Nomen

I find that neither FF 2 or Opera 12.02 render MS kb pages, and haven't for a long time. For example, this page: https://support.microsoft.com/en-us/kb/323207 Both Opera and FF show a few banner items across the top, but the rest of the page is blank. Opera says it loaded 18 out of 18 elements. I look at the page source code in FF, but the KB content is not present (?). Is there an alternative way (or an alternative site) where I can read KB content using either FF2 or Opera 12.02?

Yes, I've been running Kex for many years. I downloaded FF 3.6.9 portable from source forge, ran the install executable, told it to install to D root. Then I ran "FirefoxPortable.exe" from D:\FirefoxPortable. A small spash window opened showing "Firefox portable / Portable apps" and then firefox opened behind it. It was my default 2.0.0.20 version, complete with all my bookmarks, etc. I closed that, and dug a little deeper (D:\FirefoxPortable\App\Firefox) and ran firefox.exe located there (properties file version 1.9.2.9). Again I saw the portable-apps splash screen, and again it was my old version 2.0.0.20 that ended up running. Don't know how that happens. I have 2.0.0.20 installed in E:\Software\Firefox\FirefoxPortable\App\Firefox (file version 1.8.1.20: 2008121709). Now why when I invoke the 3.6.9 version the 2.0.0.20 version ends up running - I have no idea. ?

Can newer security protocols (such as TLS 1.1) be added to FF 2.0.0.20? Even if by way of hack? If so - where are step-by-step instructions?

> Apparently you've never had a system with an Intel ICH5 > or later chipset. While they may be available for some > third-party SATA controller chips, drivers are NOT > available for most chipset-integrated SATA controllers. I do believe that most motherboards made with Intel 800-series chipsets (at least 84x, 86x and 87x) have ICH5 chipsets (sometimes ICH5r) and have full win-9x/me driver support. For example, this board: i865PEa-7ILFR http://global.aopen.com/products_detail.aspx?auno=943 claims ICH5r, and points to Intel chipset driver v5.1.1.1002. ftp://asftp.aopen.com.tw/pub/driver/mb/intel/inf/intel_chipset_v5.1.1.1002.zip Unpacking that and it does contain 9x/me files (various ICH5 cat files). Besides, I seem to recall that ICH5/ICH5r implimentation of SATA controller was buggy or faulty in some way. Also there are many socket 478 and 775 motherboards with Via chipsets with onboard sata controllers with full 9x/me driver support. > > No system in daily use, regardless what OS it's running, > > should be using 40 or 80 gb IDE drives > > I depend on them every day. Have for the past 10 years. > No signs of any trouble, and no plans to change either. I have a few win-98 systems that have 80 gb drives and are in daily use. And I know the drives are at or have exceed their MTBF and could fail at any time. I still stand by my advice I would give to anyone in a similar situation - that yes, the 40 and 80 (particularly 80 gb WD) drives are very reliable, but they will not last forever and the only way to know their true health is to look at their SMART data every once in a while. And I certainly wouldn't build a new win-98 system or rebuild an existing one using an IDE drive today. I'd rapidly run out of storage space if I did, and I imagine so would most people.

> So if you've got the parts around, try it. > If not, I wouldn't spend the money on a "might" be a little faster solution. The point of exploring the use of SATA-1 (1.5 gb/sec) controllers with win-98 has nothing to do with disk-transfer performance. The use of SATA-1 controllers allows win-98 systems to utilize cheap high-capacity hard drives in the range of 160 gb to 2TB that have been available starting 10 years ago. More importantly, SATA-1 controllers always have (in my experience) full 32-bit driver support for win-98, which eliminates the 137gb problem that applies to most situtations using IDE (PATA) drives. No system in daily use, regardless what OS it's running, should be using 40 or 80 gb IDE drives because those drives were made many years ago (10 or more years ago in most cases) and the reliability of those drives today will be questionable. When upgrading existing systems or building new ones, IDE drives are no longer an option for most people anyways.

I can confirm that setting the audio playback (speakers) and recording (microphone) to "emulation" by adjusting the hardware acceleration slider to "None" does allow Skype to function (ie - make calls without giving "Problem with playback device" error). In this mode, the quality of the other party's audio (as heard on my speakers) is horrible (stuttering) combined with an echo (things are heard twice). Conversely, my audio (as picked up by my microphone and heard by the other party) sounds fine.

