Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 



Sign in to follow this  
technoid

Help, registry corruption 98SE

Recommended Posts

Hi folks, long time no see.  Today, one of my older 98se socket 7 boxes is acting up. At bootup, it keeps going into the blue-colored screen, Microsoft Registry Checker. It supposedly loads up a new registry and tells me to Restart. However, it doesn't work.  It will keep going into the Checker, then loading, then rebooting.  However, at the first times it acted up, it was able to load up a good registry and get me into the desktop normally, but now never more.   Going into Safe Mode at boot does not help either, it will still go to the Checker.  But I can go into either of the Command Prompts (98 Startup Menu).  The disk contents there seem ok and intact.  It has been at least 20 times since this has gone/looped through the Checker and reboots.
This all started last night.  I replaced the motherboard 3V coin battery and I changed out the AMD K6-II CPU to a K6-III CPU, at same frequency.  I would think changing the battery would have no issue, i.e. the BIOS kept losing its configuration. That problem solved.  So my only guess is the CPU changeout. 

Specs:

Abit AX5 Pentium motherboard (circa 1997-98).

AMD K6-III 450 (AHX) - Configured via SoftBios to 75mhz fsb at x2 = 450.   The K6-II 500 was setup exactly the same for years with no issues. Also, I/O at 3.3V, Core at 2.5V.

256MB memory (max)

2 hard drives

The only difference between the K6-II and III is that the III would not accept "System bios cacheable enabled" in bios, so I have that disabled. Otherwise it would hang at startup (the K6-II will work with it enabled).

Everything was working ok last night after the CPU replacement, but not today.  It has been awhile since I've tackled with Windows 98se registry issues, and I don't remember any of the tricks, so any help is appreciated.  Or how  far am I hosed with this?  I would like to save my desktop and not have to start over with a virgin registry.  :)

 

Share this post


Link to post
Share on other sites

Try going into the WINDOWS\SYSBCKUP Folder.

There are files named RB000.CAB, RB001.CAB etc. Rename or remove the ones that are dated after you changed things. DO not remove the oldest one. Let the Checker reload the Registry.

Share this post


Link to post
Share on other sites

Hi rloew,

Here are the cabs listed in \sysbckup (including bytes, date, time):

RBBAD.CAB        8829941        10-24-17    3:30P
RB000.CAB        2341188        10-24-17    1:22A
RB005.CAB        2341156        10-23-17    1:04P
RB003.CAB        2341154        10-21-17    5:28A
RB004.CAB        2341354        10-20-17    6:01P

Primary disk has 860 mb free left.

The PC has been on for several hours now (in command prompt mode) so I'm hoping it's not a stability/CPU issue... although I'm also hoping I did not mess up the drive a little bit because maybe this K6-III 450 could not handle 75 mhz fsb for some reason.  It has been on 75mhz for 4 years with the K6-II.  I also had a K6-III 400 before that, which means I had it at 66fsb x2.  The reason I switched to K6-II 500 was because the K6-III 400 will not handle overclock to 450.  Thus I had the K6-II 500 underclocked to 450.  Now I have this opportunity to switch to the K6-III 450 so as to take advantage of the internal L2 cache again (K6-II does not), and at 450 not 400, but now all this crap happened. Also, this motherboard will not handle K6+ CPUs as that would mean core voltages under 2.5V which this old PC's BIOS does not have. I'm already gambling with the K6-III core 2.4V to work at 2.5V (which is ok, to overvolt just +0.1V).

The biggest mistake I made was a few years ago was when I put the AX5's fsb to 83mhz (to get to 500mhz) and that messed up the hard drive that already had 98se established on it. The AX5 could only max out to 83 fsb.  It messed up parts of the hard drive, so I had to make a new drive with 98se on it. I assume the overclocked PCI was part of the problem. That messed up hard drive is now the secondary drive on this PC so I can pick intact files off it. It has been stable since I backed off from 83 and down to 75 fsb.

I have not done a chkdsk or scandisk, as I might further disrupt something.  

Also, what about manually doing a SCANREG/RESTORE?

What is that RBBAD?  Is the Registry Checker actually loading from that too?  

