Boot up problem. (missing sys file)

[Induna]

I don't know if anyone can help me with this but I'll give it a go.

A friend gave me his hard drive to look at as he told me when he boots up (Win ME is installed on it), when it gets to the Windows splash screen it hangs.

I used F8 on boot-up and did the 'step by step confirmation' and found that the reason the system hangs is because of a missing or corrupted sys file: IFSHLP.SYS driver...

And when I hit safe mode it says Windows is bypassing your startup files. And also says C:\system\VMM32.VXD is corrupted or missing.

I used a Win98 startup disk and tried to transfer the SYS file over to the C: but I get a DATA ERROR READING DRIVE C message.

I can't use scandisk either.

It seems to me that a SYS file is corrupted and I need to transfer a new file onto the C: but I can't. I even tried the EXT command to get the SYS file from the CD ROM drive but I get an error message saying unable to open file f:\null

Can anybody give me any advice? I only want to do a format as an absolute last option. Thanks.

[Etnies]

Ive just got a similar problem to this, i installed piolet and happened to intall mcafee as well. I didnt want this so uninstalled it, i then tried to get on the internet but it said couldnt find my network connection so i restarted my computer and got a few error messages about cant find sys file, then it rebooted to a black screen, i tried rebooting again and got the same problem.

i put the ms xp disc in and tried to correct the error, it however created more.

now if i restart my computer it says
---------------------------------------------------------------
problem has been detected and windows has shut down to prevent damage.
-----------------------------------------------------------------

it then tells me to disable all my antivirus engines, and backup utitlities and run chkdsk, which i cant do as Im stuck on the blue screen that advises me of the above problem.

I cant even reformat my computer as it wont load up in safe mode either,

any possible ideas?

[notbob]

both of you

install the drives in question as slaves

if possible, transfer the system files you need

if not save as much of your personal data as possible and

boot from a floppy

format c:

[stuperfied]

What was he doing prior to the incident and vmm32.vxd is an archive which contains .vxd files and it contains different .vxd files for every system it's installed on this is why i'm not supprised that his hard drive won't work in your computer.

If he has made major or too many alterations to hardware or just cut power too many times without shutting down first this problem can occure but that .vxd problem is probably just from putting his hdd into your computer. Here is a web site which can explain it in more detail http://www.infinisource.com/techfiles/vmm32.html.

[stuperfied]

once you fix that .vxd error which can probably be done by getting yourself a winme boot disk instead of that 98 'cough' crap 'cough' you should be able to access that drive then instead of doing a format just boot to dos and re-install over the top of the existing installation which should fix your ifshlp.sys problem but all of this should be done in HIS computer not yours.

[notbob]

Originally posted by stuperfied
getting yourself a winme boot disk instead of that 98 'cough' crap 'cough'

there is almost no difference between boot disks, much less 98 and me

boot disks contain all the dos files you need--format, fdisk,scanreg and scandisk

everything else is fluff

[stuperfied]

Thanx notbob but ever heard of sarcasm.
Yes they are almost the same and it shouldn't make a difference but dosn't the me one create a virtual drive which means that the computer will still boot reguardless of if the hdd is accessable or not. I'm not sure if winme has the virtual disk (RAM Drive) support.

[notbob]

98 has a ramdrive

95 might even

me adds support for system restore functions

[Etnies]

Thanks for the advice, however Ive just read this after going out and buying a new hard drive (60gb) which i needed anyway as my old one was smaller.

Im not sure what caused the original error, but when I put thew win xp disc in and asked it to correct the error I didnt realize at the time but the disc was not complete and had missing cab files.

I have just noticed this as I tried to install xp on my fesh drive and got exactly the same errors, i am now in need of help again

I formatted the drive into ntfs, but i also have a windows 98 recovery disc that came with my pc. i can boot from this but it has given me the option

'do i want to enable large disk sypport Y/N?

if i choose either optio will this conflict with ntfs, or should i get a full version of xp and try installing again?

[notbob]

say yes, otherwise it will format 2.2GB and nothing else

that question is a throwback to win 95, when all hdd's had to be broken into 2.2 GB partitions (6GB=c:, d: ane e: drives)

answering yes to that question can't hurt anything

[Etnies]

thanks notbob

after typing fdisk, and answering yes to the large file question I attempted to run the recover program that was located on the cd, however I think recovery cd's just tell your pc to unpack the operating system that is already on your hard drive (is this correct?) but as I am now using a new hard drive Im unable to recover anything,

So ive decided to get a new OS from a er...a very legitmate source ..... not p2p at all... lol

hopefully in about 4 hours i should be fixed, then in about 2 weeks (at 24 hours a day) I should have all the mp3's ive just lost.

