Can't boot (MBR?)

  • Thread starter Thread starter Patok
  • Start date Start date
P

Patok

And now it happened to me. :(

The symptom is the typical MBR screwup - the computer hangs on a black screen
just after completing the POST. Trouble is, the fixes don't change anything. In
Recovery Console, I did:

- fixboot
- fixmbr (it warned that the partition was non-standard)
- replaced ntdedect and ntldr (just in case, they seemed OK)
- didn't fix anything with bootcfg, because it looked quite normal - just one
installation in C:\windows, properly identified, no options out of the ordinary

It still hangs right after POST, so it is something else. Or it *is* the MBR,
but fixmbr can't fix it.

Can anybody recommend a good MBR edit tool? I'll be checking for such online,
but if somebody knows a good one from personal experience, it will be appreciated.

Otherwise, the drive seems quite OK; I have plugged it in an external USB
adapter and I can edit/modify etc.

There is one NTFS partition, using the entire drive. It was created by using
Paragon, copying the backup of the previous (smaller) drive onto this
replacement drive, and extending it to cover the entire disk. Could Paragon have
done something not quite standard, and that is the reason for the message from
fixmbr, and its inability to fix it?

How it happened:
I was working using ZoneOs ZoneScreen to extend my desktop to another adjacent
laptop, using the second laptop as a second monitor (the two laptops using the
firewire connection for that). At some point, I stupidly dragged the NVidia
control panel from the master desktop to the extended, forgetting that it is not
a real display, and it didn't work and screwed up ZoneScreen so that the desktop
could no longer be extended, just mirrored. So I decided that it was time to run
checkdisk on the master anyway, and had it scheduled on reboot, and rebooted.
What I noticed was that it took unusually long to shut down, and that was that.
On reboot, it hung.

In case someone asks, the computer itself is fine. I'm using it to write this
message now, having replaced the unbootable drive with the previous one. It is
(because older) still SP2, and I notice that NTLDR has a different date and is
binary different in places. Did they change NTLDR between SP2 and SP3? Should I
replace the SP3 NTLDR with the SP2 one?
 
And now it happened to me. :(

The symptom is the typical MBR screwup - the computer hangs on a black
screen just after completing the POST. Trouble is, the fixes don't
change anything. In Recovery Console, I did:

- fixboot
- fixmbr (it warned that the partition was non-standard)
- replaced ntdedect and ntldr (just in case, they seemed OK)
- didn't fix anything with bootcfg, because it looked quite normal -
just one installation in C:\windows, properly identified, no options out
of the ordinary

It still hangs right after POST, so it is something else. Or it *is* the
MBR, but fixmbr can't fix it.

Can anybody recommend a good MBR edit tool? I'll be checking for such
online, but if somebody knows a good one from personal experience, it
will be appreciated.

Otherwise, the drive seems quite OK; I have plugged it in an external
USB adapter and I can edit/modify etc.

There is one NTFS partition, using the entire drive. It was created by
using Paragon, copying the backup of the previous (smaller) drive onto
this replacement drive, and extending it to cover the entire disk. Could
Paragon have done something not quite standard, and that is the reason
for the message from fixmbr, and its inability to fix it?
Click to expand...

<snip>

from the repair console try chkdsk /r
 
And now it happened to me. :(
Click to expand...

LOL. Bound to eventually.
The symptom is the typical MBR screwup - the computer hangs on a black screen
just after completing the POST. Trouble is, the fixes don't change anything. In
Recovery Console, I did:

- fixboot
- fixmbr (it warned that the partition was non-standard)
- replaced ntdedect and ntldr (just in case, they seemed OK)
- didn't fix anything with bootcfg, because it looked quite normal - just one
installation in C:\windows, properly identified, no options out of the ordinary
Click to expand...

I would insert dummy lines in Boot.ini, pointing to other or even
non-existent partitions, with appropriate names.

So you can tell if your booting is getting to boot.ini. So it will
stop at boot.ini.

Which seems to be the stop after ntdetect, and ntldr.

