Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unable to Boot (XP): "NTLDR is Missing"


  • Please log in to reply
14 replies to this topic

#1 RLithgow

RLithgow

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 25 January 2010 - 03:17 AM

I've been wreckless with combofix, and now am unable to boot the XP OS.

My girlfriend had some issues with her Toshiba laptop freezing up. To make a long story short, I've somehow managed to corrupt her XP operating system and the Hard Drive now appears unpartitioned. Currently, if I boot the computer I immediately receive the following message:
"NTLDR is missing
Press any key to restart"

I now realize that I should have turned here first, as I am sure I have made things worse, and the data is now perhaps unrecoverable. I am in over my head and need to know what to do with the computer now. The computer will boot with the Windows XP CD (I had to change the boot order in the bios).


When the computer was handed to me, it would freeze each time after an error would appear regarding the built in fingerprint reader. The error displayed a message, as best I can remember it, "W32: err wstd 1702." This error would pop up after random seemingly intervals, but usually within a few minutes of booting up into Windows. My girlfriend had already run malwarebytes, and the log I found showed that two "trojan.dropper" file infections were found and deleted. I ran an additional scan in safemode, and it found another infection in one of the restore points. Otherwise, the system appeared clean, but continued to freeze up. I tried disabling the fingerprint hardware, but this did not prevent the above error from occurring. Nothing in event viewer appeared out of the ordinary.

I next tried disabling all startup programs using msconfig. The computer would now run for up to a half hour before displaying the above error and freezing. I next tried disabling services in MSconfig by selecting diagnostic startup (It left RPC and other essential services enabled). Upon rebooting, the computer seemed stable for about an hour before the error began popping up again. I renabled each of the services and restored the startup programs.

Did I run a proper virus scanner? Did I rule out hardware malfunction? Nope. I grew impatient and tried to use combofix (with which I have had success in the past). I downloaded it from bleepingcomputer.com. (Yes, I know this was probably not the smartest move, as I wasn't sure that I was dealing with a rootkit).

I do believe the copy of combofix I downloaded was legit, and have since noticed all of the warnings posted all over the forums about its recent bug issue. If only I'd been more patient, maybe I would have noticed the warnings. Anyways, on running combofix, the program informed me that the system was infected with a root kit, and something about repairing the boot.ini. The program asked to download and install the windows recovery console, which it did. When the program asked me to restart, I did. However, the computer then became unbootable. It displayed an error (as best I can remember it) saying that it could not find the operating system. Without the ability to get into safemode, I went for the windows xp CD, which failed to load. I then went into the system bios/cmos by holding f2 while starting the system, reversed the boot order so that the system would look to the CD drive before the hard drive, and was thus able to get the windows CD to load. I asked the system to do a repair install, but the Windows XP CD was unable to find an OS to repair. In fact, it asked me to create a new drive partition. I backed out of the program, and instead went for the recovery console. On examining the disk at command prompt, it appears that all space on the hard drive is free and unpartitioned. :thumbsup:

I tried typing in "fixboot", and the recovery console did its thing. That made things worse, of course. Now, instead of a "missing operating system" error, now I get exactly this error: "NTLDR is missing Press any key to restart"

It was at this point that I decided to stop and come here, as I feel I have messed this system up enough. I wish I could be more precise about what I did to this system, but I can't get at any of the logs or errors.

I would like to preserver the data on the computer, or at least some of it, if it is possible to do so. As impatience got me into this mess, I am ready to wait for help -I know that there was something about combofix having a serious bug (don't know the details though), although this may not be combofix's fault... I have no way to know at this point.


The specs are as follows (as best I can tell without tearing open the lap top):

Toshiba Satellite P105 (as per the computer's label)
Intel Core Duo T2400 1.83GHz processor
17-inch glossy widescreen (1440 x 900)
nVidia 7300 Go graphics card
120GB 5400RPM SATA Hard Drive
1GB RAM
802.11 a/b/g Wireless via Intel 3945abg card
DVD dual layer burner

I am not sure which version of OS it was running, but I am sure that it was running Windows XP SP2. (Yeah, I probably should have made note of the version before blowing the OS away, but it's a little late now).

As for the original Windows XP CD that came with the laptop, I've been assured that it is around "somewhere", but I am certain that the OS loaded onto the laptop was the original. Nothing pirated.




Any guidance at all would be greatly appreciated.

