We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now


Win98 registry restore problem

George46227 asked
Medium Priority
Last Modified: 2013-12-28

My Win98 pc will not boot, get a blue screen, won't even boot in safe mode.

I tried to restore the reg but got a failed (error) result.

my .ini file is configured for 20 or so reg backups (MaxBackupCopies=20), the backups are there, I can see them on the disk (after booting with a win98 startup disk). But when I run scanreg /restore from DOS I only get to choose from five backups! None of these backups will restore, I am pretty sure one of the older backups will work but I can't restore any of them because they don't show up in the scanreg restore choices.

How can I restore one of my other backups? How to make them show up in the restore choices, or some other way to do it?

Watch Question

Top Expert 2009
This Microsoft Knowledge Base article explains the problem and solution.  Look at method 2:

Registry Backup Not Listed in Registry Checker Tool

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
paraghsDy General Manager
Alternatively, you may try to extract system.dat & user.dat from a cab file.

See these :
http://members.holba.at/wolfgang/english/tipstricks.html (tip dated 24-02-2001)

Many unzip programs too have the option to extract files from cab files.
You've got 20 .CAB files to extract the .DAT files from if you can't get them to list with the scanreg /restore command, and testing them one after the other is going to be trial and error.  You should get a pencil and paper and start taking notes of what you are doing, because you will lose track of where you are otherwise.

Make new directories, eg:

etc. to

Extract each .cab file from the C:\Windows\SYSBCKUP folder to each of the above folders in sequence.

EXTRACT /E  c:\windows\sysbckup\cabfile_1.cab /L c:\cab001
EXTRACT /E  c:\windows\sysbckup\cabfile_2.cab /L c:\cab002

Remove the attributes from the current SYSTEM.DAT and USER.DAT files in C:\Windows and then copy to C:\DATBAK\ORIG

attrib -h -r c:\windows\system.dat
copy c:\windows\system.dat c:\datbak\orig\system.dat
attrib -h -r c:\windows\user.dat
copy c:\windows\user.dat c:\datbak\orig\user.dat

Remove the attributes from each of the .dat files in your CAB001, CAB002, etc folders:

attrib -h -r c:\cab001\*.dat
attrib -h -r c:\cab002\*.dat

Now use the copy command to copy the .dat files from the first folder to replace both .dat files in the c:\windows folder, restore the attributes, and try to reboot.

copy c:\cab001\*.dat c:\windows\*.dat
attrib +h +r c:\windows\system.dat
attrib +h +r c:\windows\user.dat

Take notes of this first step.  As I said, you may end up having to try this 19 times, so you need to remember which ones you have tried.

If that fails, try removing the attributes of the c:\windows system and user.dat files again, and overwriting them with the .dat files from the C:\CAB002 folder as detailed above.

If all fail, then you have a C:\SYSTEM.1ST fiile that was created when Win98 was originally installed.  That MAY allow you to boot to at least rescue your data before reinstalling Windows.

Your best shot would probably be to boot to a Win98 boot floppy and run Windows setup to reinstall Windows over itself (ie. back to the C:\WINDOWS folder again).


That very much echoes what has been suggested in the two links given by paraghs, but I am just giving you my personal advice given the number of .cab files you have.  I usually set the scanreg.ini file to create 7 backups (and add extra config files into each cab file), and I've got myself lost in circles a couple of times with no original backup to return to.

Restoring the Windows registry

    If you have made a backup of the user.dat and system.dat files in the past and you have verified they still exist, follow the below steps to restore your Windows 95 registry.

    First, get the computer to a MS-DOS prompt. Information about how to get to a MS-DOS prompt can be found on document CHDOS.

    Once at the MS-DOS prompt, type cd\windows  

    Once in the Windows directory, type the following:

    attrib user.dat -r -a -s -h <press enter>
    attrib system.dat -r -a -s -h <press enter>
    del user.dat <press enter>
    del system.dat <press enter>

    Once these files have been deleted, type cd\windows\backup once in the windows\backup directory type the below. If you have have changed the location of where your registry is backed up you will need to change to the directory that contains the backup.

    copy user.dat c:\windows <press enter>
    copy system.dat c:\windows <press enter>

    The above should copy two files; once copied, reboot the computer and you should now be able to get back into Windows.

Registry Restore Detailed Info :-

  1. http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/1999111116313539
  2. http://members.cox.net/scotterpops/articles/regback/regback1.html   (Everything Explained)
  3. http://home.adelphia.net/~bobstur/misc/w98regbu.htm
  4. http://freepctech.com/pc/002/Windows_registry_faq.shtml
  5. http://www.microsoft.com/technet/archive/win98/reskit/part6/wrkc31.mspx?mfr=true
  6. http://www.helpwithwindows.com/windows98/start-145.html
  7. http://support.microsoft.com/default.aspx?scid=kb;EN-US;q221512
  8. http://members.cox.net/scotterpops/text/regback.exe



thanks to all, I will try the suggestions soon, won'y have time until Saturday, will let everyone know the result.




I used the EXTRACT method to get the reg and ini files from an older cab and restored them.

