98 Guy

The following was recently posted to microsoft.public.win98.gen_discussion: "So, while I wasn't looking, they apparently deleted all 9x Updates from the Windows Update Catalog (now renamed "Microsoft Update Catalog".)" Can anyone confirm? Does this mean automated updating via windows update web site no longer works for win-98?

http://www.microsoft.com/technet/security/...n/MS07-061.mspx A patch released on Tuesday (Patch Tuesday) fixes this URI problem: http://www.pcworld.com/article/id,139598-c...gs/article.html See also this: http://www.microsoft.com/technet/security/...n/MS07-061.mspx Note the following: "Microsoft has not identified a way to exploit this vulnerability on any Windows operating system that is running Internet Explorer 6" Which explains why Win-2000 is not listed as vulnerable. So I guess the vulnerability lies in IE7 files... ?

According to one of those references: "the malware installs the wincom32 service" How can it install a service on a system running Win-9x ??? Also: "The e-mails, many of them otherwise empty, contain a link to a compromised Web site where machines are infected with a generic downloader." So the exploit is hosted on a web server, with the e-mail serving as just a pointer to the exploit. My question - what is the exploit being leveraged by the generic downloader? The last reference says this: "The Storm email worm may drop the the file 'wincom32.exe' into the Windows system directory (typically, C:\Windows\System under Windows 95/98/ME, C:\Winnt\System32 under Windows NT/2000, and C:\Windows\System32 under Windows XP." It's unclear whether the wincom32.exe file is actually part of the storm e-mail, or if that file is referenced in a web-link that is visible in the e-mail. If the wincom32.exe is an attachment to the e-mail, then it's not likely that it would be executed by OE or Outlook (the most common e-mail apps) because of how they handle attachments like .exe's. If wincom32.exe is remotely hosted, then again there is missing information as to how a browser is tripped up into downloading and executing it.

Anyone know if the Storm virus can infect win-98 systems? It's my understanding that storm normally infects a system by triggering a buffer-overrun vulnerability in IE or some ie-related component, but that it requires very specific code to correctly execute with the intended result, and exploit code written for 2K or XP may not (or will not) run correctly on 9x. Anyone know for sure if this is the case?

So something like the Biostar GeForce 6800XT http://www.shopping.com/xPO-Biostar-VGA-BI...XT-V6802XA52-RT Or the Pine Technology XFX GeForce 6800 Xtreme http://www.shopping.com/xPF-Pine-Technolog...AGP-8x-DUAL-DVI The Nvidia 6800XT was announced in August 2005 as a direct competitor to the ATI X800GT and began shipping in Oct 2005. The 6800XT is said to be only slighty better than the 6800 LE. Is the 6800XT really the best Nvidia AGP card that can be driven by win-98??? Are there any known problems (or benefits) with a 512 mb AGP video card for win-98 (vs a 256 or 128 mb card) ???

Regarding any currently available AGP video cards based on Nvidia or ATI chipsets, which boards (based on their chipset model or brand model) are known to NOT have fully operational win-98 drivers - even when the customized or modded drivers are used?

Well, when you've people saying things like this: "User interface thread: This type of thread creates its own window so it receives windows messages. It can respond to the user via its own window hence the name. This type of thread is subject to Win16 Mutex rule which allows only one user interface thread in 16-bit user and gdi kernel. While a user interface thread is executing code in 16-bit user and gdi kernel, other UI threads cannot use the service of the 16-bit user and gdi kernel. Note that this Win16 Mutex is specific to Windows 95 since underneath, Windows 95 API functions thunk down to 16-bit code. Windows NT has no Win16 Mutex so the user interface threads under NT work more smoothly than under Windows 95. " http://win32assembly.online.fr/tut15.html Then you wonder if it's really true. Especially this: "Windows 95 API functions thunk down to 16-bit code". Do they mean ALL functions? I thought the Win-95 API was very similar to NT4. Was the Win-98se API improved? Does it thunk as much as Win-95? Then you have statements like this: "The difference between Win3.11 and Windows95 is that, Windows 95 had a lot of improvements. Its was a 32 bit OS but had some 16 bit code. Windows95 had preemptive multi-tasking whereas the earlier OS was co-operative multi-tasking. Microsoft did want to have a single kernel based on WindowsNT, however for the consumer it would mean an very expensive PC. Hence they developed the Windows95 kernel as a intermediate step to bide their time till hardware became fast enough and inexpensive enough for the average consumer to run a WinNT kernel. " http://talkback.zdnet.com/5208-11515-0.htm...amp;start=-9956 So if the NT kernel (and API?) had (no?) 16-bit code, but the Win-95 kernel and/or API did, then didn't thunking take some performance away from Win-95 - which was presumably running on less-expensive hardware and could least afford such a performance hit?