It's 10-24-17 here in my timezone.  Around midnight of 10-24 was when hell broke loose.  So it's a toss up if RB000 AND RB005 are good or bad.  This leads me to assume that RB003 and RB004 are good ones, as those are dated 2-3 days before all this hoopla.  I will await another reply from you (or anyone else) before I start with your instructions in your first post. Thanks.

Share this post


Link to post
Share on other sites

RBBAD is the saved bad registry, if you wanted to undo the Restore. It is not used. It's size suggests that the Registry was seriously corrupted. You may have other damaged files.

I would not trust RB000.CAB. RB005.CAB probably is OK if the system was running OK Yesterday Afternoon. If you haven't made any changes in the last few days you could remove it also.

To be safe, rename them with a different extension such as RB000.BAK rather than deleting them. You can put one or both back if you need to.

Let SCANREG restore the Registry. If SCANREG doesn't run, you can force it to run by renaming or deleting WINDOWS\SYSTEM.DAT. It is hidden and read-only so you will have to unprotect and unhide it.

Share this post


Link to post
Share on other sites
2 hours ago, rloew said:

RBBAD is the saved bad registry, if you wanted to undo the Restore. It is not used. It's size suggests that the Registry was seriously corrupted. You may have other damaged files.

That sucks!

 

Quote

I would not trust RB000.CAB. RB005.CAB probably is OK if the system was running OK Yesterday Afternoon. If you haven't made any changes in the last few days you could remove it also.

To be safe, rename them with a different extension such as RB000.BAK rather than deleting them. You can put one or both back if you need to.

Ok I will rename RB000 first for now.  I have copied all the contents of \sysbckup to a folder on drive D:, i.e. D:\sysbckup as further backup.  As far as I recall, I started opening up the PC a few hours after 1:04pm as the RB005 timestamp shows.

 

Quote

Let SCANREG restore the Registry. If SCANREG doesn't run, you can force it to run by renaming or deleting WINDOWS\SYSTEM.DAT. It is hidden and read-only so you will have to unprotect and unhide it.

I am confused on which one you want me to do.  In your first post you said to let the Checker do its work (after renaming the cab(s) and then cold rebooting).  Here, you want me to use SCANREG.  I have tested SCANREG/RESTORE and it runs and I do see those cabs listed, however I hit the cancel button instead of proceeding, as I am a scaredy cat, and rightfully so.  I have no full backup of this harddisk. :)  So with all that added commentary, please let me know again if I should use Scanreg/restore now instead of your original suggestion of the Registry Checker.  I'm just really being careful here.  :)

Oh and if you want me to use SCANREG, do I specifically use SCANREG/RESTORE ? Or just SCANREG?  I rarely use it  so I don't know all what it does.

Edited by technoid

Share this post


Link to post
Share on other sites

They are the same thing.

SCANREG is the name of the program that checks the Registry.

Share this post


Link to post
Share on other sites

Oh, looks like you posted a new reply (above) while I was editing my last post above.  As my edit shows (last sentence), I just wanted to be sure whether I type SCANREG/RESTORE, or just SCANREG.  I assume it is SCANREG/RESTORE as that goes directly to the restoration, while SCANREG itself will perform a regsitry scan, which is what we don't want.  Again, just being anal-retentively careful and precise. 

Also, if the restoration is successful but  I get a popup in Windows soon after saying to reboot to perform the registry checker, does that mean some other file(s) is messed up?
 

Share this post


Link to post
Share on other sites

Ok, I got my desktop back. Here is what I did...

1. Booted to command prompt (from 98 startup menu).
2. Backed up the registry cab files in win\sysbckup (as stated in my previous posts).
3. Renamed rb000.cab to rb000.bak (even tho I won't use Registry Checker).
4. Instead, I used Scanreg/restore .
5. Picked "rb005" cab in the list, which looked like the best cab as discussed earlier.
6. Rebooted, hoped, & prayed.
7. It booted all the way into Win 98SE desktop. Yay.

But I'm not quite off the hook yet. I did a Scandisk (Windows version) & it found abount 1 megabyte of corruption. That might not seem like a lot, but this is 98se & this is only an 8 gb harddrive, so 1 mb could be any thing(s) important. I checked win\sysbckup and a new RB000.cab was created by Windows.

I have not proceeded with the fix in Scandisk yet, so I ignored it for now and continued. Eventually I will have to either Delete it or Convert to file. WHICH ONE?