Also I found several damaged files by checking the scandisk log, one of the files was important - user32.dll. I restored a fresh copy plus a couple of other lesser important files. Now I can boot all the way to the desktop and seem to have ALMOST full function!

two problems left to solve-
1. when I go into explorer and try to copy a file I get "Explorer illegal operation Explorer caused an invalid page fault in module shell32.dll (sometimes it says module kernel32.dll). Sometimes this error is followed by "Microsoft Internet Explorer an error has occured in Internet Explorer. Internet Explorer will now close" - this is while using Explorer NOT Internet Explorer ( it's not even open), I don't always get this error.
2. When I go to Start Run and type command I get "D:\Windows\commad.com Cannot find the file D:\Windows\command.com. Make the file exists and the path and filename are correct". I do have a 2nd drive with D: and E: partitions but not with a Windows folder, Windows has always been on C:\Windows. I have checked the msdos.sys file and it is correct, also checked the environment with SET - it is also correct. Autoexec.bat path is also correct. PATH command is correct.
If I type c:\command it works fine.
I checked shell32.dll and kernel32.dll and they seem fine for date, size and version.

Any suggestions?

paraghsDy General Manager

1. Run System File Checker.

Actually, "Invalid Page Fault" can be caused due to numerous reasons :

In short, run Scandisk & defrag, check your RAM using MemTest from http://www.memtest86.com/.

2. Open your registry using registry editor, and search for D:\Windows. Also search all .ini files for this string, and replace it with C:\Windows wherever that string is found.

"When I go to Start Run and type command, I get "D:\Windows\command.com Cannot find the file D:\Windows\command.com".

What happens if you use the "MS-DOS Prompt" icon on your Start Menu to open a DOS Window?
Did you have a look at your C:\Config.sys file?

Do a search for *.PIF to find all DOS Shortcut files on the C: Drive.  Right-Click on each in turn and chhose "Properties".  Look at the "Cmd Line" and "Working" Fields under the Program tab (equivalents of "Target" and "Start In" for Windows Shortcuts - *.LNK files).

It's likely that you have a Command.com in the root of C: and in the Windows Folder, with a Command.pif file for each.  It sounds like the PIF file in the Windows Folder has its "Cmd Line" set to D:\Windows\Command.com.

>>> "I restored a fresh copy (User32.dll) plus a couple of other lesser important files". <<<
Can you recall what those files were?  It is possible that restoring an older (native Win98) version is now conflicting with more recent system files that had been updated by IE, Windows Update, or hotfixes.

If your version of Internet Explorer was subsequently upgraded to a higher version than the version installed by Win98, then you should try and reinstall it.



checked the registry for D:\Windows - nothing found
searched all .ini files for D:\Windows - nothing found

MS-DOS Prompt on Start > Programs works OK, also one on the Start Menu which I must have put there myself some while ago, also one on the desktop
CONFIG.SYS looks OK "Buffers=30 Files=30 Device=C:\Windows\Himem.sys /Machine:13", older backup copies are the same
search for *.pif - yes, the command shortcut in the windows folder was set to D:\Windows\command.com! I think this happened (the date stamp was 4/5/06) recently when I had the drive slaved to another win98 to do the repair - the drive at that point would have been "D:\", I think Windows automatically "fixed" the shortcut - I have seen similar things happen when you open a shortcut pointing to an "invalid" location (like storing shortcuts as a backup from another machine, the OS thinks the path is "invalid" according to the live OS context and "auto-fixes" the shortcut!)


I am still working on the problem of "illegal operation" when I try to copy a file inside Windows Explorer.

System File Checker, Scandisk & defrag - not done yet

restored user32.dll - restored from a clean native Win98 1st ed. install. No system files had been updated by IE, Windows Update, or hotfixes anytime recently, probably a few months. The registry restore was from 11/05 - no updates have been installed since then. I copied user32.dll 69,623 bytes date 5/11/98 version 4.10.1998 - I have not found any information on this file for updates for Win981st ed., I assume it is the correct version - all other win98 pc's I have checked are using this version.

other files replaced (possibly were damaged based on scandisk.log info) -
iedkcs32.dll 294,912 8/17/01 6.00.2600.000 ( I am on IE 6.0) - the original file had the same date but a different size
mstask.dll 233,232 2/8/02 4.71.1968.1 - the original file had a date of 1/28/01, I couldn't find a copy with the same date as the original file, the version does match up with mstask.exe 4.71.1968.1
voltrack.vxd - 18,491 5/11/98 4.10.1998, date matches the original

later I have also replaced shell32.dll, kernel32.dll, explorer.exe with fresh copies which matched size, date and version.


Can you drag and drop shortcuts into and from your Start Menu and Quick Launch Toolbar?
This functionality is provided by the presence of IE 4? and above, and is what differentiates Windows 98/98se from Win95 which did not allow these actions.

That might give some indication of whether this problem is related more to the "shell" dll's installed by IE and integrated into the Windows Explorer interface, or whether the problem is isolated only to Windows Explorer components.

Start up Dr. Watson (Start Menu > Run > and type DRWATSON).
It opens a new icon in the System Tray and access is by Left or Right-Click on it.
You can create a snapshot and save it as a Dr. Watson Log File (*.wlg) any time you wish, for later comparisons, but as long as it is running in the background it MIGHT be able to intercept the error situation and create a log file to C:\Windows\DRWATSON.

When it does detect an error situation, it will indicate a brief description under the "Diagnosis" tab, and then adds debug information relating to it under a "Details" tab that doesn't show in normal use.  It's not easy to interpret the debug info unless you are a proficient Assembly Language programmer, but the errors stick out a bit between the nice neat columns of the assembly code.