Where did you get drivers for ICH7R ???

What web-page were you trying to view when you got that error message?

How much content from this web page: http://www.radsoft.net/resources/rants/20000321,00.shtml is true regarding Win-9x (specifically Win-98se) and it's use of 16-bit code in the kernel, API and VMM? Some of those same claims are made here: http://www.microsoft.com/technet/archive/n...h.mspx?mfr=true Near the bottom of that page under the title "Differences Between Windows 9x and Windows NT". (note that the author of that page is NOT a microsoft employee, so it's not clear to me how much he really knows about the source code of win-9x system files)

I'm reposting this (it was posted in alt.windows98 and microsoft.public.win98.gen_discussion on August 16) --------------------------------- > MSI K8M890M-V Socket 939 Micro-ATX anybody using it? Looks like you'll be able to get it functional in win-98 by downloading the via drivers from here: http://www.viaarena.com/default.aspx?PageI...&CatID=1110 Specifically: http://www.viaarena.com/Driver/VIA_HyperionPro_V512A.zip (VIA Hyperion Pro Driver Package) That board has PCI and PCI-e slots. You won't be able to get a pci-e video card running on win-98, so you'll have to find a PCI video card. If you are a die-hard AMD fan, you might want to look at this board: http://www.asrock.com/mb/overview.asp?Mode...-VSTA&s=939 (Asrock 939Dual-VSTA) It uses the ULi M1695 chipset, which seems to have win-98 support: http://www.uli.com.tw/eng/support/drivers.php (Note that ULi was purchased by NVidia in Dec. 2005) Otherwise, you might want to look at this board: http://www.asrock.com/mb/overview.asp?Model=4COREDUAL-VSTA (Asrock 4CoreDual-VSTA) It uses the VIA PT880 Ultra Chipset (same link as above for the drivers). It can take DDR and DDR-2 memory, and it has a PCI-e ->AND<- AGP-8x slots. The downside to this board is that you won't get the audio working so you'll have to use a separate sound card.

Has anyone tested or confirmed that the use of the IAA (intelata.mpd) has allowed the correct functioning of win-98 with large IDE hard drives (larger than 137 gb) ???

> It all depends on your need. The question I was posing was strictly pertaining to the in-bound handling of unsolicited packets and if a NAT-router might be inferior to a software firewall in that regard. I specifically did not expand the topic to include a larger discussion about possible network topologies. The answers given here is that a NAT-router is functionally equivalent to a software firewall when it comes to "fire-walling" unsolicited in-bound packets. I note that many responses like to point out the possibility of opening the DMZ or specific ports, but the same options exist for software firewalls as wall so again I don't see the point of mentioning those exceptions. If we were to consider network topology, I would argue that the most common type of network configuration in north america is a single PC in a residential setting. In those cases where a NAT-router (or a broad-band modem with internal NAT-router) is used, what then is the incrimental benefit of purchasing and running a third-party bi-directional software firewall? I say little to none. In the same situation (residential, single PC) where there is no NAT-router, the OS will probably be XP, and if XP's own in-coming firewall is turned on (as weak or as vulnerable as it is) then again what is the incrimental benefit of purchasing and running a third-party bi-directional software firewall? I say little to none.