Robert Lithgow
rlithgo@law.jmls.edu

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,235 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:02 PM

Posted 25 January 2010 - 08:44 AM

Worth reading, IMO: ComboFix usage, Questions, Help - Look here - http://www.bleepingcomputer.com/forums/t/273628/combofix-usage-questions-help-look-here/ .

Louis

#3 RLithgow

RLithgow
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 25 January 2010 - 11:25 AM

I've read the post at the above link. At best, I am a knowledgable amateur with computers. I've fixed my own a number of times over the years, but this is the first time I've trully gotten in over my head. I blame no one else; while I do not expect help, I would be very grateful for any advice that could be given to me. I'll assume the risk of any harm that may result or has resulted.

Bob Lithgow

#4 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:06:02 PM

Posted 25 January 2010 - 12:45 PM

Using the Windows Recovery Console

* Insert the Windows CD and start the computer.
* When the Welcome to Setup screen appears, press R for the Recovery Console
* Type a number corresponding to the Windows installation you wish to repair (usually 1) and press Enter.
* When prompted, type the administrator password and press Enter.
* From the command prompt, copy NTLDR and NTDETECT.COM from the i386 folder of the CD to the root folder of the hard drive. In the example commands given below, C: is the hard drive and D: is the CD-ROM drive. You will need to change the drive letters if appropriate:
COPY D:\I386\NTLDR C:\
COPY D:\I386\NTDETECT.COM C:\
* Remove the Windows XP CD from the drive and restart the computer.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 RLithgow

RLithgow
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 25 January 2010 - 01:34 PM

Thanks Garmanma,

I am not at home to work on the lap top at this moment, but I did try as you suggested. When I loaded up the Windows XP CD and pressed 'R' for the recovery console. I cannot remember the exact message (although I will try again when I get home, and will reply with the exact message), but it was something to the effect of no OS being found on the system... In otherwords, there is no "Press 1 to repair this copy of Windows Installation." It is almost as if there is no OS left to repair.

Also, when I set the systemroot at the command prompt in the recovery console, there are absolutely no folders (as displayed by typing 'dir').

When I return home, I will try following your directions to the letter, in case I overlooked something, and will report back with the results.

Bob Lithgow

#6 RLithgow

RLithgow
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 27 January 2010 - 02:25 PM

Garmanma,

I tried as you suggested, but could not copy NTDETECT.COM.

-Windows XP CD (Professional) loaded into laptop
-Laptop turned on
-Windows Recovery Console started successfully
-Pressed 'R' for recovery console.
-Monitor displays black screen command prompt, C:\>
-Typed: COPY D:\I386\NTLDR C:\
-System Reports "1 file(s) copied."
-Typed: COPY D:\I386\NTDETECT.COM C:\
-System Reports: "The file could not be copied."
-Upon reboot, computer reports "NTLDR is missing Press any key to restart"

Ideas?

#7 RLithgow

RLithgow
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 27 January 2010 - 02:33 PM

Never mind...

When I rebooted I was able to get NTdetect.com to copy. Don't know what changed, but I was pretty sure I typed in everything correctly both times.

The result is the same however, as the computer still says "NTLDR is missing Press any key to restart"

Typing DIR at the command prompt now reveals 10 files, but aside from the two I copied, the other files have names that are symbols without names. None of these files existed in C: yesterday.

Bob Lithgow

#8 tony.priestley

tony.priestley

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 27 January 2010 - 03:18 PM

Ws32.dll errors are caused by situations that lead to the removal or corruption of the ws32 DLL file. In which case you may have been correct in running the various malware apps. However in some cases, ws32.dll errors could indicate a registry problem, a virus or malware issue or even a hardware failure. This error with the ws32 DLL file may also happen on boot because of corruption through hardware failure in this case the Toshiba's hard drive.

Why I mention this is that I noticed in your first post with the problem, slow computer, finger print reader problems and the errors as you remember them that you may not have remembered the messages exactly. Was there perhaps two errors, one with the ws32 DLL and the other a 1700 or perhaps 1701 error? The reason I ask is the 1701 or similar error could be from the bios because of hardware failure, or imminent failure of the hard drive. If the drive has S.M.A.R.T. capabilities you could check in the Toshiba BIOS and perhaps find a log. If there are errors in the log then the drive should be replaced.

