bobkberg |
Thanks for the followup - this afternoon I plan to wipe the drive.
However, I’m also REALLY hoping to learn something concrete from this.
As for taking a lot of time, I agree - In terms of per-hour rate for this job, I’m probably below minimum wage right now.
BUT - tackling bizarre and/or difficult problems is one of my joys in life - that’s the only way I learn things.
Bob
amitrajit |
I think most of these system files that are reappearing come bundled with Win 98 so if you uninstall only the programs and then reinstall Win98 you get back all the old stuff. You have to format the HDD and do a fresh custom install of the OS. MAke a backup of only the data required and not of the whole system because that will save the old config files, registry settings etc.
cookie20 |
From my personal experience
If it is a major problem with win98 that you believe re installation is the only solution than copy the data you need to save and start new instalation with:
fdisk /mbr to clear mbr, just in case…
fdisf - to delete all partitions and create new ones…
format…
if re installation is an option it might save a lot of time !in some cases!
PeterMac |
As I think that your best option is to wipe, and reload from scratch the following is only for thinking about.
Regards Reinstall, did you do this from standard Win98 install disk, or from a System Restore, or OEM Install Disk. Either of latter may have specific drivers, and other software bundled with them, to fit in with original hardware configuration.
Regards Old Driver removal, Did you simply uninstall drivers, or delete drivers etc. Win98 will remember old hardware, and simply re-install the drivers, unless you also remove devices from Hardware Manager.
bobkberg |
Thanks for all the responses.
I’m definitely dealing with some sort of persistent virus here. One of its signs is the creation of (literally) thousands of zero length files with names like apinn32.dll.
Additionally, there are hundreds of copies of files with names like appnzi.exe. (size 66 KB) in the Windows, Windowssystem and Windowssystem32 directories. After wiping all of them, they were restored on one reboot.
I’m going to try the fdisk /mbr this afternoon. I was also talking with friend who got something similar - it was an infected MBR, so reformatting had no effect. This may NOT be the same as the one I’ve got, but he noted in his case that Norton failed to notice it. However, PC-cillin did find it for him. I’m usually a Norton user, so I stopped by the store last night and bought a copy of PC-cillin. We’ll see what happens….
Bob
ItDefPat1 |
I restate that a multiple anti vrus & spy should be done. I would start with av+as even again after wipe and reinstll OS. two security lessones: you can never be too safe; 2- it always gets worse.
Smitch |
If you haven’t removed “system.dat” and “user.dat” you will “import” items from the old registry in Win98. These reside in the c:windows directory. If for some reason (data retrieval?!?) you don’t want to or can’t scrub the drive:
Boot into a command prompt mode
CD to c:windows
enter at c:>
“attrib -s -h -r system.dat”
“attrib -s -h -r user.dat”
“del system.dat”
“del user.dat”
Leaving out the “’s (this will eliminate the old active registry. You can also del any system.bak or user.bak files)
Proceed with your O/S reload, you will have a virgin registry afterwards.
*******
P.S. If you just want a clean registry without reloading the O/S you can recover the original Win98 registry by(after eliminating the system and user.dat files)entering at the command prompt:
“attrib -s -h -r c:system.1st”
“copy c:system.1st c:windowssystem.dat”
“attrib +s +h +r c:system.1st”
gl
bobkberg |
Thanks for all your help everyone.
Much as I hate to go there, in this case, I did a complete low-level format of the entire disk - and then verified the cleanliness of the MBR with a free tool I just discovered (on download.com) called MBRtool. Then I did a complete re-install from the original HP CD’s (which the owner originally thought he had lost).
Next step was to do a file extraction from the ghost image onto a clean machine - and then clean those up with Norton.
It seems to be working just fine now.
Thanks again all.
Bob
Tech support, Help Desk, Hardware, Desktops, Windows 95/98, Windows client administration and maintenance, Installation
Once again, here I am on the outskirts of reason with problem.
0