[Induna]

Thanks for the replies. (You know it was only banter before, don't you bob ;))

Anyway, the first thing I did was take a spare hard drive round to his house and used that as a master and his a slave, so I could access his drive that way. what happened was my drive froze in exactly the same place as if his drive was the master. (it booted up fine without his drive attached) Obviously it wouldn't let my drive boot up because of this error on his drive, which surprised me. I even tried it on seperate IDE channels. That's why I'm asking for help.

So, I took the drive out of his computer and hooked up to mine and tried again, no luck. In the boot process it gets to verify DMI pool... like it normally should but this takes over a minute, then I get the winME splash screen, then it hangs. I just can't see a way of getting these system files onto his drive.

Bob was right about the startup disks, there very little difference. Win98 disk doesn't have the scanreg tool though, which could be useful, if only i can get access to this drive. It's like a locked house, I just need to find a way in.

One of you suggested I could reinstall ME on top his drive without affecting his files. This looks like the only option left, guess I'll have to try that.

Btw stuperfied, that link doesn't work.

[Induna]

Oh hI forgot to say, he just instaled a brand new game on his P.C, the new Japanese 11 football game and was downloading a patch, but he said this other thing was loading up, some music program. Then he told me athe tool for adding this patch didn't work so he downloaded a new one. Too be honest he wasn't making much sense. He said it went into safe mode, but he must have done something because it won't even do that now. He's corrupted some important startup file by the sounds of it.

[Krell]

Induna

nonbob is correct, especially when it comes to hardware configurations. My opinion is it would have been better to take HIS drive, and put on YOUR system, as a slave. Delete his Windows directory, and Program files, and root files. Scandisk, Defrag, then reinstall Windows on HIS machine. (check free space)

What you have then is all of his old files, and a clean install. Then he gets to muck it up allover again. fun fun fun

[Induna]

I've already tried that:

Quote: So, I took the drive out of his computer and hooked up to mine and tried again, no luck.

All that happens is my (good) drive hangs just like his. It's as though something on his drive prevents my drive from booting correctly. Normally if the slave isn't recognised the Master will boot up but the slave won't be seen. In this scenario the slave prevents the master from booting up. It's bloody frustrating!

I knew when we tried this at his house earlier today I was doubtful I could save his files.

[Induna]

I'll try to explain it better.

I boot up, press F8, and wait until it goes into the Windows Millennium Startup Menu.

It gives me four options:

1. Normal

2. Logged(Bootlog.txt)

3. Safe Mode

4. Step-by-step confirmation

I hit 3 then it just goes to a black screen saying:

Windows is bypassing your startup files.

The following file is missing or corrupted: C:\WINDOWS\IFSHLP.SYS

The following file is missing or corrupted: C:\WINDOWS\SYSTEM\VMM32.VXD

Type the name of the windows loader (e.g.,C:\WINDOWS\SYSTEM\VMM32.VXD

C>

[Etnies]

I finally sorted mine out, it only took all day :(

I found this link induna I hope it proves of some use

http://www.bustedcomputer.com/windows/cannot_start_windows.htm

[stuperfied]

Induna
It looks to me like your friend got a nasty virus and I have some evidence to support it co-incidental as is may be.

Windows 9x replaced the old io.sys with a new one with the same name only it now incorporates msdos.sys and you no-longer need config.sys and autoexec.bat but they are retained for backwards compatability.

This io.sys is what loads that IFSHLP.SYS file you keep hearing about which stands for Installable File System Helper and is used to load device drivers. This allows the system to make file system calls. Until this is loaded, only the minimal file system from IO.SYS is used. After this point, the full file system is available.

Now that VMM32.VXD file that you get a problem with when you try to boot into safe mode is not actually a .VXD file it's-self but really just an archive of .VXD files. It contains different .VXD files depending on what system you have it the operating system installed on.

If someone were to put a virus on your computer which corrupted the IFSHLP.SYS file then you wouldn't be able to boot with any more than minimal functionallity and could get around it by booting to safe mode and copying the necessary files into the config.sys.

Now if someone corrupted your VMM32.VXD file you could just bypass it by loading the drivers manually into the windows/vmm32 directory or wherever they have put it now.

Now suppose both of these were taken out at the same time, you wouldn't be able to boot either way and you would have no way of accessing the file system so your master slave plan goes out the window and your drive becomes a paper weight.

As usual if I am wrong please correct me.