And you'll know it got that far, even if it later gets stuck loading
windows. In fact, once you are at boot.ini, I think you can then
press F8, and choose safe mode, so you'll know better where it freezes
if it freezes in that part.

If it never displays the boot.ini list, then it is one of those two
files (There are more files inolved when you have dual boot.)


Question. I read somewhere serious that bootcfg doesn't work in XP
home, only Pro. OTOH, a microsoft article about the commands in
recovery console made no such distinction. I've never used it.
Does it work in Home.

Regardless, it's easier to use a boot cd like Hirens to fiddle around
with boot.ini than to use the recovery console, I think.

It still hangs right after POST, so it is something else. Or it *is* the MBR,
but fixmbr can't fix it.

Can anybody recommend a good MBR edit tool? I'll be checking for such online,
but if somebody knows a good one from personal experience, it will be appreciated.

Otherwise, the drive seems quite OK; I have plugged it in an external USB
adapter and I can edit/modify etc.

There is one NTFS partition, using the entire drive. It was created by using
Paragon, copying the backup of the previous (smaller) drive onto this
replacement drive, and extending it to cover the entire disk. Could Paragon have
done something not quite standard, and that is the reason for the message from
fixmbr, and its inability to fix it?

How it happened:
I was working using ZoneOs ZoneScreen to extend my desktop to another adjacent
laptop, using the second laptop as a second monitor (the two laptops using the
firewire connection for that). At some point, I stupidly dragged the NVidia
control panel from the master desktop to the extended, forgetting that it is not
a real display, and it didn't work and screwed up ZoneScreen so that the desktop
could no longer be extended, just mirrored. So I decided that it was time to run
checkdisk on the master anyway, and had it scheduled on reboot, and rebooted.
What I noticed was that it took unusually long to shut down, and that was that.
On reboot, it hung.

In case someone asks, the computer itself is fine. I'm using it to write this
message now, having replaced the unbootable drive with the previous one. It is
(because older) still SP2,
Click to expand...

Isn't it going to upgrade to sp3 soon? They kept saying we had to
do this, but on two computers, I've seen the normal MS upgrades
include a whole SP. I would set your updating to the second option,
so you have some control over when it upgrades, so it doesn' decide to
do it when you need the computer. Am I right about that concern,
guys?
and I notice that NTLDR has a different date and is
binary different in places. Did they change NTLDR between SP2 and SP3? Should I
replace the SP3 NTLDR with the SP2 one?
Click to expand...

In my recent case, I replaced the sp2 ntdetect with the sp3 one from
my own computer, before the broken computer was working well enough to
even start windows, let alone upgrade itself. And it was okay.

But I woudn't do what you are suggesting since you have other things
to do first, like modifying boot.ini.
 
mm said:
Good point.
Click to expand...

Sorry, guys, that's the first thing I did; I just forgot to mention it.

Now, more weirdness.
I downloaded HxD, a very nifty hex editor that can open absolute disk
sectors, partition sectors, and files. First I checked to see is there any
difference between the two MBRs (absolute sector 0) of the two drives. It
appears, that beyond the necessary differences for the partition sizes, the two
MBRs are identical (including the boot code). So the problem is (no longer) the MBR.
Next, I checked the boot sectors (sector 0 of the partition), which is the
one that actually has code to run the NTLDR. And here is the greatest weirdness
I've ever seen. The sector contains, besides the code, error messages - "Ntldr
is missing" and such; and the non-bootable drive contains exactly that. However,
the *other* drive, the one I'm booting with, contains other messages - "Bootmgr
is missing", and the name of the thing to run (in the beginning of sector 1) is
BOOTMGR ! Now, I'm most certain I don't have Bootmgr anywhere on the drive, and
I never did. (Apparently it is the name of the loader for Vista and 7). Could
I have at some point trialled installing Vista or 7? I don't remember; hardly.
Still, that may be a clue. I'm going to try some things in that direction. For
example renaming NTLDR to see if it ever gets to that, and then maybe the
boot.ini suggestion.
 