Here's an example error report from the "Diagnostics" tab from a Win98se machine that wouldn't start:

Windows Kernel core component used an uninitialized variable, attempted to access memory or a DLL that has been freed, or encountered some other nonspecific error.

Module Name: KRNL386.EXE
Description: Windows Kernel core component
Version: 4.10.1998
Product: Microsoft(R) Windows(R) Operating System
Manufacturer: Microsoft Corporation

Application Name: Explorer.exe
Description: Windows Explorer
Version: 4.72.3110.1
Product: Microsoft(R) Windows NT(R) Operating System
Manufacturer: Microsoft Corporation

Error situation on opening the C:\Windows\FONTS folder in Windows Explorer

The "Details" tab allowed me to see that there was an error with a particular font that had been installed by WinAmp, and was either incompatible or corrupt (only two relevant lines shown from debug info shown below), and delete the file from DOS:

020cf838 020cf9dd -> 3a 57 69 6e 61 6d 70 35 20 53 6f 6e 67 74 69 63 :Winamp5 Songtic
020cf8d0 020cf949 -> 57 41 35 53 54 2e 46 4f 4e 00 bf 05 00 00 80 b8 WA5ST.FON.......

Although this page is for Dr. watson in Windows NT, it shows you how the detailed debug report is laid out:
It is usually easier to save the log as a *.TXT file and open in Notepad/Wordpad to view it.

You may also want to open C:\Windows\FAULTLOG.TXT to see if anything useful has been captured in it.
Unfortunately it appends errors, so you have to scroll to the end.  It usually just echoes the full details of Windows Errors as they display in the "details" view of the dialog, but it might contain something extra.



ran scandisk again, no new info - some errors in data files and some non-critical system files (files installed by other applications, not part of the win98 core).

I had already run Dr. Watson last week-
"Windows Shell Common DLL performed an invalid memory access.
module name shell32.dll
application name explorer.exe"

that's why I replaced shell32.dll and explorer.exe, replaced kernel32.dll because it is usually mentioned in the "illegal operations" error.

dumb question - I am a preferred keyboard user/menu user, hardly ever use mouse/drag and drop stuff. I must be doing something wrong - when I try to dag and drop a desktop shortcut to "Start" button or "Quick Launch" bar  - nothing happens.



When you drag a shortcut to the start menu, you have to hang it over the start button until the menu opens, and then move it to where you want it in the menu, apart from the bottom section which is fixed.  The same applies to the Quick Launch toolbar, you can only use the section on the left ie. immediately next to the start button.  There is a slider handle that you can use to widen this part fo the toolbar.  You'll see the plack vertical beam marking the spot when you hang the mouse over it for a moment.  It sounds like you are being a bit hasty with dropping the shortcut.



I was confused about your suggestion - I thought we were trying to drop the shortcut on the Start button - seems like I remember you could run a program by dropping it on the Start button.

I drag and dropped a desktop shortcut to the Quick Launch bar without any error. However it "moved" instead of "copied", so I moved it back to the desktop, no problem or error in either direction. I forget the whole drag and drop thing - left drag, right drag, the "+" sign, the slash/not allowed thing, copy vs. move, etc.

I'm not sure what is going on with the Start Menu. Today I noticed 2 new icons in the upper Start Menu - these were the ones I was playing with yesterday, properties confirmed the date 4/11/06, so I guess it was working whatever I was doing I just didn't notice ( I already have quite a few items on the Start Menu so I just didn't notice the new ones, they were scrolled under at the bottom ). Today I can't repeat it! Either what I did yesterday or your suggestion, the icon never shows up. I guess my technique is just not quite right. I did seem to create a horizontal thin black bar on the Start Menu in the area where I tried to drop it, it stayed for a while then eventually went away after opening/closing the Start Menu several times.

later 11:55am

I rebooted, now I can drag and drop to the start button which puts the shortcut on the Start Menu (copy) - no error. Also able to drag them off the Start Menu to a desktop folder (move) - no error. Also able to drag to the Quick Launch bar and back to the desktop (move) - no error.



Sorry about the confusion.  Yes, dropping on the start menu can start a program up, but I merely wanted to have you test to see if the act of dragging and dropping in those two areas would generate an error like the one within Windows Explorer's interface.

What you have done is eliminated that aspect from further consideration.  This functionality is provided by Internet Explorer.  Your problem seems to be isolated to Windows Explorer.

An "invalid memory access" normally means a corrupt file OR a mismatch of file versions.  Explorer.exe seems to be looking for a function of shell32.dll that isn't loaded into memory where it is supposed to be, or vice-versa.

Do you have Windows 98 First Edition or Second Edition?



Windows 1st Ed 4.10.1998 OEM
IE 6.0.2600.0000 128 bit

my instincts tell me it is more likely a corrupt file(s) or version(s) problem vs. a registry problem. the restored registry is from 11/05, I would think I would have tried to copy some files between 11/05 and 3/06 when the crash occured, if I had copied files I would have gotten the error which I would remember. But I can't swear to it (it is possible I could have gone that long without doing some copying but it seems unlikely).


Using the System File Chcker (SFC) in Win98 First Edition can be problematic depending on what file(s) you are extracting from the CD, because it can extract and restore older file versions that are only used during setup and are really just old Windows 3.1 versions.  This is in addition to the fact that IE 6, MS Office versions after Office 97, and some Windows Updates will have introduced more recent files to the system that may end up being retrograded to the default ones by running Extract or SFC.

