MSDOS.SYS.FIXED - what's this doing here? 1

[MiklK]

It looks like this file popped up out of nowhere. I found this MSDOS.SYS.FIXED file in C:/windows, later it was on C: drive as well.
I reverted my drive and it-they weren't there anymore. It was like it popped up out of nowhere.
I NAV scanned it and no virus found.

Can someone tell me what it is ("FIXED" ??) and if I need it?

thanks, people

(A bird in the hand greatly interferes with typing.)
Mikl

 

[Mulga]

Odd one, normally I would say virus but you have done a scan for that. I cannot find any references to this in a quick search so...
Suggestions:
1. Open the file in notepad and compare it to MSDOS.SYS, see what the differences are if any.
2. Rename the file to something like msdos.sys.bak and see what happens.
Is your system behaving normally apart from this?

Help us to help you, please post back and tell us if this helped.
All things are possible except skiing through a revolving door.

 

[MiklK]

thx, mulga -
i will compare files tomorrow - i've pulled it out to just sit on the desktop for now
and the system hasn't been acting exactly normal otherwise -

often, where a normal banner is supposed to appear in a site, a chopped-off piece of a message like "Windows cannot find ..." on a white background appears instead ... Refresh doesn't help

Might that be related, you think, or is it more likely a DirectX problem, or some other setting screw-up?

I'm beat tonight, i'll follow up and report file comparison tomorrow - if it's weird i'll print it

thx

(A bird in the hand greatly interferes with typing.)
Mikl

 

[Mulga]

I'm still thinking virus, NAV has been known to miss them. Might be worth trying an online scan

http://housecall.antivirus.com/pc_housecall/

just as a double check

Help us to help you, please post back and tell us if this helped.
All things are possible except skiing through a revolving door.

 

[TonyBose]

You might consider a tech put it there. I have used that same exact name for that same exact file on several machines I've worked on as a sort of "reference" while experimenting. Chances are this may be the case...and of course it will not affect anything since "*.fixed" files don't run. Compare it to your MSDOS.SYS file and note the changes. I'd bet there are performance improvements in it.

 

[MiklK]

thx guys - there ARE differences, but no tech put them in
I'm the only one goin into this machine, and i definitely
don't qualify for &quot;tech&quot; - &quot;slowlearner&quot; is more like it<smile>
Please advise which of these is preferable.

Only the differences are listed.
The differences are:

msdos.sys msdos.sys.fixed
DoubleBuffer=2 DoubleBuffer=1
DblSpace=1 DblSpace=0
etc.
DrvSpace=1 DrvSpace=0

then the filler lines for 1024 bytes, then
BootMenuDelay=3 BootMenuDelay=5

(A bird in the hand greatly interferes with typing.)
Mikl

 

[TonyBose]

Your MSDOS.SYS.FIXED is the correct one because FAT32 drives don't support DBLSPACE or DRVSPACE. Also, Doublebuffer should be 1 if you're using an SCSI controller or a zero if you're SURE it isn't needed. Never 2. Default is 1.

 

[TonyBose]

Forgot to add...it doesn't belong inside the c:\Windows folder. It belongs on C:

 

[MiklK]

Thx tony - i'll make those fixes now -

but if FIXED is right, should i delete DBLSPACE and DRVSPACE since win98/FAT32 doen'st use them?

y'know, i must've gotten that Double Buffer=2 from SOMEwhere on line - i must've misunderstood what i saw .... by the way, do you know what the =2 would do?

Much thx for your help

(A bird in the hand greatly interferes with typing.)
Mikl

 

[TonyBose]

Do a file search for DBLSPACE and DRVSPACE and delete all occurences of them. As far as the &quot;=2&quot; is concerned...0=no, 1=yes, and 2=shit!, sumpin's wrong!

 

[MiklK]

Tony-
LOL on the =2.
Delete those references through file search? Not on Regedit?
I guess I use *.* in File Name and DBLSPACE and DRVSPACE in the &quot;Containing Text&quot; box ...

I wonder how they got there if they don't belong on the machine.

thx for checking back.