Patok said:
Sorry, guys, that's the first thing I did; I just forgot to mention it.

Now, more weirdness.
I downloaded HxD, a very nifty hex editor that can open absolute disk
sectors, partition sectors, and files. First I checked to see is there
any difference between the two MBRs (absolute sector 0) of the two
drives. It appears, that beyond the necessary differences for the
partition sizes, the two MBRs are identical (including the boot code).
So the problem is (no longer) the MBR.
Next, I checked the boot sectors (sector 0 of the partition), which is
the one that actually has code to run the NTLDR. And here is the
greatest weirdness I've ever seen. The sector contains, besides the
code, error messages - "Ntldr is missing" and such; and the non-bootable
drive contains exactly that. However, the *other* drive, the one I'm
booting with, contains other messages - "Bootmgr is missing", and the
name of the thing to run (in the beginning of sector 1) is BOOTMGR !
Now, I'm most certain I don't have Bootmgr anywhere on the drive, and I
never did. (Apparently it is the name of the loader for Vista and 7).
Could I have at some point trialled installing Vista or 7? I don't
remember; hardly. Still, that may be a clue. I'm going to try some
things in that direction. For example renaming NTLDR to see if it ever
gets to that, and then maybe the boot.ini suggestion.
Click to expand...

To follow-up - no, renaming and removing NTLDR and ntdetect.com changes
nothing - there's no error message. It just hangs, which suggests the boot code
is not processing them at all. At this point I'm not really sure what to do -
would a repair install be able to correct the issue? I have a backup, but it is
not sector-by-sector, it is the files of the partition, and I'm afraid it won't
make it bootable, if there's some hidden issue there.
I regret not being in the DOS days - there were such nice tools then! There
was Norton Disk Doctor, which, IIRC, had specialized modes for displaying boot
sectors - one could instantly see the disassembled code and the data that went
with it! Now, if I want to see the code, I have to copy and paste into different
programs, and it is not convenient.
Anyhow, I'm checking out the different possibilities outlined in
http://technet.microsoft.com/en-us/library/bb457123.aspx
in the meantime, if anybody has a suggestion for a good disk doctoring
utility, please advise.
 
Patok said:
And now it happened to me. :(

The symptom is the typical MBR screwup - the computer hangs on a
black screen just after completing the POST. Trouble is, the fixes
don't change anything. In Recovery Console, I did:

- fixboot
- fixmbr (it warned that the partition was non-standard)
- replaced ntdedect and ntldr (just in case, they seemed OK)
- didn't fix anything with bootcfg, because it looked quite normal -
just one installation in C:\windows, properly identified, no options
out of the ordinary
It still hangs right after POST, so it is something else. Or it *is*
the MBR, but fixmbr can't fix it.

Can anybody recommend a good MBR edit tool? I'll be checking for such
online, but if somebody knows a good one from personal experience, it will
be
appreciated.
Otherwise, the drive seems quite OK; I have plugged it in an external
USB adapter and I can edit/modify etc.

There is one NTFS partition, using the entire drive. It was created
by using Paragon, copying the backup of the previous (smaller) drive
onto this replacement drive, and extending it to cover the entire disk.
Could
Paragon have done something not quite standard, and that is the
reason for the message from fixmbr, and its inability to fix it?
Click to expand...

Maybe. As you probably know, when you are restoring an image Paragon sets
things up so that it's what boots. However, if that's what happened I can't
fathom why fixmbr didn't fix it.

--

dadiOH
____________________________

dadiOH's dandies v3.06...
....a help file of info about MP3s, recording from
LP/cassette and tips & tricks on this and that.
Get it at http://mysite.verizon.net/xico
 
Sorry, guys, that's the first thing I did; I just forgot to mention it.

