need some help with virus -ed PC

  • Thread starter Thread starter Daf
  • Start date Start date
D

Daf

Hi all!
Need a little help. A friend brought me his Win98 box and said he opened
some attachments "or something" and now his PC will boot up until the end
of the post. Then there is a c prompt.

He has no idea which virus it might be ... so neither do I.
I'm inclined to simply reformat and start over. He would like to save a lot
of music he has downloaded.

Does anyone have any advice as to the next step? I'm able to navigate the
drive from the c prompt but that's it.
I tried to install windows again, over itself, to maybe "repair" the OS but
it wouldn't let me saying that "Windows can't be upgraded from this
disk"...

Thanks
Daf
 
Daf said:
Hi all!
Need a little help. A friend brought me his Win98 box and said he opened
some attachments "or something" and now his PC will boot up until the end
of the post. Then there is a c prompt.

He has no idea which virus it might be ... so neither do I.
I'm inclined to simply reformat and start over. He would like to save a lot
of music he has downloaded.

Does anyone have any advice as to the next step? I'm able to navigate the
drive from the c prompt but that's it.
I tried to install windows again, over itself, to maybe "repair" the OS but
it wouldn't let me saying that "Windows can't be upgraded from this
disk"...

Thanks
Daf
Click to expand...

Can you start Windows from the C: prompt by typing c:\windows\win ? Might
there be an error message before the C prompt?

Go to a virus free machine and make a anti-virus boot disk or CD.
Best if you have a AV boot CD from Symantec, McAfee, Trend-PC.
Boot off the floppy or CD and run the virus scan.
For any worms or virii found that can not be removed you can download
a remover from AV vendor sites.
After the scans complete CLEAN try to reboot to W98 safe mode.
If you're still at the C: prompt get a clean W98 CD and run "sys C:"
Then compare config.sys to config.bak, autoexec.bat to autoexec.bak or
*.old, *.dos.
You're looking for himem.sys statement in config.sys, Win and a
path=c:\windows statement in Autoexec.bat.
Still no Win boot try to run Setup from the W98 CD.
 
Daf said:
Hi all!
Need a little help. A friend brought me his Win98 box and said he opened
some attachments "or something" and now his PC will boot up until the end
of the post. Then there is a c prompt.

He has no idea which virus it might be ... so neither do I.
I'm inclined to simply reformat and start over. He would like to save a lot
of music he has downloaded.

Does anyone have any advice as to the next step? I'm able to navigate the
drive from the c prompt but that's it.
I tried to install windows again, over itself, to maybe "repair" the OS but
it wouldn't let me saying that "Windows can't be upgraded from this
disk"...

Thanks
Daf
Click to expand...

Does he have some kind of anti-virus installed? If so, maybe he has a
recovery disk that he created.(but anyone that would open an attachment from
a stranger probably doesn't use anti-virus programs!) I would just reformat
& get rid of everything. Why try and save something that might be infected
with a virus?
 
Daf said:
Hi all!
Need a little help. A friend brought me his Win98 box and said he opened
some attachments "or something" and now his PC will boot up until the end
of the post. Then there is a c prompt.

He has no idea which virus it might be ... so neither do I.
I'm inclined to simply reformat and start over. He would like to save a lot
of music he has downloaded.
Click to expand...

Before reformatting, try a bootable anti-virus CD, such as this one:
http://centralcommand.com/downloads.html

-WD
 
Daf said:
"Can you start Windows from the C: prompt by typing c:\windows\win ?
Might there be an error message before the C prompt?"

Almost... ;^)
I got this message:
VFAT Device Initiation Failed
A device or resource required by vfat is not present or is unavailable.
VFAT cannot continue loading.

System halted.

I'm working on downloading the bootable CD suggested by Will.

Thanks!
Daf
Click to expand...
Bootable AV floppy works well for older more common viruses. You can dl a
floppy scan from Symantec I think.

Since I doubt he has Linux or a CardReader installed here's a link to MS KB
http://support.microsoft.com/default.aspx?scid=kb;en-us;139063.
It talks about a missing ifshelp.sys in config.sys, ie,
DEVICE=C:\Windows\Ifshlp.sys Ifshelp.sys was required for file sharing or
maybe compressed files in W9x.

Also, another possible cause is paths statement in MSDOS.SYS
Restart your computer, press and hold down CTRL after your computer
completes the Power On Self Test (POST), and then choose the Safe Mode
Command Prompt Only option from the Startup menu.

Type the following command at a command prompt:
attrib -s -h -r msdos.sys

Use a text editor (such as Edit.com) to open the Msdos.sys file.

Verify that the following lines in the Msdos.sys file are correct [Paths]
WinDir=Windows WinBootDir=Windows HostWinBootDrv=C where Windows is the
folder that contains Windows. Note that if you are using disk compression
software, you must change the drive letter in the HostWinBootDrv= line to
the drive letter of the host drive.

Save and then close the Msdos.sys file.

Type the following line at a command prompt:
attrib +s +h +r msdos.sys

Restart your computer.
 
Daf said:
"Can you start Windows from the C: prompt by typing c:\windows\win ?
Might there be an error message before the C prompt?"

Almost... ;^)
I got this message:
VFAT Device Initiation Failed
A device or resource required by vfat is not present or is unavailable.
VFAT cannot continue loading.

System halted.
Click to expand...

If all you want to save is the music files, I'd be tempted to pull the
hard drive out of the machine and install it as a slave on another
machine and then copy off the files or burn them to CD. You can't
transfer a virus in this way unless you actually execute any programs
stored on the infected disk.

Then stick the disk back in the original machine and install Windows
from scratch, formatting the whole disk in the process.
 
Daf said:
Hi all!
Need a little help. A friend brought me his Win98 box and said he opened
some attachments "or something" and now his PC will boot up until the end
of the post. Then there is a c prompt.
Click to expand...

I don't think it's a virus. Many people claim a virus is the cause of
any and every PC problem. Try starting windows from the C prompt. If
that works, you need to check Autoexec.bat and MSDOS.sys (check that
BootGUI=1)
 
I don't think it's a virus. Many people claim a virus is the cause of
any and every PC problem. Try starting windows from the C prompt. If
that works, you need to check Autoexec.bat and MSDOS.sys (check that
BootGUI=1)
Click to expand...

You're right- a scan with rescue disks showed no virus.

I can tell you this - from looking at fdisk - that hard drive is at
capacity!

Now when I try the windows\win ? command it says that himem.sys is
missing. Yet if I look around in there (through the c prompt) I can see
it's there...

I'll try the suggestions above and see what happens.

Thanks
Daf
 
Daf said:
You're right- a scan with rescue disks showed no virus.

I can tell you this - from looking at fdisk - that hard drive is at
capacity!

Now when I try the windows\win ? command it says that himem.sys is
missing. Yet if I look around in there (through the c prompt) I can see
it's there...

I'll try the suggestions above and see what happens.

Thanks
Daf
Click to expand...

If the drive is truly at capacity you won't be able to load Win for lack of
swap disk space. Delete temp files, windows\temp files, copy music files to
CD, etc., etc. Himem.sys didn't load because of what error message?
 
Back
Top