Searching a few drives I have handy at the moment for CTL3D32.dll versions: (1) 2.31.000 26,624 bytes Jan 26/1998 (2) 2.26.000 26,112 bytes Nov 6/1997 (3) 2.31.000 45,056 bytes April 23/1999 (4) 2.31.000 27,136 bytes July 13/1995 (5) 2.31.000 45,056 bytes June 8/2000 (1) is what my win-98 system is currently using (2) located in a Coreldraw 9 program directory (3) located in an archived copy of a win-98 installation from another computer (4) located in a \temp\_istmp0.dir directory of another archived copy of a win-98 installation (5) located in a folder containing unpacked files from Win-ME cd (3) and (5) are same size, but not binary identical. A directory containing an unpacked win-98 CD is not handy at the moment, so I don't know what version of CTL3D32.dll is there. Based on file date, this computer seems to be using a version from win-98 FE? Nothing has changed as far as being able to use skype 3.8.0.188 on this system (see my earlier posts in this thread). It doesn't see or recognize audio components, and I can't change my skype user image or icon picture (see post #11 in this thread). Would CTL3D32.DLL play a role in BOTH of these problems?

Last week I downloaded the daily build "intelligent updater" package from Symantec for an XP machine running NAV 2002. This was only to scan the slaved NTFS hard drive of a suspect win-7 laptop (ordinarily NAV is not running on the XP system in question). The Symantec package was over 700 mb in size (6 or so years ago it was 100 mb). The package updated the NAV 2002 scan engine and definitions to current standards. NAV 2002 runs on win-98 just fine. Now why you need or want to waste CPU power running an anti-virus program on win-98, that's the larger question here.

I took the drive to a different machine that is dual boot XP/7. The machine was off, but it was in win-7 suspend mode because I hooked up the drive and powered it on and it came up (resumed) and was having some difficulty with the drive. The task bar said it was "installing new hardware", and while that was going on I brought up the drive managment console and I think it was showing 2 instances of the drive, showing the same drive identification number and showing it/them as uninitialized. But it wouldn't let me do anything with it. I rebooted the machine and started it in XP, but never got past the spash screen (with the 3 blue boxes scrolling left to right). Drive light showed what looked like random or intermittent activity. I let it go for about 15 minutes and hit the reset and started win-7, but again it never got past the spash screen. So there is something about this drive that not even the "power" of an NT-based OS can overcome.

I had a spare 400 gb sata drive that was pulled from an old XP machine that I wanted to temporarily slave to my win-98 machine (intel 845-based motherboard with 2-port SATA controller add-on PCI board). I disconnected one of the two SATA drives connected to the PCI card and connected the 400 gb drive in its place. Windows 98 booted fine, but (as expected) did not see the 400 gb drive. I then booted into DOS and ran free fdisk 1.2.1 where I deleted the single NTFS partition on the 400 gb drive and then created a single FAT32 partition (I did not reboot between those 2 actions). I then rebooted, but the system would not boot. I tried pressing f8 during startup, but that menu never came up. The bios was set to boot floppy first, then drive-0 (which is an IDE connected to Master primary). I disconnected the 400 gb drive and was able to boot normally. I set the bios to only boot from floppy, and a floppy formatted with win-98 dos (format a: /s /u) with no config.sys or autoexec.bat booted normally. But the floppy won't boot with the 400 gb drive connected to the system. Even if that's the only drive (no other IDE or sata drives) the floppy shows disk activity for about 10 seconds then stops. I'm going to take the drive and slave it to another (XP) system and mess with it until I'm able to connect it back to the win-98 system, but I was wondering what sort of state the partition table must be in for DOS and win-98 to freeze up during boot when the drive is present. ? I've connected many IDE and sata hard drives to various win-98 systems in the past and have never encountered a situation where just physically connecting a drive to the system prevented full booting into win-98 - or even DOS.

This thread should have been added to the sticky "motherboards for win-98" thread.

So what is the relationship to the beautifier output vs the wepawet.iseclab.org output? The wepawet.iseclab.org output indicates a dependency or utilization of an activex component, and it seems to be constructing a target .exe file to download from the above-mentioned domains based on some sort of algorythm using a random number generator. Would be useful to generate one and download the payload from one of those domains - assuming they're still serving up the payload.

If you want to see the "beautified" (more readable) version, I put a copy here: http://pastebin.com/raw.php?i=K7DjsewG See the first link (to wepawet.iseclab.org) I gave in the first post. That is the "de-obfuscated" version of this JS script. I don't know if taking the de-obfuscated output and saving it as a text file (with .js suffix) would result in a functional .js file (that you can throw into a browser to see what it does). ??? I tried it and got nowhere.