Now, more weirdness.
I downloaded HxD, a very nifty hex editor that can open absolute disk
sectors, partition sectors, and files. First I checked to see is there
any difference between the two MBRs (absolute sector 0) of the two
drives. It appears, that beyond the necessary differences for the
partition sizes, the two MBRs are identical (including the boot code).
So the problem is (no longer) the MBR.
Next, I checked the boot sectors (sector 0 of the partition), which is
the one that actually has code to run the NTLDR. And here is the
greatest weirdness I've ever seen. The sector contains, besides the
code, error messages - "Ntldr is missing" and such; and the non-bootable
drive contains exactly that. However, the *other* drive, the one I'm
booting with, contains other messages - "Bootmgr is missing", and the
name of the thing to run (in the beginning of sector 1) is BOOTMGR !
Now, I'm most certain I don't have Bootmgr anywhere on the drive, and I
never did. (Apparently it is the name of the loader for Vista and 7).
Could I have at some point trialled installing Vista or 7? I don't
remember; hardly. Still, that may be a clue. I'm going to try some
things in that direction. For example renaming NTLDR to see if it ever
gets to that, and then maybe the boot.ini suggestion.
Click to expand...



To boot XP

you need


boot.ini
ntdetect.com
ntldr



There should not be bootmgr...
 
Patok said:
To follow-up - no, renaming and removing NTLDR and ntdetect.com
changes nothing - there's no error message. It just hangs, which
suggests the boot code is not processing them at all. At this point I'm
not really sure what to do - would a repair install be able to correct
the issue? I have a backup, but it is not sector-by-sector, it is the
files of the partition, and I'm afraid it won't make it bootable, if
there's some hidden issue there.
I regret not being in the DOS days - there were such nice tools then!
There was Norton Disk Doctor, which, IIRC, had specialized modes for
displaying boot sectors - one could instantly see the disassembled code
and the data that went with it! Now, if I want to see the code, I have
to copy and paste into different programs, and it is not convenient.
Anyhow, I'm checking out the different possibilities outlined in
http://technet.microsoft.com/en-us/library/bb457123.aspx
in the meantime, if anybody has a suggestion for a good disk doctoring
utility, please advise.
Click to expand...

Ok, I tried repair install, and it hangs exactly at the same place. After
copying the files from the CD, the computer reboots, where you'd expect
installation to continue from the HDD, and hangs exactly at the same position -
right after POST. And this is not computer specific - I put the disk into
another laptop, and it behaves exactly the same.
There is some major weirdness going on - after replacing the MBR code, and
the boot code, and doing repair install, it still (apparently) does *not*
process NTLDR, and hangs somewhere before that. (Renaming NTLDR elicits no
response. On a differn computer and disk, renaming NTLDR produces the expected
error message that it is missing.)
The only reason it /could/ do that, according to MS, is if it got confused it
is coming out of hibernation, and went to try to load hiberfile.sys. But if it
were a corrupted hiberfile, it *should* say something (as per MS).
Either there is a hidden/corrupted entry in the root dir, which the boot code
takes to be NTLDR and goes into it, i.e. nowhere, or the same thing happens WRT
hiberfile. The cause (I think) is that I scheduled a chekdisk on reboot. The
shutdown was abnormally long, and I think whatever checkdisk writes to indicate
the volume is dirty, went somewhere else, and corrupted something.

At this point, I can try doing a restore, but since it is a backup of the
logical contents of the partition, excluding the MBR and common bulky things
like the pagefile and such, I have little hope that it will restore whatever
went wrong. If it were a sector-level backup, then yes... but it isn't.
 
In
philo said:
To boot XP

you need

boot.ini
ntdetect.com
ntldr

There should not be bootmgr...
Click to expand...

If there is a bootmgr file, that is part of Vista/Windows 7. For
example, this laptop I am on right now used to have dualboot XP/W7.
Later I dumped Windows 7. I dumped all traces of Windows 7. And repaired
the XP boot system.

Although I believe Paragon was mentioned. Well guess what? The newer
versions of Paragon somehow thinks Windows 7 is still there (it even
states the right build number of Windows 7 in the logs). And it removes
the XP boot system and replaces it with the BCD boot system (what Vista
and Windows 7 uses).