Scroll down a bit to the errors, and you'll see where the problem lies.

"The following files are CREATED during Windows 98 Setup and are NOTt located in the Windows 98 cabinet files:
...MSTASK.DLL, Mstask.exe, Mstask.cnt, Mstask.hlp, Mstask.inf, Mstinit.exe...

NOTE: You replaced MSTASK.DLL.  I would suggest copying it from another functional Win98 FIRST EDITION system.
The Win98se version is 4.71.1972.1 and is 233,232 bytes in size, so it would probably cause a mismatch.

The problem with SFC restoring older non-compatible file versions is documented here:
and the resolution is to use the EXTRACT command from DOS instead.

I'm not sure whether this IS an issue, or whether you have run SFC.  The logfile would tell you if it restored any of the listed files (C:\Windows\SFCLOG.TXT):

Windows 98 First Edition and SE both install the same version of Explorer.exe : 4.72.3110.1 180,224 Bytes.
So, it would appear that your version is OK as long as it isn't corrupted.

I see from this page that they have a Windows 98 Drag and Drop Fix .REG file:
"Repairs SOME cases of lost drag-and-drop ability" - nothing said about errors.







That OLE grabs my attention though.  Within the past 3 weeks I've fixed 3 systems where part or all of the HKEY_CLASSES_ROOT registry key were wiped out.  It would seemto have been caused by some type of malicious script being run from Yahoo Chat Rooms, because the owners talk of many others who use the same chat rooms being affected in the same way.  The OLE mappings to support drag-and-drop operations are stored as settings in that key.

Do me a favour and export the following keys from regedit to .REG or .TXT files, and paste here:


Another thought I am having, since discovering a value in my registry that contains a "drag" reference, is whether you have nVidia Graphics Drivers that allow "nView" settings.  I'm not sure of the significance of this, because I always disable all the fancy user-tweaks in these extra "advanced" display properties:

HKEY_CURRENT_USER\Software\NVIDIA Corporation\Global\nView\Tweak
DWord value named "TransDragClickDelay".  (Transparent Drag Outline Click Delay??).

HKEY_CURRENT_USER\Software\NVIDIA Corporation\Global\nView\WindowManagement
"TransparentWindowDrag" and "TransparentWindowDragPct" DWord values.

Have a look at your advanced display settings if this is relevant, and disable all fancy extras just in case there is some conflict going on.

Another thing you might want to test is one of your standard Windows display settings under the "Effects" tab ie. "Show windows contents while dragging".

[HKEY_CURRENT_USER\Control Panel\Desktop]

That's about all I can think of meantime without doing a dirty reinstall of Windows right back over itself to the C:\Windows folder.



just saw your latest info, thanks for all the resources.

I am aware of the SFC issues, never had much luck using it in the past - too many files reported, no way to know for sure whether the version is a match or not, etc.

just to summarize:
do you think this is related to a drag and drop issue? you mention a lot about drag and drop. when I followed your testing I WAS able to drag and drop desktop shortcuts on and off the Start Menu and Quick Launch - I hope I explained that clearly. My original problem (after the reg restore) was I can not copy and paste files or folders using r-click "copy" and "paste" or the Explorer Edit menu "copy" and "paste" - gives the illegal operation error and then Explorer shuts down and re-loads.

I just now put the reg/ini files (system.dat, user.dat, system.ini and win.ini) from the bad pc on a good win98 1st ed. pc (fresh install plus IE upgrade to 5.5 and all critical MS updates). So I now have a good \windows folder running with a reg/ini set from the bad pc. just to see if this is a reg. issue vs. file issue.

1. I booted the "good" pc with the reg/ini from the bad pc into Safe Mode. no errors on booting. When I try to copy and paste - NOTHING at all happens - no error, nothing is copied, etc. tried r-click copy and paste, drag and drop, Explorer Edit copy and paste - all the same, nothing copied but no error. I can copy with no problems/no errors normally from the MS-DOS prompt.

2. boot to normal mode, no errors on boot. Same results more or less. Using Explorer Edit copy and paste - no errors, nothing is copied. Drag and Drop - no errors, nothing is copied. Right click copy and paste - no errors, nothing is copied. I am wondering again about IE-related issues. When I tried to open \Windows folder in Explorer I got an error something "You don't have permissions to run ActiveX Controls..page may not display properly.." It looks like it's trying to display the folder in a Web view but not properly (don't know why it is trying to use Web View - I always change everything to Classic Style) - in the right pane for \Windows it shows "%THISDIRNAME%, also the same thing for any other folder - but when I first open Explorer it is just the normal classic view in List view, only after I try to open \Windows or \Program Files do I start getting %THISDIRNAME% for every folder. Also I notice when I go to Folder Options the View tab is EMPTY! - no choices are present!

thought you might be interested in this "experiment"




Here is the reg stuff you asked for -















Doh! I'm afraid I have been working on an assumption gained through misinterpreting something you stated a while back, and relating it to the way I do things on the computer:

>>> When I go into explorer and try to copy a file I get "Explorer illegal operation - Explorer caused an invalid page fault in module shell32.dll (sometimes kernel32.dll). Sometimes this error is followed by "Microsoft Internet Explorer an error has occured in Internet Explorer. Internet Explorer will now close". <<<

When you said "copy a file", I'm afraid that I based it on how I copy files, ie. Drag and Drop (right mouse mostly).  I never use the Right-Click on file > Copy > Right-Click in new folder > Paste method.  So, I've been off on a tangent looking at drag-and-drop issues.  Damn.

