Windows 98 SE problem - Blue screen and Bad Cluster

[Hull_guy]

Hi, my computer uses Windows 98, currently whenever I switch it on I get a blue screen saying that the computer was not shut down properly and is scanning drive c for errors.

This then goes onto another blue screen that scans different clusters of my computer. When going through this scan i get a message telling me I have a bad cluster that the computer is unable to fix and to make a back up of my files. This comes on everytime I use my machine even when it seems to be shutting down okay.

By cancelling this scan I am able to use my computer fine I'm just a bit worried that all is not as it should be. Any advice as to what the problem is and how I can solve it.

Thanks

 

[WhitPhil]

Run a Scandisk/Thorough (surface) on the drive. This "should" reset these bits that think you had a bad shutdown.

If it doesn't, please post back the Exact messages you are getting.

Tx

 

[Hull_guy]

Thanks for the reply. I ran a full surface scan last night, it took around 3 and a bit hours, and came up with 1 bad unused cluster. I cant remember the exact message but basically it asked me if it should fix this bad cluster, however when I clicked yes it then said it was unable to fix the problem as the required files were in use. Shall I run the scan again and post back exactly what it said?

My computer has today started reguarly freezing completely and I'm having to unplug it and start again about every hour or so.

 

[VirtualMe]

Try running scan disk in DOS or Safe Mode.

http://www.pcdon.com/page82.html

(B) DOS
1 - Run ScanDisk in DOS by going to Start, Shut Down, Restart in DOS. At the
C:\Windows prompt, type SCANDISK and press Enter. Six items will be displayed to
be checked. The first five will be checked automatically, and you'll be told about the
disposition of any errors that might have been found.
2 - Finally, you'll be asked if you want to run the sixth item, Surface Scan. This one can take
a long time, so I usually do it when I expect to be away from the PC for a few hours.
3 - When finished running ScanDisk in DOS, type EXIT and press Enterr to return to Windows.

(C) Safe Mode
1 - Go to Start, Shut Down and click Restart. When the PC begins to restart, hold down
your Esc* key while the rebooting takes place. This will put your PC into "Safe Mode,"
whereby it bypasses a number of different "Start" options, such as printer and scanner
drivers, which may be running in the background and interfering with running ScanDisk
or Defrag.
2 - After running ScanDisk and Defrag in Safe Mode, go to Start, Shut Down and turn
your PC off. Turn it back on again and it should reboot into the regular Windows mode.
Occasionally it may take two or three shutdowns to get back to Windows.

*On some computers the F8 key is used instead of the Esc key.

Also, is the harddrive making any load or funny noises?
If so backup anything you don't want to lose.


Have you tried an online virus scan?

http://housecall.trendmicro.com/

http://www.pandasoftware.com/activescan/

http://www.ravantivirus.com/scan/

http://www3.ca.com/virusinfo/virusscan.aspx

 

[Hull_guy]

I've tried a couple of times in safe mode and dos to run the surface scan, however my computer is now crashing every 30 minutes or so and just switches off half way through. I've managed to do a couple of online virus scans and both say that I'm infected with JS Kak worm and that it can't be cleaned. My computer is making the strange noises and I have made a back up of individual documents I want to keep.

What should I do now!!!!!!!!!!

 

[yuval]

Bloody thing!
I hate viruses!

Do you have any anti-virus installed?
(If not, get AVG for free from www.grisoft.com)

I'd suggest try scanning in DOS mode, it's a longshot but some viruses are only loaded with Windows. If it'll find it it'll may not be able to clean it but it'll delete it either way.
Then you'll have to cross your fingers and hope it is gone.

I once had to reformat my PCto get it cleaned and lost loads of data.
Also, if making backups make sure you check them for viruses before you'll copy them to the formatted HD.

 

[VirtualMe]

You can try the instructions in this Symantec Article.

http://securityresponse.symantec.com/avcenter/venc/data/wscript.kakworm.html

 

[Hull_guy]

I've downloaded the microsoft patch for kakworm and also followed the manual instructions for removal just in case, and there appears to be no sign of it on my computer. After this removal however I've run two of the suggested online virus scans, and my own AVG antivirus on my computer. Both are still saying that JS/kakworm is present on my computer.

Also I'm still unable to use scandisk either in safe or dos mode. In safe mode I got a message saying scan disk had tried ten times and was unable to run. In dos the scan ran through the first 5 option okay, but about half way through the surface scan I got the following,

Scandisk encountered an error while reading clusterZ, allow scandisk to do a surface scan of this error

I allowed it to do this and then got the following message

Scandisk is gathering information it needs to safeguard the contents of drive C during surface scan

At this point my computer just locked up and nothing happened.