I ran the .js file through an on-line script "beautifier" (jsbeautifier.org) and saved the result as a test .js file. FF2 opens it as a text file. IE6 opens it as a script, gives me a warning, and then gives the same error as above - except that I know what line the error is happening on. Its the very last line of the file. Here is what the last few lines look like: ------------------------- for (var xuow = 1; xuow <= 229; xuow++) { tz += this['nbny' + (xuow * 3562)](); }; this[nbny243()](tz); ------------------------- The line starting with "this" is line 817 - the line that the error is happening on (which is also the last line of the file). So I don't know if this file was malformed to start with, or what...

Last week (and again today), for the first time ever, I'm seeing zip-compressed .js files as spam email attachments. These are polymorphic files that seem to have very low initial detection rates (such as less than 10 out of 57 at Virus Total). An analysis of today's .JS file can be found here: http://wepawet.iseclab.org/view.php?hash=1404be252a3d2861fdffc6af412d2495&type=js I'm trying to understand how an end-user, using a windows-based email client (such as outlook, thunderbird, etc) would end up executing the attachment. For example, after saving the attachment and decompressing the .zip file, I dragged the resulting .js file over to a few of my installed browsers. Firefox 2.0.0.20, Netscape 9.0.0.6 and Opera 12.02 all did the same thing - just opened it as a text file and displayed the text of the .js file. IE 6 seems to have actually known it was a script file, because it first threw up a warning if I wanted to open, run or save a potentially dangerous file. I said sure - run it. It then threw up this error: -------------- Windows Script Host Script: (path to js file)\Invoice_whatever.doc.js Line: 1 Char: 15876 Error: Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another. Code: 800A0BB9 Source: ADODB.Stream --------------- I had to dismiss that error message about 10 times before it went away. I would have thought that Opera 12, being somewhat "new" or newer, would have known how to handle or execute a .js file. Is IE the only browser that opens / executes .js files if you drop the file onto the browser? Is this unique for IE6, or do other versions of IE also do this? Do newer versions of Mozilla-based browsers execute .js files if you drop them on them? Is the Windows Script Host (or file-handler?) that Win-9x/me has somehow "invulnerable" to this seemingly recent development in malware email attachment techniques?

It's not Kex that you're testing. It's a specific program / software that you're testing. And there are certain specific deficiencies in those old P2's and P3's that affect multimedia / video rendering if I'm not mistaken. Absolutely no reason to be putzing with win-98 on anything less than a socket 478 P4 with 512 mb ram these days. Five years ago you could find PC's like that sitting on the side of the road - being thrown out with the garbage.

Probably something to do with your hardware. Video driver, or not enough system ram, or old (non-P4) CPU. If not hardware or drivers, then what updates / patches / tweaks to your system files do you have as a starting point before you try KernelEx?

I make extensive (even insane) use of my HOSTS file to block contact with any host that I figure my win-98 computer doesn't need to talk to. I add entries based on what I see when I examine web-page code and also what my router shows in the out-going contact logs. Some of these entries probably makes browsing on some sites difficult or impossible (it's hard to know which entries are responsible) but if FF2 can't perform then Opera 12.02 frequently can. In an effort to see if I can serve up some of the frequently accessed files locally, I installed Abyss Web Server free version, which you must choose either http or https service (I chose https). So it serves up quite a lot of .js files that I've retrieved manually and placed in the local web-server directory (214 files at last count, 90 of them being .js files, 22 of them .css files, etc). Various jquery.js files being the most common. I examine these .js files (expand them when necessary and store them that way) and look for references to other hosts and mung them for the fun of it. I mention all this because one of the things that Abyss has is this: the host that is shown in that example (apis.google.com) is currently rem'd out in my hosts file. It will serve up TLS/SSL ciphers on port 443 for any hosts that I have in my HOSTS file. Here is the Abyss help-page for these functions: http://www.aprelium.com/data/doc/2/abyssws-win-doc-html/ssl.html I don't know if any of this would help outlook when contacting a mail host (like gmail) as a way to get around SSL or Certificate errors during login... ?

> And no, most probably I will never find out Jaclaz - do you not have a PC with 4 gb with a floppy drive? That's all you need to find out yourself by booting DOS 7.1 from a floppy and seeing if you can load smartdrv with the regular himem.sys (and any suggested switches). The system I was working with is now at another location, but later today I will be able to test numhandles on several different machines with various amounts of ram. Regarding the Numhandles argument - after looking through the results of many web searches, I can find: - no authoritative explanation from any source as to what NUMHANDLES is for, what it does, when to use it, etc, and - no explanation as to how NUMHANDLES affects or alters himem.sys's ability to provide XMS memory to applications such as smartdrv.exe, especially in situations when a system has a large amount of installed ram.