(A bird in the hand greatly interferes with typing.)
Mikl

 

[MiklK]

Looking at deleting all references to DBLSPACE, i found

102 files found

Found in -
WIN98 CD Contents - C:\windows\desktop\&quot;Win98 BackUp drivers, cab lists and crit updates&quot;
(I downloaded these - why would they be in MS Win98 material if they're not ok?)

Also in In C:setuplog.txt
Ver:C:\DRVSPACE.BIN=:278528:512: Ver:C:\WININST0.400\DRVSPACE.BIN=:278528:512:
Ver:C:\DBLSPACE.BIN=:278528:512: Ver:C:\WININST0.400\DRVSPACE.BIN=:278528:512:

CAB-No volume name for LDID 2, local copy - path C:\WININST0.400
Resolve Conflict:C:\DBLSPACE.BIN ConflictType: 240

Ver:C:\DRVSPACE.BIN=:278528:512: Ver:C:\WININST0.400\DRVSPACE.BIN=:278528:512:
SrcLdid2)DRVSPACE.BIN
Ver:C:\DBLSPACE.BIN=:278528:512: Ver:C:\WININST0.400\DRVSPACE.BIN=:278528:512:
SrcLdid2)DRVSPACE.BIN
SRCDUP:drvspace.bin

Resolve Conflict:C:\DBLSPACE.BIN ConflictType: 240
drvspace.bin=31,DBLSPACE.BIN,9387,40992

drvspace.sys=13,dblspace.sys,9387,40992

References also in
Winundo.dat
winundo.ini
system.1st
msdos.sys

C:\windows
config.txt
default.sf0
default.sfc
defrag.exe

many more including
eyedog.ocx (???)

i should go through these files and delete all these references ?

(A bird in the hand greatly interferes with typing.)
Mikl

 

[WheeDoggy]

ok......... getting back to msdos.sys.fixed..........

i have recently seen a machine with that on there.

from what i have read, this is a remnant of the &quot;dagger&quot; virus.

http://www.f-secure.com/v-descs/dagger.shtml

the only webpage that ties msdos.sys.fixed to dagger no longer exists but there is a google cached page to reference.

http://216.239.53.100/search?q=cach...race.pl?dagger+msdos.sys.fixed&hl=en&ie=UTF-8

however, on the machine in question, the os was installed 11-2001, same as the filedate of the msdos.sys.fixed - which is simply a copy of a default msdos.sys.
this machine, according to all recordings, has never had any virus related trouble.

as for &quot;eyedog.ocx (???)&quot;, this is an activex control related to hwinfo and is probably used by the winupdate site.

 

[MiklK]

thx for the 'eyedog' eplanation and the tip on dagger and msdos.sys.fixed.

should i use an eradication tool? my up-to-date NAV doesn't find anything.

(A bird in the hand greatly interferes with typing.)
Mikl

 

[WheeDoggy]

i am unable to find much at all on this virus, as it is 8 years old - however norton claims to be aware of it:

http://securityresponse.symantec.com/avcenter/venc/dyn/17095.html

there are some clues such as it being a 483 byte direct infector and appending &quot;*.* *.COM&quot; (no quotes) to .com files.
you could open up .com files with a binary editor and search for the string mentioned but unless your cmos settings have been getting scrambled on tuesdays, you really don't need to worry about it.

 

[MiklK]

thx wheedoggy
my cmos settings are fine on tuesdays, although i myself have had some rough tuesdays ...

there was also an msdos.sys on my c:\windows - no idea how it got there -
and an msdos.--- file which was weird.
it WAS kinda like something was spreading, i guess.

(A bird in the hand greatly interferes with typing.)
Mikl

 

[WheeDoggy]

if for nothing but curiosity's sake, open up those two files (c:\windows\msdos.*) using notepad and post back if you see anything unusual.

 

[MiklK]

C:\windows\msdos.sys matched with Msdos.sys.fixed -
based on what everyone said i deleted &quot;fixed,
deleted C:\msdos.sys and moved &quot;good&quot; the C:\win to C:
I think i sorted it out with help - still don't know where it came from ..... and i care less and less. NAV says all current ver's would pick it up, and i have NAV current ...

(A bird in the hand greatly interferes with typing.)
Mikl