Any more suggestions folks?

 

[VirtualMe]

Where does it say the JS/kakworm is located on your computer?

Also if you've not done it yet, run Ad-aware 6, and Spybot Search & Destroy.

Then post a Hijack This log.


1. Download Adaware 6 Build 181

Install the program and launch it.

Look at the bottom right corner and click on "Check for updates now" and download the latest reference files.

Make sure the following settings are applied. (When applied the button will turn "GREEN".

From main window :Click "Start" then "Activate in-depth scan (recommended)"

Click "Use custom scanning options"

then click "Customize" and select these options under "Drives and Folders"

put a check by "Scan within archives"below that,

put a check by all of the options you see under "Memory and Registry".

Now click on the "Tweak" button in that same window.

Under "Scanning engine"

select "Unload recognized processes during scanning"

under "Cleaning Engine" select "Let windows remove files in use at next reboot"


Click "Proceed" to save your settings.

Now to scan just click the "Next" button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose "select all" from the drop down menu and click "Next")

Restart your computer.



2. Download Spybot Search & Destroy from here.

Install the program and launch it.

Before scanning press "Online" and "Search for Updates" .

Put a check mark by all the updates and click "Download Updates".

Click "Check for Problems" and when the scan is finished let Spybot fix/remove all it finds marked in RED.

Restart your computer.



3. Download Hijack This

Unzip it into a permenant folder. Do not leave it in or put it in a TEMP folder, as this will not let it make backups in case something goes wrong.

Then click HijackThis.exe

Click Scan

The Scan Button changes to a Save Log button.

Click the Save Log button to create a file named Hijackthis.log.

A dialog box will pop up. Use it to select the location where you will save the log. (I save mine to desktop so it is easy to find)

Close the program.

Open the Log in Notepad.

Highlight the entire contents.

Copy and paste the contents of the HijackThis log into your post.

[size=+1]Wait for help! DO NOT FIX ANYTHING WITHOUT SOMEONE HELPING![/size]

 

[Hull_guy]

Firstly the kakworm know seems to have gone. I just did two online scans again and both came up clean. However my computer is in dire straits still.

I've tried a couple more times to run the scandisk in safemode. Its keeps freezing up though. Worringly it is now finding bad clusters all over the place. Originally I just had 1, the last scan picked up 5 before it stopped working.
I had already run adaware and spybot, but just in case have just done both again. Here is my latest hijack this log,

Logfile of HijackThis v1.97.7
Scan saved at 17:04:04, on 15/04/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\HPZTSB05.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\D-LINK AIRPLUS\AIRPLUS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb05.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autocheck
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: D-Link AirPlus.lnk = C:\Program Files\D-Link AirPlus\AirPlus.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .m1v: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38001.1968518519
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

 

[WhitPhil]

Finding more bad sectors on each run is a good symptom of a failing drive.

Start backing up critical data ASAP.

 

[Triple6]

WhitPhil is right on, bad sectors = drive failure.

To be absolutely sure you can run the hard drive's manufacturer's diagnostics on the drive. On bootup it should mention the drives manufacturer and it should also be marked on the drive itself. The diagnostics usually run from a bootable floppy disk that will be made by executing the program you download to your hard drive. Common manufactures are Maxtor, IBM/Hitachi, Seagate, Western Digital, Samsung, Fujitsu. Backup any critical data first.

 

[Hull_guy]

Hi guys, thanks for your on going help. I confess to knowing very little about computers and so your last post went a little over my head Triple 6 especially the bit about diagnostics. The drivers manufacturer is samsung, however I have no floppy disk, the computer was built for me by someone else who I have no way of getting hold off (he is back packing round the world) I have already made a back up of most of my files, is it possible to save larger files on floppy disks as a number of my files are to large for the disks I have?

Would it be possible for someone to talk me through exactly what I need to do to my computer to get it working okay again, whether that be reinstalling the diagnostics or even if it means completely starting again as currently it is next to useless anyway. The only thing I have is a windows 98 se installation disk.

 

[Triple6]

No, the floppy disk is something you have to make using the diagnostics you download from Samsung. If the diagnostics cannot fix the drive then you will need to buy a new hard drive and use a utility to copy the contents of your old drive to the new drive or completely reinstall windows on the new hard drive.

Here's a link to one of the Utilities: http://www.samsung.com/Products/HardDiskDrive/utilities/hutil.htm
if your drive is not listed as one of the supported you can use Shdiag from that site.