> NAT is not a firewall in its self however. > The mechanism it uses to perform this does block unsolicited > packets, but it was not meant to be a firewall. Does it matter? When you look at a (software) firewall, you basically have 2 (and only 2) capabilities or modes of operation: 1) dealing with incoming packets 2) dealing with out-going packets For the sake of argument, if we consider a NAT-router as a firewall, then it only has 1 of those two capabilities: A) dealing with incoming packets When I say "dealing with incoming packets", I mean preventing unsolicited incoming packets from reaching any system on the internal LAN. If we agree that the CAPABILITY or FUNCTIONALIY of (A) is equal to (1), I then have to ask myself if item (2) is important enough for me to go out and install a software firewall. Many people do not think that (A) is equal to (1) but can't explain why or how (A) is deficient when compared to (1). It doesn't matter that (A) is a side-effect of how the router performs NAT. > I guess you could say it protects against "active" threats, but not "passive". And by "passive threat", you mean a solicited INCOMING packet that contains exploit code? Or is it unauthorized out-going packets? > I've seen too many people install a NAT router and then remove > firewall and A/V from their machines internally thinking they're > magically protected due to the router. I think that unsolicited incoming threats are way more of an issue compared to monitoring out-going stuff. Once you have a NAT-router, the reason for getting a software firewall drops considerably. Assuming that a software firewall hasn't been disabled by malware, then I guess it can alert you to the fact that you have malware installed and running on your system, but it didn't prevent it from getting on your system in the first place.

> From my experience, VIA based boards works fine with win98 ... I'm not arguing about that. What I'm saying is that you'll probably find better drivers at the VIA website vs the old legacy drivers that are on the win-98 CD. > The last successfull win98 install I did was on MSI K9MMV with a sata hdd. Was the SATA drive being used in IDE-remap mode? > One wil have to enable compatibility mode for the sata interface > and it will run fine with win98. As long as the drive is less than 128 gb in size. When you enable IDE-remap mode in the BIOS, win-98 will see the drive as an ordinary IDE drive and it will use ESDI_506.PDR to access the drive. If the drive is larger than 128 gb, the drive will get screwed up the first time windows tries to access it past the 128 gb point.

> You defined a 25GB Partition, therefore Windows was able to "deal" with it. > If you go back to the first link I provided, there is also an "unofficial fix for > GT 132GB HDD", so tryng it on a 500GB HDD wouldn't work unless it had > first partition defined small enough (did you try that?). The 500 gb drive is a SATA drive that is being controlled by the on-board VIA raid controller. Win-98 is NOT using ESDI_506.PDR to talk to the drive. If it was, I would have pooched the drive during my file-copy test where I filled the drive with >500 copies of the win-98 CD. > Also there is a WorkAround for GT 512MB RAM (the limit for Win98). I was able to have 1 gb of installed ram (and win says 1022 mb available ram). > MaxFileCache=524288 I think I made my entry something like 128 mb, not 512 (why go so high?) Here's an update: So you know that my C:\ drive is a 500 gb SATA drive, formatted with 4kb clusters (resulting in 121 million clusters). I filled most of the drive with over 500 copies of the win-98 CD (copy rate was about 11.5 megabytes per second). It took about 10 hours. Anyways, the drive still has about 50 gb free. Win-98 did not want to create a swap-file on it (I noticed that AFTER I filled the drive). So I assume that it didn't like the 4kb cluster size (more specifically, the fact that the drive had so many of them). So when I slaved another drive to the system (a drive with only 6 million clusters) windows was OK with it (but I had to manually tell it to put the swap file on d:). Ok, so now I remove the slave drive and substitute another 500 gb drive (this time, formatted with 32kb clusters - about 15 million of them). Win-98 was ok with that drive too for holding the swap file. Conclusion: 1) Microsoft had us believe that Win-98 wouldn't function properly on a drive where the cluster-count goes through the roof, hence they had the cluster size increase as the drive gets bigger. This results in 4.17 million clusters on a 128 gb volume. Many people bad-mouth FAT-32 because the clusters get so large - they think it has to. Truth is that MS does that just to limit the number of clusters to about 4 million. 2) I took a 500 gb drive and formatted it with 4kb cluster size. This resulted in 121 million clusters. I then installed win-98se on it, applied all relavent motherboard, video and network drivers, updated IE to 6.0 and then went to windowsupdates and downloaded all the updates and patches. I replaced scandskw.exe, dskmaint.dll and defrag.exe with the win-me equivalents. Ok, so they don't work on this drive (insufficient memory - even with 1 gb of installed ram). 3) I repeatedly copied the win-98 CD over 500 times just to fill the drive (resulting in over 3 million files and 200,000 directories on the drive). No catastrophe happened when I crossed the 137 gb point on the drive. So, would I ever prepare a 500 gb drive as a single volume and install 98 on it? No, not for regular use. This was a special test, just to see if win-98 and FAT-32 could cope with that situation, and it basically did. However, when I do create several volumes for real use, I will make sure the win-98 volume does have 4kb cluster size to make for efficient use of the space. Other volumes for stuff like audio or video or other large files I may increase the cluster size, but probably not beyond 16 kb.