OK, now that I have realised my wrong direction, here's where I think the problem MIGHT lie.  Either export the following registry keys and then merge the .reg file, or compare exports from the problem computer with mine:


@="Shell Copy Hook"




I think this is the most likely source of the problem.

There is a great little utility that allows you to see registered shell extensions and those in use, just in case you like utilities:
Shell Extension Viewer:

Standalone program files (leaves registry entries in [HKEY_CURRENT_USER\Software\NirSoft\ShellExView]):

Installer with add/remove uninstaller (probably better with this):

I meant to say, and perhaps you may not be aware of this, that you should leave two blank lines after the last text line in a .REG file or it won't usually merge properly.  I don't know why, but this is based on experience and much head-scratching.




thanks again for your suggestions, I had noticed the shell copy hook entry earlier when comparing the reg to a good reg, wondered if that might be the problem, I'll take a close look at that one.

At this moment I have copied the bad \windows folder - including the bad? reg/ini files to another Win98 pc and booted it. I am going to try to duplicate the error or at least try to narrow done what works/doesn't work exactly as there seems to be some inconsistencies depending on method used and the items (files, folders) being worked with.



George, I'm looking again at what you did by way of experimentation, ie. dumping the bad user.dat, system.dat, win.ini, and system.ini into a good windows installation on ANOTHER computer.

I am surprised that it booted without errors, or some types of messages or prompts, unless of course the other computer has almost identical hardware.  The system.dat and system.ini files hold hardware settings that are computer and device-specific and would usually have enough differences to cause errors.

Strange that it thought you preferred "web view" folder and desktop settings.  I would have thought they (ie. the Classic View preferences), and other appearance preferences, would have been copied across with the user.dat and win.ini.
The settings held under:
store details of icon placements, menu order, etc.  You probably find that there have been enough substantial  differences found with the current state of the new computer the registry now finds itself in that it has reverted to Windows default settings.

Interesting experiment.  I would liked to have had the original .dat files from the fresh install on the other computer, and the .dat files from the problem computer to do some side-by-side comparisons.  I use a program named "Beyond Compare" (version 2.01) by http://www.scootersoftware.com/ for binary and other file comparisons, but most often to show .reg file differences.  I have the retail version, which supports a few handy plugins, but I'm sure the 30-day trial would allow you to compare your registry files.

To load and view and then export a registry .dat file to a .reg file, I use a couple freeware utilities from MiTec.  I downloaded the older version of the utility below (v. 1.8) a long while back, and the versions may have changed.  The same link I had for version 1.8 is now shown against details of version 2.0 and this may have changed in functionality - haven't tested it yet.  Somehow I have ended up with a downloaded copy of a version which works the same way, but I don't seem to have saved the url.

MiTeC Windows Registry File Viewer

Viewer for standalone files containing Windows registry hives (e.g. NTUSER.DAT, SYSTEM.1ST, SAM, etc.).
It features extended registry searching, registry dumping and exporting to REGEDIT4 format.

I have a feeling that the utility (whichever version used) MAY NOT load ALL the details contained in each .dat file as a representation of a regedit-type explorer window, but I've always found that it provided me with enough details for comparisons and troubleshooting when exported to a .reg file.

Perhaps this is something you could do if the Beyond Compare trial version allows full access.  The Registry viewer above can load two .dat files side-by-side for comparison, but it is a bit laborious doing visual comparisons on each of the "keys", hence my preference for BC.




thanks for the links, resources, etc.

to clarify - when i boot the good pc from the bad pc \windows folder - including the bad reg/ini files - I do get various alerts, warnings, errors, etc. Nothing that prevents basic function though. As I recall the "New Hardware Found" thing found a bunch of stuff and wanted to install them, I just canceled out. Also warnings about various files and shortcuts that were trying to load from the E:\ drive (the bad pc has 2 disks, disk 2 is E: and F:). Nothing un-expected or anything preventing me from working with basic windows functions.

I think I also mentioned I loaded the good \Windows folder with the bad reg/ini files with some weird results - such as the Web view for Explorer, the ActiveX error, the missing directory names (%DIRNAME% or whatever it was). I was hoping to eliminate the registry vs. missing/corrupt/mis-matched files as the problem.

I am going to try to import your reg keys today from a fresh win98 1st install.




I imported the CLSID Shell Copy Hook reg key and the Directory CopyHookHandlers keys (from another pc fresh install plus all critical updates and IE 6 upgrade).

Good news and bad news -
so far I have not got the illegal operations error when copy/paste either Rclick or Edit, tried single files, single folders, multi-folder group copy.
there is a long delay (30-40 sec.?) and the copying seems very slow. I think because my \windows and reg/ini do not match the hardware I am running "MS-DOS Compatibility Mode" which likely explains the delay and slow copying. But no errors!!