While we're on the subject - some quotes from http://www.programdoc.com/1017_4787_1.htm here: ============ "The script to get the setup started works but immediately before the file copy starts in earnest (it has copied the udb file) setup stops with a heap of disk activity lasting several hours. Setup does eventually continue and complete correctly. Is the an entry in the unattend file to skip disk checks or do a quick format perhaps? or am I missing something else?" "The short answer is that you need to load smartdrv. This "feature" was introduced in Windows XP" "smartdrv.exe as the setup-from-DOS 'feature' was introduced in NT4" "Using smartdrv.exe always made it faster. But you could do an NT or 2k install without smartdrv and only pay a penalty of a few extra minutes. Starting with XP, that penalty increased to hours. Thus the need for (?). The XP (and Server 2003) winnt.exe performs a tremendous number of tiny writes. The NT (and 2k) winnt.exe does not." ================= By all indications, DOS 7.1 himem.sys should be compatible with 4 gb ram, but all I can find on that topic is unsubstantiated comments that DOS (or himem, or smartdrv.exe) has problems with more than 2 gb ram: https://community.landesk.com/support/message/34771 I don't think this helps to explain anything here: https://support.microsoft.com/en-us/kb/95555

My last test (if you read my previous post) was to invoke smartdrv from the command prompt with no arguments. I got the same message that it can't load because the XMS driver himem.sys is not loaded. That message must be built into smartdrv.exe. I was just doing web searches for combinations of smartdrive, smartdrv, xms, himem.sys, and get very little, even when doing google search on site:microsoft.com. One thing I did come across was this: ftp.microsoft.com/MISC1/peropsys/WINDOWS/KB/Q85/4/24.TXT It should be easy enough for anyone with a PC with 4 gb ram and a floppy drive to create a DOS 7.1 boot floppy with smartdrv.exe on it and see if you get the same thing I do. But I'm not able to bring up anything from the ftp.microsoft.com server, not even when log in using an FTP client. And I can't find any archive of that "peropsys" folder.

During previous attempts I had removed the load-high, so that line was this: C:\DOS\SMARTDRV.EXE A- B- C+ /V 4096 4096 /E:8192 /B:8192 But as one final test, I removed the autoexec.bat completely and booted into dos with no config.sys or autoexec.bat. Then I executed the command smartdrv (with no arguments) from the dos prompt, and AGAIN was told that smartdrive can't load because the XMS driver himem.sys is not loaded and I should check config.sys for device=himem.sys. I haven't searched the web for this for any authoritative confirmation - but is this fact (that DOS 7.1 smartdrv.exe must have XMS memory available to it, which means himem.sys must be used) not known to us?

> what happens on your machine without any config.sys nor autoexec.bat, > simply running SMARTDRV on command line? Starting the system in question without any config.sys (but with smartdrv in the autoexec.bat - as the only active line in that file) does not work. Smartdrv says it's can't load because the XMS driver (himem.sys) is not loaded.

Replaced himem.sys with himemx. This did not work: DEVICE=C:\DOS\HIMEMX.EXE/X2MAX32 But this did: DEVICE=C:\DOS\HIMEMX.EXE /MAX=512000 Smartdrive now loads and can see / use some XMS ram. And let me tell you - when you're installing XP from a CD copied to a source directory on a FAT32 hard drive and installing it on the same drive, you really do need smartdrive running. Prior to fixing this, I let the install run for 3 hours - and it looked like the install had hung. Every time I restarted and tried resuming the install, XP said it couldn't find the EULA and couldn't go any further.

DOS boots fine with emm386. It's just that smartdrv.exe isin't loaded because there is, apparently, no available XMS memory. This is what's in my autoexec.bat: LH C:\DOS\SMARTDRV.EXE A- B- C+ /V 4096 4096 /E:8192 /B:8192 And this is in my config.sys: DEVICE=C:\DOS\HIMEM.SYS /verbose DEVICE=C:\DOS\EMM386.EXE NOEMS VERBOSE DOS=HIGH,UMB,NOAUTO BUFFERSHIGH=50,0 FILESHIGH=50 STACKSHIGH=32,512 SWITCHES /F /W BREAK=ON Does emm386.exe have problems detecting / allocating XMS memory when a system has 4 gb ram?