EMERGENCY: System Hosed!!

[ChromWolf]

I had done a web search for "elf pics" in order to locate a suitable avatar for a roleplaying character (I'm an avid gamer)... So, just to get things straight, I was NOT looking for porn (though I think that somehow, I was redirected to a porn site, which is how this all happened, ironically) :P :P :P

I run Win98SE, and my AV prog of choice is AVG (the free version). It caught several Trojan Horse install attempts (which I told it to "Heal", of my choices for "yes", "no", and "heal" in response to whether or not I wanted to allow the file to interact with the system), and found several things running in the background, which I tried as fast as I could to close. I knew that, even by going into MSCONFIG, they'd still likely come back (unless I scoured the Registry to look for RunOnce crap), so I went through and uninstalled anything that looked like it shouldn't be there (I had just gone through the list a few days ago to free up some desperately needed space). I uninstalled several items, which *seemed* to be removed; there were a couple that weren't, and I was going to try to remove them as well. However, one of them (I believe one of the ones that wouldn't uninstall at first, but would after removing a different component), which I believe was called something along the lines of "SideFace" or something like that, seems to have TOTALLY hosed the system!

I clicked uninstall, and that seemed to work--and then it TOTALLY cleaned out the entire Add/Remove Programs list! It was all empty!! All my icons (even for documents and the like in the "Recently Opened Documents" or whatever the section is called in the Start Menu) reverted to the icon Windows assigns when a shortcut is present, but you've deleted/uninstalled the program/file/whatever to which it pointed. I couldn't access anything (other than executable programs via "Start-->Run")--shortcuts on the desktop, start menu, or quick launch bar. The Close Program dialogue box only showed the programs I could see in the System Tray (AVG, HotSyng as I own a Palm handheld, possibly the driver for my Logitech mouse, and I think Rundll, as I like the ability to alter my moniter resolution with ease, and keep that function enabled). Anyway, getting back on track, I tried running "C:\WINDOWS\Explorer.exe", and nothing happened. I successfully opened MSCONFIG, but in the Startup Tab (where I moniter any programs starting up on system start), there were only like, 5 to 7 options! FAR fewer than there normally are, and it didn't include Explorer, like it should have.

In a panic, I restarted the system (in retrospect, I imagine that was a poor idea, but I as I couldn't open IE either, I figured there wasn't much else to try). It asked me for my Win98 Reg code, like it was the first time I had installed Windows!!! ....However, I did note that the fonts were all off... there were 4 or 5 different fonts, none of which were the normal ones for when Win98SE is installed for the first time... Anyway, I inputed the Reg Code (after at least being prudent enough to unplug the ethernet connection), but while my previous background would load (and the regular startup noise would play), it would say Explorer caused an IPF in module Explorer and would be shut down... entering the Close Program dialogue box showed nothing at all running in the background, and the system essentially halted (mouse movement worked, but beyond that and being able to access the Close Programs dialogue box, nothing else).

Somewhere in there, I decided to have a look at things from DOS. As far as DOS is concerned, all my files still seem to be there; I keep the documents I'm working on at the time on the Desktop, and C:\WINDOWS\Desktop checked out okay (other than having the MS-DOS filename structure, of course)... also, there *was* an Explorer.exe in the windows folder, and its access date wasn't today, so... ::shrugs:: I dunno. I did notice a couple files in I believe the Windows\System folder----EXDL.EXE and EXUL.EXE. They weren't dated today, but I seem to recall having seem EXDL amongst the list of files I saw running in the background before the first Restart (and system hose). I renamed both to (same filename).BAK, but restarting again didn't seem to help.

While my next guess would be to actually try and rename key Windows files (enough so that the computer thinks Windows has not been installed, and will reinstall those files) and do an over-install of windows, but I wasn't sure if that would help, or just hurt more---or if there wasn't something else I could do.

Also while in DOS, I came across a file called FRUNLOG.TXT, which had a time/date stamp exactly when the computer died. It seemed to have some pretty weird commands in it similar to registry entries, but I'm pretty sure Microsoft would never spell "Special" as "Spezial".... If I can manage it, and anyone thinks it's important, I can post the contents of that file here.

What in the world should I do? Is this situation salvagable, or is this a format/reinstall? ((Forgive me for having left out any vital information---I'm pretty upset about it right now, since it just happened not an hour ago... any helpful responses would be GREATLY appreciated...))

[DougL]

If you have a win98 bootable floppy you can boot to that. At the a: prompt change to the c: drive and type in scanreg/restore this will give you an option to restore a previous registry identifiable by the dates. If that works it will ask you to reboot, providing you get back into windows a full virus scan, adaware spybot etc seems the logical step. hope this helps

Doug

[glc]

Before I would restore a previous registry, I'd do a full virus scan with F-Prot for DOS. This can be done totally from floppies.

http://forum.pcmech.com/showthread.php?t=106077