However now when I try to Shutdown or Restart I get a blue screen "Fatal exception OD at 00E0:00005603...etc." I usually have to force power down, "Hit any Key.." and "Ctl-Alt-Del to restart" don't usually work. But I can do Restart in MS-DOS mode. Not sure but I think the 00005603 address is related to System Board Plug and Play extension or something similar (according to MSINFO). So maybe it also has to do with the hardware issue because I canceled out of the New Hardware Found stuff. But it never happened with this setup until after I imported the reg keys - weird, can't see what that would have to do with anything.

I am thinking of doing another scandisk. I assume scandisk.ini is only for scandisk - not scandiskw.exe? The directions seem a little confusing - refers to "Windows 95 (not Windows 98) and talks about MS-DOS Prompt and "single application mode". So - scandisk runs from Windows 98 command prompt ? or from boot into Command Prompt mode (F8 startup menu mode)? or either?

Generally I am pleased to be gaining ground although I may still have some issues.



Scandisk and Scandskw are both only really intended for finding bad areas of the filing system, problems with file names, wronglly reported drive capacities, etc.  Running either should also rebuild the Master Boot Record and the File Allocation Table.  They aren't really going to fix up any problems relating to the registry.

Scandskw.exe runs in Windows mode, even though it is still only a 16-bit executable.  It's really just a throwback to the 16-bit Windows 3.1 or the first Win95 that just ran executables on top of DOS that showed graphic user interfaces rather than being purely command line.  References to Windows 95 are very common with a lot of Windows 98 executables, because they were just continued on unchanged, or with very minor alterations in functionality.

Scandisk.exe is intended ONLY for Full DOS mode.  Try executing it from Within Windows, and it will just call scandskw.exe instead.  To my knowledge, BOTH versions use the settings in scandisk.ini unless the default settings are overridden from the command prompt when running scandisk.exe.

I think the scenario is now getting a bit confusing as you import sections of the registry back and forward between different systems.  The "Shell Copy Hook" *.reg file that I provided was really intended just to be merged to the registry of the problem computer to see if it fixed the disfunctional "Copy" actions.  Of course, if the other stable computer's registry contained exactly the same settings for these keys, then importing that from the good PC to the problem one would have done just the same thing.

It sounds as though, after cancelling out of the "found new hardware" wizard, the problem computer has re-enumerated its hardware database and may not now be loading and using the chipset drivers, etc.

I would be inclined to try and force redetection of the hardware and install the required drivers when prompted to do so.  You might be able to force redetection by using the "refresh" button from Device Manager, but other than that you would probably have to try deleting listed devices from Device Manager in Safe Mode, and then rebooting.

This carries risks, and you could end up with a system that doesn't boot at all.

Your best option by far is to do a dirty reinstall of Windows back to the C:\Windows folder and hope that it repairs the problems.  You can use a couple of switches with the setup command to force it into ignoring the existence of Windows Configuration Files.

Examples of possible options shown here:

/d - bypasses using existing Windows configuration (such as your current Win.ini and System.ini files).

I would probably run the reinstallation using the following switches:

setup /d /m /id /ie /im /iv /IW

or, to ignore the registry check:

setup /d /m /id /ie /ih /im /iv /IW

These options will make the setup process run a lot faster, and without all those billboards.  Yoy would, of course, have to reinstall IE6, DirectX (if you had a version more recent than 6 installed), MS Office, and perhaps some other applications that may have previously updated system files to more recent versions.



yes I am familiar with the difference between scandisk and scanreg. I thought it might be worh a try to see if the problem has anything to do with any damaged files. One of the first things I did was check the scandisk.log which had a lot of errors (this was a while back, couple weeks ago maybe). The log was old and appended, very large. I searched for all .exe, .com, .dll, .drv,
.sys, .vxd, .386, etc. files, checked them manually against a fresh install - that's how I found my first problem - user32.dll was the wrong size, at that point I couldn't even boot into safe mode, after replacing user32.dll I could boot. I also found corrupt iedkcs32.dll, mstask.dll, voltrack.vxd and replaced them with versions of the same date stamp because the version could not be determined (all the corrupted files had no property tab so no version info available).

Yes, I am thinking of doing an overlay re-install, I will probably test it by moving the disk from the good pc (which has the same \Windows folder, red and .ini files) over to the bad pc and see what happens. That way I don't have to worry about hardware/chipset/New Hardware found variables. Plus if it blows up the "good pc" it's OK, it's just a test pc/disk anyway.

Setup question: I don't see anything in the article about id or IW - what do they do?

thanks for the info



I have moved the disk from the good pc to the bad pc. The good disk has the \Windows folder and reg/ini from the bad pc, hardware issues should not be a problem with this setup.

I am going to try to re-install/overlay WIndows 98 1st Ed. into the original windows folder.

Do you recommend-

running Windows setup from Windows normal boot (such as Start > Run > Q:\setup.exe)
or running it from DOS ( I have a Windows 98 StartUp Disk floppy and also a Windows 98 Setup floppy).
As I recall - I don't think I can boot to the WIndows 98 CD on this pc
I seem to recall having done it either way, can't remember if it makes any difference.


I would just do what I do, and that's boot to a Win98se boot floppy with CD-Rom support, and run setup from the win98 folder of the CD.  My feeling has always been that a dirty reinstall is usually done to rectify a problem, and if done from within Windows then it may not be able to replace wrong/bad files while they may be in use by Windows.

The following download, when executed in a Windows environment, creates a replica of the Win98se boot floppy:

Good luck.  I hope it works.