[stuperfied]

They changed the url to that other site I mentioned which contains info abot VMM32.VXD but I found it again and corrected my other post. Here is the new link. http://www.infinisource.com/techfiles/vmm32.html

[Induna]

That sounds about right to me Stuperfied, i's a bloody devious virus, there's no way I can access this drive.

So I read that article on VMM32, very useful to know. Looks like I can't just replace it it with a new one because the old one was tailored to my mate's system. Anyway, I followed one of links from that page to Microsoft's Knowledge Base and found this, which is exactly the problem I have:

http://support.microsoft.com/default.aspx?scid=kb;en-us;258471

I've got the WinME startup disk and CD-ROM.

But if you look at the article it says I need to "Modify the WinBootDir in the MSDOS.SYS file to point to the correct location of the Windows folder". Before I do anything else.

How can I if I can't access the drive?

If I use C: DIR at the command prompt all I get is two strange looking symbols, then I get Error: Reading data from C:

I'm not going to give up yet, there must be a way!

Any other ideas?

[Krell]

Use the manufacturers utilities on a floppy to try to "see" the drive, as the master only, and run a low level diagnostic to test and recertify the drive. IF you could see it at all, consider doing a low level format. I think youve already put too much time in to it so far anyways. If it is this much trouble, either chuck it or get an RMA # for warrenty.

You get an A for effort. He owes you.

[Induna]

Good idea Krell. It's a Segate, I'll go to their website and have a look for some disk diagnostic tools.

I won't give up just yet because I'm an optimistic person. I always believe there is a way.

[stuperfied]

lol, I think there might be one possibility but it's just a guess and will probably never work.

This problem is with the IFSHLP.SYS file and to correct that problem it suggests making the enteries manually into the Config.sys file but you can't boot with a Win9x disk to do that on the drive cause the VMM32.VXD is stuffed on the drive.

This might sound crazy to some but a simple DOS boot disk may be the answer to your problems. DOS boot disk even version 4 has everything in the Config.sys file that is necessary to boot and access your disk.

So, feel like trying a DOS boot disk?

[Induna]

Well I tried the Seagate diagostic utility but the floppy wouldn't boot. (I tried in on my own drive and it was fine).

I'll see if a DOS boot disk can access the C:, I've got one somewhere. But doesn't a Win9x disk have config.sys on it? The problem has always been the inability to access the drive, it won't write to it correctly. I'll give it a try anyway.

A mate suggested I use Norton 2002 virus checker (on a bootable floppy) I'm sure he said it would take 14 floppy disks!! I don't know about that.

But he said if I do decide to format the drive, Fdisk it rather than do a straight format. And he also said use PowerQuest's 'Lost and Found' to make sure no trace of the virus is left.

[stuperfied]

The win9x has config.sys but it dosn't use it cause it's only there for backwards compatability so that's why I suggested using dos.

As for making sure you got rid of a virus, if you choose to format just do it from the dos prompt and use the "u" switch which stands for unconditional and after that I can guarentee that nothing will be left behind on that drive ie: "format c: /u".

FDisk is to drop the partition out of the drive and then re-partition it and in theory nothing can be left behind but you know theory's they are seldom correct. But if you delete your primary dos partition using FDisk then re-boot and using FDisk again with large disk support enabled, make a new primary dos partition, use the maximum available size for the partition then reboot, format your drive with the /u command and reboot again. After that if anything survives it won't be worth knowing about.....But if your still worried after that just format your drive another three times and then you can't even be taken by the law for anything that remains cause anything under four layers is not accepted as evidence in a court of law, but be warned formatting too many times wares out your drive which is where bad sectors can come from.

Well have fun and let us know if the DOS Disk works.....

[Krell]

You can standard format a zillion times with the same result, shiney new row makers, and data left behind. You ever DO get to that damn partition, wipe it, then do a low level format, which writes 1's and 0's in patterns, to D.O.D. standards.

I benchmark these utils, and I have been unsuccessful in recovering any data when properly wiped in this manner. If you simply FDISK and FORMAT, I can get your data, np.

If you need any of these utils, let me know, they are very small and effective.

.

[stuperfied]

I said
After that if anything survives it won't be worth knowing about.....And
But if your still worried after that just format your drive another three times and then you can't even be taken by the law for anything that remains cause anything under four layers is not accepted as evidence in a court of lawI didn't say it wasn't possible to retrive data from a drive formatted in this way, I just said that there wouldn't be much left that would be of any use let alone be runable.

Oh and I also said to do it from DOS using the /U switch which means Unconditional. This means that the WHOLE LOT of your drive is written to ZERO'S reguardless and that's not zero as in the number but as in the value.

