Windows 32 startup problems

[Dta]

Hello. I am having problems starting up windows 98 in normal mode. When the computer boots up, it runs through the memory test and then goes to the windows startup page (just the screen saying "windows 98" before it takes you to the desktop), at which point it seems to stop. I am able to start up in safe mode though. I believe it may be due to some spyware/malware as my friend had a similar problem before. However, I don't have any spyware removal programs on my computer. I copied Adaware and Spybot S&D to a cd to try install, unfortunately (as you well know) I can't access the cd rom drive in Safe mode. So I can't check for spyware in safemode but I can't get into normal mode to check either. Any ideas on how to start up in normal mode? Thank you.
By the way, it's a different computer that doesn't have internet access (only used for Microsoft office & digital photos) so I can't use Hijack This.

Cheers!

[Paul Komski]

After booting to Safe Mode - you could try and run msconfig from the run box and use it to turn off all the configured startup programs there - and then reboot. This wont prevent everything running at startup but it will cut the list down to size.

To get the anti-malware files onto the system, first copy them onto a CDROM but then boot to a Win98 startup floppy diskette and use "With CDROM support". You can then copy the files from the CD to the HDD so they are there when you next boot to Safe Mode.

You should be able to run HJT without internet access and then copy the results to a floppy diskette and post them here using the PC you are using now.

[Dta]

Disabling the startup programs in msconfig (in safemode) didn't allow the computer to start in normal mode. As for your suggestion of getting the anti-malware files on the computer, unfortunately I don't have a Win98 startup diskette. My dad is currently trying to save HJT to a floppy so he can install it onto the system. Until then, any other ideas?
Thanks again.

[PrntRhd]

dta,
You can download a 98 boot diskette file here:
http://freepctech.com/pc/002/files010.shtml

[rio_bugarin]

did you check in the device manager if you got any problems?

[Dta]

I did check the device manager Rio, and it didn't show any problems.

How do I go about using the bootup diskette specifically. First I download it and save to a floppy. Then I put the floppy disk and the cdrom with anti-spyware software into the problem computer and start it up, selecting the "With cdrom support". From this point, I'm not sure how to proceed.
Thanx

[Paul Komski]

In windows from safe mode create a folder in the C: drive called cdfiles

First boot to the floppy and choose with CDROM support. Try and note which drive letter is given to the CD drive. Commonly it will be the E: drive - but that is not a constant phenomenon.

Insert the CD and then enter E: at the command prompt. Then enter dir to give a list of the files and folders on the CD. This will confirm that you have found the files on the CD. If E is incorrect try F, G, H, and so on until you find the correct drive letter.

You can now copy the files from the CD to the cdfiles folder you created in the C: drive. You can copy them all at once by entering the following at a command prompt (using the correct letter for the CD in place of E as necessary):-
copy E:\*.* C:\cdfiles
or copy them one at a time eg:-
copy E:\myfile1.exe C:\cdfiles
copy E:\myfile2.txt C:\cdfiles
etc...

[Sylvander]

It would be easier to copy files from a CD-ROM whilst in "msconfig | Diagnostic Mode".
This is LIKE safe mode but with CD-drive access.
Much easier than working in DOS.

To check whether this is caused by a bad configuration change [assuming no new hardware has been connected and no new programs installed] you could boot to a command prompt [using a startup floppy or selected from the startup menu] and enter the command SCANREG /RESTORE. Then select one of the sets of configuration files [that Windows automatically makes a backup of at the first successful boot on each new day] made immediately before the problem was introduced.
If this IS a configuration problem it will disappear like magic, so it's worth a try.

If that doesn't work, what you need then is a backup of the C: partition made when all was well. If not, then Paul can help you eliminate the nasties.

[Dta]

I have the scan log for HJT, so hopefully you'll be able to see something that will at least allow the computer to start in normal mode. Failing that, I'll get my dad to try one of the suggested methods for copying from cd.

Logfile of HijackThis v1.98.2
Scan saved at 7:09:50 PM, on 2/16/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.ca/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KPF4] C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab


Thanx

[Dta]

Hello. I know this is a delayed response (unfortunately I my dad lives in a different city and I was unable to try fixes until now).
Sylvander, I was unable to start the computer in diagnostic mode. Like normal mode, it just stopped on the Windows98 startup page.
As for the bootup diskette Paul, that isn't working either. I used your link and saved the file to a floppy. However, when I tried to use it on the affected computer, the computer would not read the disk. I tried to open the disk in Safemode, but received a message saying the program was not compatible with Win32.
Any other ideas how to start the computer in normal/diagnostic mode or how to get the anti-malware onto the system?
Thanks again

[Sylvander]

You should make a separate thread for your HJT log in the security section and link it to this thread. But first try this:

Do you have a backup of the C: partition you can restore [made when the PC was working well]?
If not, and assuming you haven't changed your hardware, nor installed/uninstalled new programs since the problem appeared [or immediately prior], then:
To restore your last working configuration [Windows automatically makes a backup of the configuration files at the 1st successful boot of each new day], then:
Go to a DOS command prompt.

At the command prompt enter the command [B]SCANREG /RESTORE, and choose the last good configuration. That would be on 1st boot of the last day on which your PC successfully booted into Windows.
If this problem is caused by a bad change to the configuration, this may fix it; if not, then doing this will cause no harm, since all your configurations will be identical anyway.

If that doesn't work, try this:
http://support.microsoft.com/kb/188867/EN-US/

[Paleo Pete]

Scanreg may be the best idea yet, I've fixed a lot of configuration problems that way.

The Win98 start up disk you downloaded is a disk image, not the actual boot disk. You need to run it and it should make a win98 start up disk. Double click the file you downloaded while in Windows Explorer and it should open a command prompt window, have a blank floppy in the drive.

Scanreg can be run either from the Command Prompt Only option advised by Sylvander, or from a Win98 start up disk, you may have to switch to the Windows directory first. I've also run it from the Windows CD. That's a bit trickier...

You'll be working in DOS a lot so...

X: - canges to the drive you want. A, C and E will be floppy, hard drive and CD ROM respectively if you only have one partition and boot to a Wi98 Start Up Disk. A, C and D if you boot to Command Prompt Only.

CD_directory - Changes to the directory typed in italics here, an underscore was used to indicate the SPACE that must be there. Use the directory name, eg Windows in the command line. Caps and lower case can be used, DOS is not case sensitive.

DIR = Will list all files and folders in the current directory.

CD\ will go back to the root of C drive.

If scanreg will not run from the C:\> prompt, change to the Windows directory and try it. If it won't run, the scanreg.exe file may be gone or corrupted, it's in the Win98 directory of the Windows CD. Copy to C:\Windows or run it from there. copy_scanreg.exe_c:\windows will do it. Remember the spaces instead of underscores.

Boy, DOS is tedious...but it's rock solid and really not that difficult, not to mention very useful...

EDIT: Keep the HJT log here since it's a continuation of the same thread and problem. Normally we like them to go in Applications and Security, but in some cases they can stay in the original thread, like this one.