The other clue as to why I believe the drive may be in a failure state is your description of the dir output from the c:\ root folder. A corrupt, or damaged drive can return this type directory. It looks like at the very least you will probably have to reinstall the OS and applications.

#9 RLithgow

RLithgow
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 27 January 2010 - 05:01 PM

The only Ws32 error number was 1702. I could not find any reference to this in the eventviewer, although its possible that the computer began failing (freezing) before the error could be logged by the OS I suppose.

I can't think of a way to rule out hardware failure other than through checkdisk and some sort of bootable memory diagnostic program.

I will post more information when I get home and get a look at my notes. I appreciate the help and input.

Bob Lithgow

#10 thcbytes

thcbytes

  • Malware Response Team
  • 14,790 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:02 PM

Posted 27 January 2010 - 05:16 PM

Hello,

Let's see if there still is recoverable data!!! Let's now create a boot disc so that you can access your files and folders and so I can get a look at a log.....

*** Please print these instructions ***
  • Download Hiren's BootCD Iso to the desktop of a clean computer.
  • Extract the zipped HirensBootCD.zip to your desktop.
  • Open the extracted HirensBootCD folder and extract the zipped HirensBootCD.iso.
  • Double click the BurnToCD.cmd bat file contained in the HirensBootCD folder. This will launch BurnCDCC.
  • Insert a blank CD in your drive.
  • Press Start. This will burn the image to disc. After it has completed...
  • Restart your sick computer and boot from the HBCD you created.
    • If your PC is not booting from the CD, you need to change the boot order:
      • Restart your PC
      • As soon as you get an image, press the Setup key. This is usually F2, F10, F12 or Del. On some machines the key can also be a different one. It should, however, be stated on the screen which key is the setup key.
      • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
      • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
      • The tab should now show your current boot order.
      • If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
      • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
    • Your PC should now boot from your CD.
    • Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
  • When the CD boots choose "Start MiniWindowsXP". Allow Windows to load. You will see a typical Windows Desktop.
  • You will be able to access your sick drive and save files/folders from here.
  • Create an ethernet (wired) Internet Connection
    • Double click the Network Support icon on the HBCD desktop
    • A computer screen will appear in the lower right corner system tray
    • Double click HBCD Menu on your HDCD desktop
    • Choose Menu
    • Then Browsers
    • Then Opera
    • Success?
  • You should now be connected to the internet.
  • Navigate here to the forum and click this link.
  • Download the program and save it to the desktop.
  • Once saved, close all other windows then double click the program to run it.
  • When completed, a log will open.
  • Save the log to the desktop using File>Save as, then post the log in a reply.

    Please note: If you are unable to connect to the internet then please download to a flash drive on a clean computer and transfer to the sick computer to run!

  • In addition you now have access to all your files and folders amoungst many other utilities that we might need to use later. :thumbsup:
  • If you double click your Windows Explorer icon on your desktop you will be able to access your hard drive.
Kind regards,
~ t

Edited by thcbytes, 27 January 2010 - 05:29 PM.

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost!

http://donatelife.net/register-now/

#11 slyhill

slyhill

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:02 PM

Posted 05 February 2010 - 02:02 PM

Don't want to hijack this thread, but I have the same exact situation with the same hardware, so I thought that may be of interest.

#12 slyhill

slyhill

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:02 PM

Posted 08 February 2010 - 08:59 AM

I was able to save the partition and boot the laptop up again using a very sweet utility called TestDisk. It scans the drive and rebuilds the partition table. I connected the laptop drive to another computer via an Apricorn SATA to USB converter. What a great program and its free! Thanks to cgsecurity dot org and to Christophe Grenier. Anticipate my contribution.

Anyone interested in the Combofix log from this machine, just message me.

Thanks again.

#13 RLithgow

RLithgow
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 07 March 2010 - 05:05 AM

I am sorry it has taken me so long to get back to you -I have been getting quite busy with school.

I tried to download Hiren's Boot CD, which I was finally able to do using another computer (my laptop, which is not sick -at least I hope its not- wouldn't open the downloaded zip files for either Hiren's or Test Disk). Using Hiren's I was able to get into the mini-XP desktop. I tried using the dds-bootcd.exe as directed. I was able to move this onto the sick computer using a USB flash drive, but the program would run without making a log file. None of the files are visible on C:\ except the garbled files and the pair that I copied from the windows xp cd.