Maybe I'm wrong, but I get the impression in a lot of forums that a lot of people either don't understand (or don't want to understand) that a NAT-router is just as effective as a software firewall at blocking unsolicited in-coming threats, and that a NAT-router performs this function more effectively and efficiently than a software firewall, without being vulnerable to being deactivated by malware.

> > Were there some on the CD that came with the motherboard? > > No, the buit-in drivers on the Windows CD. The hard disc controllers > are working, but not the onboard LAN yet. So you're saying that VIA drivers from 1998 are compatible with a VIA chipset from 2006? You should look to see if your hard drives are being accessed in "DOS compatibility mode".

As reported here: http://support.microsoft.com/kb/272620 ----------------------- When you view the Virtual Memory tab in System properties, the hard disk free size is reported as a negative number if your hard disk has more than 32 gigabytes (GB) of free space. WORKAROUND You can ignore the incorrectly listed free space because Windows internally interprets the numbers correctly as large positive numbers. The English version of this fix should have the following file attributes or later: 09/12/2000 02:31p 4.10.2224 384,144 Sysdm.cpl Windows 98 Second Edition To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. -------------------------- I obtained the updated file from the win-98 service-pack thing (unpacked it manually) and replaced my existing sysdm.cpl. While it did correct the display of a negative free size on the hard drive, it did not solve the virtual memory issue. I then connected another SATA drive to the system (160 gb, with a single 25 gb FAT-32 partition, formatted with 4 kb clusters, a little over 6 million clusters) and Win-98 DID enable virtual memory when instructed to put the swap file on the new drive. So for some reason win-98 did not want to locate the swap file on the 500 gb drive. Either it did not like the fact that the drive was formatted with 4kb cluster size (resulting in 121 million clusters) or it didn't like where on the drive it would have to put it (at the back 10% of the drive). Also - I increased the amount of installed memory to 1 gb, and still got "insufficient memory" when running Windows Scandisk and Defrag on the 500 gb drive. DOS scandisk does not give an error, but it would have taken 4 days to run (given it was at the 30% point after 30 hours).

> I have not been able to install the VIA drivers, even when I downloaded one 4:1 specifically for Win98 I found that this worked fine on the dual-core VSTA: VIA Hyperion Pro Driver Package http://www.viaarena.com/Driver/VIA_HyperionPro_V512A.zip > but it is working well enough for now on the native drivers. Native drivers? Were there some on the CD that came with the motherboard? (I didn't look at mine).