Next, I will have to find (or buy) another hard drive and back (or clone?) this drive up, before things may head in the wrong direction (most likely due to the fix inside Scandisk). Anyone recommend a nice backup and/or cloning drive-to-drive software?

Thanks to rloew for the help!

Share this post


Link to post
Share on other sites

The files or fragments that scandisk found are often not recoverable. But you can check "Convert to file". Then Scandisk saves the fragments in C. The Filename Extension is CHK. Afterwards you can try open the CHK file(s) with notepad. Perhaps something is readable. Also there are tools like deCHK. DeCHK recognises about 50 file extensions.

 

There are many free clone tools like HDClone or CloneZilla. I recommend the self-booting version or ISO file, which you burn on CD.

Share this post


Link to post
Share on other sites

> there are tools like deCHK. DeCHK recognises about 50 file extensions.

There is also a freeware/cardware command-line utility, TrID, written and maintained by Marco Pontello. It's a file-identification program that uses a continuingly-updated database of file signatures (over 9,000 at last count!), and the executable has an optional switch that automagically re-names (or adds) file extensions.

Here's its web page: http://mark0.net/soft-trid-e.html

Here's the program's help screen:

TrID File Identifier v2.24, 2016-Apr-04, Marco Pontello

Usage: TRID filespec [-ae|-ce][-d:file][-ns][-n:nn][-@][-v][-w]

filespec Files to identify/analyze.
-ae Add guessed extension to filename.
-ce Change filename extension.
-d:file Use the specified defs package.
-ns Disable unique strings check.
-n:nn Number of matches to show (default: 5).
-@ Read file list from stdin.
-v Verbose mode - display def name, author, etc.
-w Wait for a keypress before exiting.

TrID is a utility designed to identify file types from their binary
signatures. While there are similar utilities with hard-coded rules,
TriID has no such rules. Instead, it is extensible and can be trained
to recognize new formats in a fast and automatic way. TrID uses a
database of definitions which describe recurring patterns for
supported file types.

You can help creating new definitions! Just run the TrIDScan module
against a number of files of a given type. The program will do the rest.

- Doug B.

Edited by DougB

Share this post


Link to post
Share on other sites

Thanks I will try DeChk and TrID. I was being philosophical about whether to delete or convert to file the scandisk repair, because either way, I'm hosed. There is some urgency in trying to get this operating system back to normal as this is a PC that is used frequently. The question is whether I should proceed with the Scandisk repair and save the CHK file and then peruse it with DeChk and TrID. Will I find anything useful? While the operating system is working, I know it is going to freeze or hang or say something about a corrupted registry again, because of the parts on disk that are corrupted. When it freezes, there is this thin light green horizontal line below the active title bar. Hard to explain, you would have to see it.

Scandisk shows that it "found 1261568 bytes in 3 lost file fragments". That is where I have stopped and the PC is turned off for now. Yes, the desktop is working, but as I said, once the O/S needs to run a particular file that is already corrupted, it will freeze. Or a small window will pop up at any time saying it found a corrupt registry and it needs to restart.

I wish the O/S knew what system files are bad. There have been a couple times in the past where I've seen 98SE (and also in XP) where it tells you that it found bad system file and it overwrites the bad file with a good copy from some backup folder or something. Anyone know what I'm talking about? That would be one surgical skill needed in this scenario.

Share this post


Link to post
Share on other sites

If that is the only message from SCANDISK then there is no real risk of letting it save them.

You won't know if anything is corrupt until you run your system more extensively.

Lost File fragments are the least serious type of error. A bad shutdown will cause them.

Windows creates a number of logging files that end up in these fragments. I just delete them if there are no more serious errors.

Share this post


Link to post
Share on other sites

In my experience too, lost file fragments can be safely deleted. If scandisk made other corrections they will be detailed in the file scandisk.log and this will tell you precisely which files/folders are affected and what scandisk did with them. Most often all these will have been truncated or deleted as to correct filesystem errors and will need to be replaced if they are of some importance.

Share this post


Link to post
Share on other sites

Many of them are newly created files, so they have zero length and no start sector in their directory entries on disk. Although they are effectively truncated, SCANDISK will not see them or report them.
There is no practical way to connect the Lost File fragments to the Files they came from in this case.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×