I do see a host of potentially dangerous tools on this Hiren's CD, and won't touch them unless directed -most look like they could do a whole host of damage in my unknowledgeable hands. However, against my better judgment, I looked into TestDrive and did an 'analyze' from the menu. Found my partitions -apparently there was a small back-up partition on the HDD as well, from what I can see. When I was using the recovery panel before, it was reporting that the "garbled" C:\ was in fat 16, which I figured wasn't right.

Still, I am unsure how to repair the partition so that I can boot from it. I will await further instruction (and will be quite patient, given my month-long absence), although I may try to copy a few documents from the partition onto a flash drive with the TestDrive program.

I very much appreciate your help thus far.

Robert Lithgow
rlithgo@law.jmls.edu

#14 joseibarra

joseibarra

  • Members
  • 1,082 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:06:02 PM

Posted 07 March 2010 - 07:06 AM

My Recovery Console experience tell me that when you boot RC, you should be here:

C:\WINDOWS

not here:

C:\

If you find yourself in that situation of landing in C:\, I would start with a chkdsk /r on your drives(s):

chkdsk c: /r

If the file system is somehow corrupted and you don't fix it (chkdsk /r runs clean), I can't see the point in copying any files anywhere until it is fixed and booting RC put you in C:\WINDOWS.

If you don't land in C:\WINDOWS, something is wrong immediately and I would work on fixing that first.

Generally, anytime I feel the need to load RC, I will always start with chkdsk /r before doing anything else.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#15 thcbytes

thcbytes

  • Malware Response Team
  • 14,790 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:02 PM

Posted 07 March 2010 - 08:08 AM

Hi,

You 1st order of business should be to use Hiren's to back up your data. Your sick hard drive is now accessible. Please save any important data to a peripheral drive.

Next please try this...

We need to create an OTL ReportAfter you have successfully burned the OTLPE ISO to disc you will need to transfer the disc to the CD drive of your sick computer and boot from it.
  • Insert the CD-ROM into the CD-ROM drive, and then restart the computer.
  • If your PC is not booting from the CD, you need to change the boot order:
    • Restart your PC
    • As soon as you get an image, press the Setup key. This is usually F2, or Del. On some machines the key can also be a different one. It should, however, be stated on the screen which key is the setup key.
    • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
    • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
    • The tab should now show your current boot order.
      If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
    • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
    • Your PC should now boot from your CD.
    • Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
  • Please be patient as "Windows" loads
  • Your system should now display a REATOGO-X-PE desktop.
  • Double click on the Posted Image icon on your desktop.
  • When asked "Do you wish to load the remote registry", select Yes
  • When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  • Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  • OTL should now start. Change the following settings
    • Under "Extra Registry" please check "Use Safelist" and also check "LOP Check" and "Purity Check" as pictured.Posted Image
    • Copy and Paste the following code into the Posted Image textbox. Do not include the word "Code"

      Please note: Double click the Firefox Icon on the desktop to connect to this thread if you have a Wired connection otherwise you can use a flash drive and copy this script into a txt file from a clean computer to transfer to this computer.

      netsvcs
      msconfig
      safebootminimal
      safebootnetwork
      activex
      drivers32
      %ALLUSERSPROFILE%\Application Data\*.
      %ALLUSERSPROFILE%\Application Data\*.exe /s
      %APPDATA%\*.
      %APPDATA%\*.exe /s
      %SYSTEMDRIVE%\*.exe
      /md5start
      eventlog.dll
      scecli.dll
      netlogon.dll
      cngaudit.dll
      sceclt.dll
      ntelogon.dll
      logevent.dll
      iaStor.sys
      nvstor.sys
      atapi.sys
      IdeChnDr.sys
      viasraid.sys
      AGP440.sys
      vaxscsi.sys
      nvatabus.sys
      viamraid.sys
      nvata.sys
      nvgts.sys
      iastorv.sys
      ViPrt.sys
      eNetHook.dll
      ahcix86.sys
      KR10N.sys
      nvstor32.sys
      ahcix86s.sys
      /md5stop
      %systemroot%\*. /mp /s
      %systemroot%\system32\*.dll /lockedfiles
    • Push Posted Image
    • When finished, the file will be saved in drive C:\OTL.txt
    • Please post the contents of the C:\OTL.txt file in your next reply.
    • Copy this file to your USB drive if you do not have an internet connection.
Thanks,
~ t
Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost!

http://donatelife.net/register-now/




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users