.
The file cannot run :-(
What does it do anyway?
Can I perform a "fixing" setup of Win98se through DOS (with a boot diskette)?
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
Try this first

F-Prot Antivirus for DOS
http://www.f-prot.com/products/home_use/dos/

F-Prot Antivirus for DOS is free for personal use

Downlaod
http://www.f-prot.com/download/download_fpdos.html
0
 
LVL 44

Assisted Solution

by:CrazyOne
CrazyOne earned 30 total points
Comment Utility
Reinstall the operating system over the top of itself. This will retain most of you settings and programs and replace the system files.

How to Reinstall Windows 98
http://support.microsoft.com/default.aspx?scid=kb;en-us;250928

or

If the CD is bootable and your system allows booting from the CD then boot to the CD and install.

Otherwise boot to a ME or Win98 floppy bootdisk http://www.drd.dyndns.org/fr_index.html?/disks.html
Put the CD in the CD drive
At the prompt run the following command

setup

If you don't have the CD then run one of these commands

C:\Windows\Options\Cabs\setup.exe

or

C:\Windows\Options\Install\setup.exe
0
 

Author Comment

by:liorde
Comment Utility
Trying these...
thank-you!
0
 

Author Comment

by:liorde
Comment Utility
Hi CrazyOne,
I tried the f-prot anti virus program yopu suggested. it did not find anything infected.
Still I cannot run any application. Funny though that WinZip did work fine.
Anyway, I did the second option that you suggested, reinstalling windows as a fix. I chose not to backup the previous files, and performed the setup normally.
Now , all programs are functional but I cannot use Outlook express, Internet Explorer as they crash immediately when trying to reach any URL. I have checked with my AV program for viruses but found none.
My questions are these:
1. WHat is that MSUPDATE.EXE file that was in my windows->startup folder?
2. Where did this file come from ? I am always protected with my AV program (AVG ver 6) so how did that file get there?
3. Is this msupdate.exe file a legitimate file?
4. Is there anything else I can do to my WIn98se partition before having to format everything...?
I really do not want to do the 4th option...

Please advise.
0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
1) it's a virus
2) Could be your virus definitions where not up-to-date at the time you got that virus
3) No
4) as you can now run programs, post the hijackthis logfile.

Let's just take it one step at a time, both your OE and IE problems might be related to the virus.

LucF
0
 

Author Comment

by:liorde
Comment Utility
Thanks LucF...!
Could you pleae tell me what this hijackthis.exe file does?

Thank-you,
Lior
0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
Hijackthis does check what processes are running and what is starting them. It's an easy tool to spot all kinds of things that have been messing up the computer.

Just run it, then click "Scan" afterwards "Save log"
then copy/paste the contents of the logfile here.
0
 

Author Comment

by:liorde
Comment Utility
Okay,
I will do this as soon as I get home.
Do you think that this problem I have with the Internet Explorer and OE is fixable...? Basically anything that requires internet connection crashes (with GPF) as soon as it attempts to perform it's internet connection.
Just thought you should know this.

Thanks again.
0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
I'm pretty sure that the problems with IE and OE are caused by something running on your computer.
I think after getting rid of the culprit IE and OE are fixed or maybe they'll just need to be re-installed, nothing to worry about.
0
Too many email signature updates to deal with?

Do you feel like you are taking up all of your time constantly visiting users’ desks to make changes to email signatures? Wish you could manage all signatures from one central location, easily design them and deploy them quickly to users? Well, there is an easy way!

 

Author Comment

by:liorde
Comment Utility
Can it be that the Anti Virus I am using currently is not that good? (AVG 6)
I ususally update it every time I am connected.
Could it be that the virus entered when I was on XP and went by "mistake" to the C:\ partition, thinking it was the XP's drive?
I must know how it got in. Otherwise, how can i prevent it from coming in next time??
0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
Let's take a look at the logfile before taking any conclusions about how you got the virus or whatever.
Different virusses have different ways of infecting a system.
0
 

Author Comment

by:liorde
Comment Utility
Hi again
Some bad news. Today I tried to repair my IE and OE by installing it from a file I had on a CD(full installation, not web install). Everything seemed fine, but after the restart the PC started loading the startup files and then BSOD. I tried this several times but the problem remains. Funny thing is that I cannot log into Win98 in Safe Mode. Can't understand why though...?!?
Any ideas?

0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
Try the repair installation again... that should bring you back in.
Then, please post the logfile...

LucF
0
 

Author Comment

by:liorde
Comment Utility
Hello LUcf...!
Thank-you SO much for not loosing the faith man! I really appreciate it.
Tell me if this is a good procedure to do, and also suggest what you think is better:
1. Boot with Win98se CD, begin installation, choose "Do not save backup files (110MB)"...?
2. After finished setup, run SFC to see if there are any version conflicts with the current system files.
3. Install IE 6 + SP1 from CD. OR Install IE 5.5 from CD...? Which is better for Win98se??
4. Run AV to see if virus returned...?



0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
Nope, just do 1, afterwards, post the hijackthis logfile, otherwise we might be back to zero again.
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
Your are going around in circles here it is probably time to try something different.

First run the following

Also use SpyBot and AdAware in tandem. Neither is 100% accurate but the two of them together get pretty close to 100% accuracy.

spybot here
http://www.safer-networking.org/
Download
http://spybot.safer-networking.de/index.php?lang=en&page=download

AdAware
http://www.lavasoftusa.com/

then next do the IE Eradicator thing. And install and only use IE version 5.0 or 5.5
Version 6 in some instacnes been kown to be problematic on Win98. Prior version seem to work better for this OS.
0
 
LVL 32

Expert Comment

by:Luc Franken
Comment Utility
Sorry to say this, but I wouldn't try this before finding the culprit...
0
 

Author Comment

by:liorde
Comment Utility
Thank-you for sticking with me, it is very helpful...!
Unfortunately I do not have much to try these solutions, only at night when I return from work.
I will inform you what has become.
I am going for what LucF has suggested, first.
After this, all options are open, if there will be any more options...

Thank-you.
0
 

Author Comment

by:liorde
Comment Utility
Hello again
I still have bad news. I cannot boot to safe mode. I tried reinstalling the system in repair mode. After the setup is done and wishes to "load windows for the 1st time" I het a BSOD. Something is conflicting there that is for sure...!
Is there a way, that I can disable things thru my other system? Since it is a dual boot, I have WinXP on D:\. Do you guys think I can work on the Win98se from WInXP?
Can I disable things that launch on startup for example?

Thank-you.
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
What do you think you can work on from XP? In other words what do you plan to do?
0
 

Author Comment

by:liorde
Comment Utility
I ask if I can modify my WIn98se regstry file, thru WinXP?
I am quite desperate as you can see...
I want Win98se to boot minimally so I can isolate the problem... hopefully.

Thank-you.
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
The two registry files are system.dat and user.dat. They can be opened in Notepad. However the design of these files make it very difficult to do accurate editing and by editing them in this manner tends to corrupt the registry.
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
What might work is run the regedit.exe file on the the Win98 disk making sure a copy of the system.dat and the user.dat are in the XP Windows folder. I haven't done this so I am just quessing that this might work.
0
 
LVL 57

Expert Comment

by:Pete Long
Comment Utility
ThanQ
0
 

Author Comment

by:liorde
Comment Utility
CrazyOne && LucF...
I am opening a new thread, since I finally was capable of loading Win98se in safe mode and ran HijackThis.exe file...
Please help me in the new thread...

Thank-you all...!!
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now