For some background, see my recent post about installing win-98 on a 500 gb hard drive. There seems to be a problem with enabling virtual memory. From the System Properties, Performance tab, I am told that virtual memory is not enabled. When I bring up the virtual memory dialog box, the radio-button "let windows manage my virtual memory settings" is selected, and the following information is shown in grey: Hard Disk: c:\ -14440 MB Free Minumum: 0 Maximum: no maximum When I select the radio button "Let me specify my own virtual memory settings" those settings change to this: Hard Disk: c:\-14440 MB Free Minimum: 0 Maximum: 51096 I changed the maximum to 512 (I assume that's mega-bytes) and restarted. Virtual memory was still showing as being disabled. I set both the min and max to be 512 and restarted again. It still said that virtual memory was disabled, but this time the Hard Disk value had changed to -13928 MB Free (a difference of 512). I changed both to 128 and still virtual memory was still disabled. Prior to each change, I looked for win386.swp in the root directory, but it was never there (even when I tried to unhide it using attrib). So something wierd is going on with the swap file and virtual memory. Might have to resort to messing with registry or .ini settings to see if I can get it going. Any known issues with Win-98 showing a negative number for hard drive space or otherwise for refusing to enable the swap file?

Why is the Asrock Dual VSTA not on this list? http://www.asrock.com/mb/overview.asp?Mode...-VSTA&s=775 And the 4-core version: http://www.asrock.com/mb/overview.asp?Mode...-VSTA&s=775 I have installed win-98 on the dual-vsta - the only thing I can't get working is the HD audio chip (ALC888). I don't know if I can get AC97 audio working either.

Ok, we've got two different answers. One says: > checking for unsolicited UDP would require the router to keep a > list of UDP requests you have made. this goes beyond the > "passive" firewall that a router provides and requires an active > checking mechanism. The other answer says: > If the router is performing 1 to many NAT then yes it will block > them, it shouldnt matter the model router you are using. 1 to > many NAT is 1 to many. If you are performing 1 to 1 NAT then > no NAT will not necessarily block it. You would need some type > of packet inspecting/filtering to do the blocking for you. > > Most home (netgear/dlink to name a few) perform 1 to many NAT > and has SPI so unless you globally forwarded all ports to 1 > copmputer or put 1 specific computer in the DMZ then it should > block it.. According to the first answer, if an unsolicited UDP packet came into the router, then which of it's internal LAN ports would it send the packet to? Why do you belive that a router doesn't track UDP packets like it tracks TCP packets as it performs it's NAT function? The second answer is more alongs the lines of what I was thinking. Given someone with a "1 to many" NAT-router (say, in a residential setting), then what sort of alerts would someone running a software firewall see (in-bound alerts)? I would think they wouldn't see any alerts, be they unsolicited UDP, or TCP. Am I right?

I've been exploring win-98 limitations with regard to the use of large volumes with smaller-than-intended cluster size, specifically the use of 4kb cluster size on volumes ranging from 24 to 500 gb. I've posted my results to microsoft.public.win98.gen_discussion - you can read them here: http://tinyurl.com/33tytp http://tinyurl.com/2umqoz http://tinyurl.com/2wf5gk http://tinyurl.com/2kh8kn Basically, Microsoft has tried to limit FAT-32 volumes from having more than 2 million clusters, and only when necessary allows the cluster count to rise above 2 million to the documented limite of 4.177 million (this happens for volumes between 64 to 128 gb). I've found that DOS scandisk will handle an absurdly high cluster count (121 million clusters on a 500 gb volume) but win-98 scandisk and defrag are limited to 4 million clusters. However, windows-ME scandisk and defrag are capable of handling a volume with more than 4 million clusters - but not as many as 121 million. It seems strange that Microsoft limited win-98 defrag and scandisk to 16-bit functionality - seems like an intentional handicap. Is anyone here aware of any functional or performance issues for win-98 given the expansion of the size of the FAT table when the cluster size is kept small and the cluster-count grows beyond (or way beyond) the intended maximum of 4.177 million?

It's generally said that your conventional residential NAT-router acts by default as a kind of incoming firewall by blocking unsolicited packets from reaching any PC's connected to it's LAN ports. That said, I'm asking specifically about UDP packets, and if unsolicited UDP packets are blocked.