I did the overlay install to c:\windows

My understanding of an overlay install -
1. If a folder or file does not exist it will be created/copied
2. If a reg key/value does not exist it will be created
3. If a file exists it will be replaced if it is older than the install copy, left alone if it is newer than the install copy
4. If a reg key/value exists it will left alone

I think it is supposed to work the same as an "upgrade" install

Is this your understanding ?

so far no illegal operations to copy a file or folder, r-click or edit-copy



Hi George.  Glad the dirty reinstall seems so far to have patched up whatever the problem was.

I agree in general with your understanding of what happens during such a reinstall, but there are a number of examples that I can think of where such a reinstall doesn't behave as expected as you detailed in points 3 and 4.

One example is DirectX.  Windows 98 installs version 6.  If, after having upgraded to version 8.1 or 9, you then do a reinstall, it bumps it back to version 6 again.  Clearly it is preset to always overwrite newer file versions with older ones, which is the opposite of the anticipated result.

Registry values that formerly disabled Task Scheduler will always be overwritten with the default behaviour of loading Task Scheduler at startup.

There are quite a few other examples, but ones that I would have to inspect my notes to check up on.  A good indication of exactly what was done during the reinstallation will be found in C:\SetupLog.txt.

Remember that during the initial stages of the Windows 98 installation (and reinstallation), well in excess of 300 .INF files are unpacked from the .CAB files in the Win98 CD's "win98" folder.  These are unpacked to a temporary folder, and are used as the basis for installing all the Windows components.  Extract them to their own folder from the CD and have a look through some of them to get some idea of how the individual windows components are installed and configured:

extract /A X:\win98\BASE4.CAB *.inf /L  c:\windows\temp\infs
extract /A X:\win98\precopy2.cab *.inf /L c:\windows\desktop\infs\precopy

From precopy2.cab, you will find a couple of the most important files that are used during the Win98 setup, namely copy, copy1, and copy2.INF
layout, layout1, and layout2.INF
setupc, setuppp, and subase.INF

Some setup scripts have a qualifier that tells them what to do if a file of the same name is encountered when it gets to the file copy stage.  This may be to always copy the older version and overwrite the existing newer one, or to only copy if the file being copied is newer.  These instructions, as far as I can determine, override the Version Conflict Manager which normally prompts you for a decision.

Actually, you may find it interseting to see what files have been backed up by the Version Conflict Manager.
Start > Run > and type VCMUI > click OK.





thanks for lots of helpful info. Of course with MS Windows there's always more than what meets the eye...

it did appear to overwrite my NIC .inf and .sys driver files, reverted to an older version. I just re-installed it using the previous .inf and other files stored on \backup\Windows from the pre-upgrade install.

I could not get my NICs (have two pci nics) to ping no matter what - un-installed, re-installed the NICs, even all the network components in Network Properties plus windows setup components (DUN, VPN, etc.) - link light but no pings!

after I removed all networking components I blue-screened on reboot - "vsdata95.vxd such and such etc."
I disabled it in HKLM\Services\CCS\VXD\VSDATA - renamed the value to a dummy file, rebooted OK, now my NIC's work! vsdata95.vxd is a ZoneAlarm file, maybe it didn't like the network being completely removed! ( I had previously removed ZoneAlarm components from the Startup folder and reg HKLM\Run so I thought it was already disabled!)

Network is good so I re-enable vsdata95.vsxd, reboot - now NIC's not working again! - obviously vsdata95.vxd is messing me up so I will leave it disabled for now.

IE6 also seems to be working OK (survived the re-install hopefully!)

So far no errors with copy/faste operations


Hi George.
It would seem that the vxd problem is just one of the common small problems you often get when doing a dirty reinstall:


Personally, I would do the following (links shown after) - always reboot after each update:

1. Install the Windows Installer version 2 (Win98 installs version 1)
2. Install Visual Basic Runtime version 6 SP6 (Win98 installs VB Runtimes version 5)
3. Install the Windows Common Controls update version 6.0
4. Install the Win98 Libraries Update
5. Install IE6 SP1 (see notes down the page for getting the full installation package)
6. Install DirectX version 8.1
7. Install DUN 1.4 (Win98 installs version 1.3 and there's some improvements with 1.4)
8. Install the FDISK update and then create a fresh boot floppy the usual way
9. Install Microsoft Java Virtual Machine Build 5.00.3810
10. Install Sun Java Virtual Machine Runtime Environment and configure it as the default Virtual Machine
11. Lastly, run Windows Update and then toggle it off with the .REG file given below.

Windows Installer Redistributable version 2.0

Visual Basic Runtime Version 6 SP6

Windows VB Common Controls version 6.0 for Win98 and later:
(updates Comctl32.ocx to and Mscomctl.ocx to

Windows 98 Libraries Update:

Windows Script 5.6 for Windows 98, ME, and NT 4.0 (installs VBScript Version 5.6, JScript Version 5.6, Windows Script Components, Windows Script Host 5.6, and Windows Script Runtime Version 5.6).

Win98 FDISK Update:
(fixes problem with capacities being wrongly reported in drives 63GB and over)

Dialup Networking version 1.4 for Win98:

DirectX 8.1 for Windows 98 and Me:

In my opinion, version 8.1 was the last completely stable version for Win98.  I have used version 9c on some of my Win98SE machines without any ill effect, but you can never be too sure - especially as DirectX is not uninstallable.