Then I end up with what Patok sees. So Patok, did you ever have Vista or
Windows 7 on this hard drive before? I don't know what Paragon is seeing
that it still believes Windows 7 is still on my hard drive? But I can't
use Paragon on this machine because of this.

In my case, fixboot and fixmbr works to correct it. And I would look at
the boot.ini file again. Here is what it should look like on a drive
with a single partition.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
Professional" /noexecute=optin /fastdetect
 
Patok said:
And now it happened to me. :(

The symptom is the typical MBR screwup - the computer hangs on a
black screen just after completing the POST. Trouble is, the fixes
don't change anything. In Recovery Console, I did:

- fixboot
- fixmbr (it warned that the partition was non-standard)
- replaced ntdedect and ntldr (just in case, they seemed OK)
- didn't fix anything with bootcfg, because it looked quite normal -
just one installation in C:\windows, properly identified, no options
out of the ordinary

It still hangs right after POST, so it is something else. Or it *is*
the MBR,
but fixmbr can't fix it.

Can anybody recommend a good MBR edit tool? I'll be checking for such
online,
but if somebody knows a good one from personal experience, it will be
appreciated.

Otherwise, the drive seems quite OK; I have plugged it in an external
USB
adapter and I can edit/modify etc.

There is one NTFS partition, using the entire drive. It was created
by using Paragon, copying the backup of the previous (smaller) drive
onto this
replacement drive, and extending it to cover the entire disk. Could
Paragon have done something not quite standard, and that is the
reason for the message from fixmbr, and its inability to fix it?

How it happened:
I was working using ZoneOs ZoneScreen to extend my desktop to another
adjacent laptop, using the second laptop as a second monitor (the two
laptops using the firewire connection for that). At some point, I
stupidly dragged the NVidia control panel from the master desktop to
the extended, forgetting that it is not a real display, and it didn't
work and screwed up ZoneScreen so that the desktop could no longer be
extended, just mirrored. So I decided that it was time to run
checkdisk on the master anyway, and had it scheduled on reboot, and
rebooted. What I noticed was that it took unusually long to shut
down, and that was that. On reboot, it hung.

In case someone asks, the computer itself is fine. I'm using it to
write this message now, having replaced the unbootable drive with the
previous one. It is (because older) still SP2, and I notice that
NTLDR has a different date and is binary different in places. Did
they change NTLDR between SP2 and SP3? Should I replace the SP3
NTLDR with the SP2 one?
Click to expand...

Just a thought, have you tried clearing the BIOS?
Buffalo
 
XP's file: [ntldr]

SP2 = Name: ntldr Size: 250,032 Date: 08-04-2004
SP3 = Name: ntldr Size: 250,048 Date: 04-14-2008

If you have installed XP Service Pack 3, then you should have a copy of the
correct (sp3) version of [ntldr] in your : C:\WINDOWS\ServicePackFiles\i386
folder (XP x86 32-bit).

Try booting with an XP install disk and choose the option :

To repair a Windows XP installation using Recovery Console, press R.

....check that the file [ntldr] in the root of C:\ is of size 250048 (by
typing "dir") and if it is not, then copy the correct [ntldr] from the
folder (quoted above) to the root of your system drive.

copy C:\WINDOWS\ServicePackFiles\i386\ntldr c:\

*NB If you get an "access denied" message, you may need to remove hidden
and read-only attributes by issuing the following commands before the copy
command will overwrite [ntldr] :

attrib -h ntldr
attrib -s ntldr
attrib -r ntldr

Next, still in RC, try typing the following commands :

FIXMBR
FIXBOOT C:

Theory: Your observed errormessage BOOTMGR is missing is a symptom that
Win7 (or Vista) has, at some point, at least attempted to install itself
(at least as far as to overwrite sector 0).

I have seen this problem before, and it has been fixed by starting the XP
Recovery Console (RC) and issuing the FIXMBR then FIXBOOT C: commands.