And it doesn't matter which way you use to wipe a drive there is still information left behind because drives have layers, it's just that the information after the fourth layer begins to become distorted that much that it is no longer viable in a court of law.

[Krell]

I fail to see where you have anything to say about my post at all. I neither contradicted what you said, nor negated the validity of it. My experience in Forensic investigation for court cases, and my use of DoD standard utils FOR THE Dept. of Defense means I have more than a little experience in hard drive geometry and testing. Forensics was never the subject here, but the complete eradication of the boot sectors and master boot record. I leave you with this quote.


The master boot record is always located at cylinder 0, head 0, and sector 1, the first sector on the disk (see here for more on these disk geometry terms). This is the consistent "starting point" that the disk always uses. When the BIOS boots the machine, it will look here for instructions and information on how to boot the disk and load the operating system. The master boot record contains the following structures:

Master Partition Table: This small table contains the descriptions of the partitions that are contained on the hard disk. There is only room in the master partition table for the information describing four partitions. Therefore, a hard disk can have only four true partitions, also called primary partitions. Any additional partitions are logical partitions that are linked to one of the primary partitions. Partitions are discussed here. One of the partitions is marked as active, indicating that it is the one that the computer should use for booting up.
Master Boot Code: The master boot record contains the small initial boot program that the BIOS loads and executes to start the boot process. This program eventually transfers control to the boot program stored on whichever partition is used for booting the PC.
Due to the great importance of the information stored in the master boot record, if it ever becomes damaged or corrupted in some way, serious data loss can be--in fact, often will be--the result. Since the master boot code is the first program executed when you turn on your PC, this is a favorite place for virus writers to target.
http://www.pcguide.com/ref/hdd/file/struct_Viruses.htm

http://www.pcguide.com/ref/hdd/file/structBoot-c.html

Low-level formatting is the process of outlining the positions of the tracks and sectors on the hard disk, and writing the control structures that define where the tracks and sectors are. This is often called a "true" formatting operation, because it really creates the physical format that defines where the data is stored on the disk. The first time that a low-level format ("LLF") is performed on a hard disk, the disk's platters start out empty. That's the last time the platters will be empty for the life of the drive. If an LLF is done on a disk with data on it already, the data is permanently erased (save heroic data recovery measures which are sometimes possible).

If you've explored other areas of this material describing hard disks, you have learned that modern hard disks are much more precisely designed and built, and much more complicated than older disks. Older disks had the same number of sectors per track, and did not use dedicated controllers. It was necessary for the external controller to do the low-level format, and quite easy to describe the geometry of the drive to the controller so it could do the LLF. Newer disks use many complex internal structures, including zoned bit recording to put more sectors on the outer tracks than the inner ones, and embedded servo data to control the head actuator. They also transparently map out bad sectors. Due to this complexity, all modern hard disks are low-level formatted at the factory for the life of the drive. There's no way for the PC to do an LLF on a modern IDE/ATA or SCSI hard disk, and there's no reason to try to do so.

Older drives needed to be re-low-level-formatted occasionally because of the thermal expansion problems associated with using stepper motor actuators. Over time, the tracks on the platters would move relative to where the heads expected them to be, and errors would result. These could be corrected by doing a low-level format, rewriting the tracks in the new positions that the stepper motor moved the heads to. This is totally unnecessary with modern voice-coil-actuated hard disks.

Warning: You should never attempt to do a low-level format on an IDE/ATA or SCSI hard disk. Do not try to use BIOS-based low-level formatting tools on these newer drives. It's unlikely that you will damage anything if you try to do this (since the drive controller is programmed to ignore any such LLF attempts), but at best you will be wasting your time. A modern disk can usually be restored to "like-new" condition by using a zero-fill utility.
http://www.pcguide.com/ref/hdd/geom/formatLow-c.html

. . . . . modern drives do not need to be low-level formatted by the end user, and in fact cannot be LLFed outside the factory due to their precision and complexity. However, it seems that the need to LLF hard disks on the part of users has never gone away. Like some primordial instinct, many PC users seem to have a fundamental desire to LLF their modern disks. Maybe it is built into the genetic code in some way yet undiscovered. ;^) In fact, even if it were possible, the vast majority of the time that someone "needs" to LLF a hard disk today, it is not really necessary. Many users jump quickly to wanting to try an "LLF" whenever they have a problem with their hard disk, much the way many jump to re-installing their operating system whenever it gives them trouble.