How to download IE6 SP1 and SAVE setup files rather than allowing it to update over the internet:
(In the last screenshot, I recommend ticking boxes for ALL operating systems).

Microsoft Java Virtual Machine Build 5.00.3810 for Windows NT 4.0, 95, 98/98se, ME, 2000, XP

Sun Java Virtual Machine Runtime Environment Version 5.0 Update 6:
(choose the Windows "Offline Installation" option)

(link starts download of jre-1_5_0_06-windows-i586-p.exe)

Test it here: http://www.java.com/en/download/help/testvm.xml

If you prefer to pick and choose your Windows Updates, then go here:

Also, if you have access to a Windows ME CD, extract DEFRAG.EXE from it using SFC.EXE and you will have a fully compatible and much faster defrag program.

Reg files to toggle Windows Update on and off as required.  Doesn't need reboot, but needs IE to be closed and reopened:

; Disable Windows Update


; Enable Windows Update


While you are at it, download and store away the "Winsock Fix" utility program.  I've used this to fix dialup problems quite a few times:

Another version here which also supports XP:

Hint: If you run Windows Update, DON'T close IE or reboot when prompted after it finishes.
Instead, open your Temporary Internet Files folder and copy out all the cached .exe files to a neutral folder.
Then close IE, disconnect, and reboot.
Find the file "Windows Update.log" and you have a good list that contains many of the URL's from which it downloaded the files you copied out.  From that, you can rename the files appropriately to reflect the nature of the update, and burn them to CD for later manual reinstallation.

Hope this is useful.




thanks for all the great ideas and links. This is why it is called "EXPERTS EXCHANGE". An Expert has specific ideas about the problems and suggestions for fixing it. Maybe some people are just trying to grab some quick points or maybe they just don't know very much. The usual responses are "install every possible MS update/hotfix/service pack, every IE and Office update, update all drivers, etc. If that don't work try a overlay re-install. If that don't work then FDISK and re-install everything - all OS, apps, drivers, settings, etc." Too bad MS has developed an OS that is difficult to install, difficult to configure, insecure, difficult to update (without breaking more than you fix), impossible to document, almost impossible to backup/restore/repair, etc.

thanks for intelligent responses

your opinion?
you think defrag is a good idea? recent benchmarks that I have seen showed very minimal actual performance gain from defrags even on badly fragmented systems, some even slowed down after the defrag!
just interested in your opinion
you like Diskkepper or not?


You're welcome, George.  Passing on tips that I have discovered doesn't cost me anything, and it's good to share information.

I'm afraid that the only 3rd-party defrag progarm i have ever tried was VOPT Quick Disk Defrag.  That was a while ago now and, although they may have sorted out some problems, it played havoc with my Win98se system from the moment i installed it.  I have a copy of DiskKeeper Lite somewhere on one of my partitions, and keep meaning to try it out, but have never got around to it.

Generally I'm not a huge fan of utilities designed to make everything "easier" or put them all in one place, but I use a utility called "ScanDefrag" to initialise defrag.  Basically all this does is allow you to preconfigure MSCONFIG so that it disables processes likely to interfere with defrag, reboots the system, and runs defrag in minimal view mode.  I sometimes used to forget to disable background processes first, and remembered when defrag was interrupted half way through.  I think that is worse for your drive than not running defrag at all, but I would accept contradiction on that point.

I run defrag about once a month, and I find that it noticeably improves performance.  I usually have the contents of quite a few CD's worth of data stored while I am working on projects, and that must leave gaping holes when I delete all the data and start another project.  So it's an ongoing process for me, and I would say that my system is moderately defragmented most of the time in between defrags.  The Windows ME Defrag.exe is definitely faster at doing its job, and compatibility in Win98/98se is not a problem.

The reason I suggest using SFC to extract defrag.exe from the Windows ME CD is that this updates the database of installed system files so that SFC doesn't detect it as a changed or modified file the next SFC is run.

There is an "Unofficial" Windows 98 SECOND Edition update package available for download which I have tried on a few Win98se systems.  It incorporates just about all of the critical updates and the cumulative ones, and also adds quite a few Windows ME file versions eg. the USB support files, defrag, etc.  Unfortunately you have the First Edition, or perhaps you could have tried it the next time you formatted for a fewsh install.


"fewsh install" !! shuld have been "fresh install".  Thick fingers :-)



I am going to close the question. Thanks everyone for many quick and accurate responses and many useful resources. I still have a few secondary problems but the system is basically functional.
I have increased the points from 250 to 500
BillDL - many good responses with detailed explanations including some secondary questions, many good resources 250 PTS
LeeTutor - first quickest helpful response 100 PTS
paraghs - also early helpful response plus some good resources 100 PTS
sunilcomputer - good response and good resources 100 PTS




correction - total points must be 500, points for BillDL should be 200 instead of 250.

Top Expert 2009

Thanks, George.  Glad we could be of help...
paraghsDy General Manager

Many a thanks, George.
Glad to help :)

Thank you, George.

I'm still smiling at your overview of Microsoft Windows:
>>> "Too bad MS has developed an OS that is difficult to install, difficult to configure, insecure, difficult to update (without breaking more than you fix), impossible to document, almost impossible to backup/restore/repair, etc". <<<

It's not really that bad ... once you've reinstalled and reconfigured it about 1,000 times :-)

Have you tried Linux yet?
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.