Hard drive manufacturers have created for modern drives replacements for the old LLF utilities. They cause some confusion, because they are often still called "low-level format" utilities. The name is incorrect because, again, no utility that a user can run on a PC can LLF a modern drive. A more proper name for this sort of program is a zero-fill and diagnostic utility. This software does work on the drive at a low level, usually including the following functions (and perhaps others):

Drive Recognition Test: Lets you test to see if the software can "see" the drive. This is the first step in ensuring that the drive is properly installed and connected.
Display Drive Details: Tells you detailed information about the drive, such as its exact model number, firmware revision level, date of manufacture, etc.
Test For Errors: Analyzes the entire surface of the hard disk, looking for problem areas (bad sectors) and instructing the integrated drive controller to remap them.
Zero-Fill: Wipes off all data on the drive by filling every sector with zeroes. Normally a test for errors (as above) is done at the same time
When most users today talk about "low-level formatting" a drive, what they are really talking about is doing a zero-fill. That procedure will restore a functional drive (that is, one that does not have mechanical problems) to the condition it was in when received from the factory. There are occasions when a modern hard disk can become so badly corrupted that the operating system cannot recover it, and a zero-fill can help in this situation. Stubborn boot sector viruses for example can be hard to eradicate without resorting to low-level intervention. Since the zero-fill cleans all programs and data off the drive it will get rid of almost any data-related problem on the drive, such as viruses, corrupted partitions and the like. Just remember that it's a bit like burning down your house to get rid of termites: you lose everything on the drive.

This type of utility can also be used to "hide" bad sectors by telling the drive to remap them to its collection of spares. Just remember that a drive that continues to "grow" bad sectors over time is one whose reliability is highly suspect
Warning: Only use a low-level zero-fill or diagnostic utility designed for your particular hard disk. You can download one for free from your drive manufacturer's web site. Even though damage probably won't result from using the wrong program, you may lose data and you may also complicate any warranty service you try to have performed on the drive. (Technical support people at "Company X" generally don't like to hear that you used a utility on their drive written by "Company Y".)
http://www.pcguide.com/ref/hdd/geom/format.htm

[stuperfied]

My appologies Krell I must have missread your post.

As for what you just posted, it is entirely correct but I hate how everyone has to keep refering to the information as one's and zero's, it's not entirely correct. Do you know of anyone who has even attempted to describe this more accurately?

[Krell]

Nope, and I do not either, it's like explaining lasers to kindergardeners.

My answer for most things, is 2,000,000, take it or leave it.

[stuperfied]

Well I think I will seccond that anyway, since my last post I tried to put it in simple terms that are more accurate than zero's and ones and graciously failed in the attempt for example "it's not that the drive contains actual zero's and ones but that some parts of the drive are altered to a state that is different from others which tells the" I stopped there cause I realized it was already getting too complicated, lol.

[Induna]

Just to round off this story. I managed to access the drive in the end and retrieve most of his data. He had a partition. The D drive (which was lost) had his P.C games installed on there so he wasn't too worried about losing those but the C: was accessible, and I transferred his 'valuable' files to my drive. When I say valuable I mean in relative terms, it depends on how you view Dragon Ball Z:p

The lost and found thing gave me the idea to see if there was a better data recovery tool I could download. I did find one, Ontrack's EasyRecovery, which I used, made a rescue diskette. This time it did manage to boot up and better still - recognised his drive and his data. But when I tried to write it to my drive I got a message saying I need to buy the full program. So I exited the prog and booted up again and this time the drive was recognised as a slave for the first time ever. So I retrieved his data, did the fdisk and format /u command, as you suggested stuperfied, installed an OS and transferred his files back. Now everything seems to be OK. At last.


Krell, what data recovery programs would you say, in your opinion, are the best to use? Another friend installed the latest sig2dat and for some inexplicable reason it deleted his entire 'My shared folder' in Kazaalite, and basically deleted all 40gigs of his data. He's not very happy at this moment as you can imagine!

[Krell]

I use Fast File Recovery from dtidata.com

My copies *cough* work just fine, thats why I often say, if you NEED something, let me know. Plus, they have never been pissy about my use of their software, even after I brazenly sent them results and comparisons.

You would fall on the floor at the things you can recover form your HD, or what I can get from certain files, like User,dat, User.doa, etc

I am glad to hear of your success, if you hadnt done that, a set of Norton Recovery Disks would have helped you also.

good work,

cheers

[stuperfied]

Maybe you will be able to tell me a little about kazaa lite...
as you know I am new to the programme but have already learned all it's features and I find it a lot better than any I have ever encountered.

The problem is when I click clear downloaded and eronious and then if I want to redownload that file it tells me that I am already downloading it. what's the go there? Oh, and if I cancel a download and exit the programme it delete's that file from my shared folder. It's really anoying for someone who is on 56k.