This will repair the MBR and then re-write the XP bootsector that loads
[ntldr] instead of the Vista / Win7 code that tries to load [bootmgr]

==

Cheers, Tim Meddick, Peckham, London. :-)
 
In
Patok said:
Ok, I tried repair install, and it hangs exactly at the same place.
After copying the files from the CD, the computer reboots, where
you'd expect installation to continue from the HDD, and hangs exactly
at the same position - right after POST. And this is not computer
specific - I put the disk into another laptop, and it behaves exactly
the same. There is some major weirdness going on - after replacing
the MBR code, and the boot code, and doing repair install, it still
(apparently) does
*not* process NTLDR, and hangs somewhere before that. (Renaming NTLDR
elicits no response. On a differn computer and disk, renaming NTLDR
produces the expected error message that it is missing.)
The only reason it /could/ do that, according to MS, is if it got
confused it is coming out of hibernation, and went to try to load
hiberfile.sys. But if it were a corrupted hiberfile, it *should* say
something (as per MS). Either there is a hidden/corrupted entry in
the root dir, which the boot code takes to be NTLDR and goes into it,
i.e. nowhere, or the same thing happens WRT hiberfile. The cause (I
think) is that I scheduled a chekdisk on reboot. The shutdown was
abnormally long, and I think whatever checkdisk writes to indicate
the volume is dirty, went somewhere else, and corrupted something.
At this point, I can try doing a restore, but since it is a backup
of the logical contents of the partition, excluding the MBR and
common bulky things like the pagefile and such, I have little hope
that it will restore whatever went wrong. If it were a sector-level
backup, then yes... but it isn't.
Click to expand...

Are you trying to boot from an USB drive, Patok?

If not, remove all external devices for starters. Printers, external
drives, extra keyboards and mice. And try to boot up with the bare
minimum hardware that you can. And if that doesn't work, I would try
removing all of the internal hardware you know you don't need. Like
optical drives and even extra memory (then swap the removed memory with
what was left).
 
Patok said:
Ok, I tried repair install, and it hangs exactly at the same place.
After copying the files from the CD, the computer reboots, where you'd
expect installation to continue from the HDD, and hangs exactly at the
same position - right after POST. And this is not computer specific - I
put the disk into another laptop, and it behaves exactly the same.
There is some major weirdness going on - after replacing the MBR code,
and the boot code, and doing repair install, it still (apparently) does
*not* process NTLDR, and hangs somewhere before that. (Renaming NTLDR
elicits no response. On a different computer and disk, renaming NTLDR
produces the expected error message that it is missing.)
The only reason it /could/ do that, according to MS, is if it got
confused it is coming out of hibernation, and went to try to load
hiberfile.sys. But if it were a corrupted hiberfile, it *should* say
something (as per MS).
Either there is a hidden/corrupted entry in the root dir, which the
boot code takes to be NTLDR and goes into it, i.e. nowhere, or the same
thing happens WRT hiberfile. The cause (I think) is that I scheduled a
chekdisk on reboot. The shutdown was abnormally long, and I think
whatever checkdisk writes to indicate the volume is dirty, went
somewhere else, and corrupted something.

At this point, I can try doing a restore, but since it is a backup of
the logical contents of the partition, excluding the MBR and common
bulky things like the pagefile and such, I have little hope that it will
restore whatever went wrong. If it were a sector-level backup, then
yes... but it isn't.
Click to expand...

One last follow-up before I start forgetting. In short, I fixed the problem,
but I did not find out to my satisfaction what exactly happened. As I don't have
time to sleuth it out now, I'll just report the findings, and maybe get back to
it later.

- Conclusion (tentative): the corruption happened to some entry in the root
directory, which waylaid the boot loaders. Both the custom Paragon and the
native XP (Fixboot) loaders hung; renaming or removing NTLDR produced no change,
the code never looked for it. The custom boot code that Paragon B&R 2010 Free
Advanced writes into the first sectors of the partition looks like a cross
between the XP and the Vista/7 boot codes. The first sector contains references
only to BOOTMGR, while in the next sectors NTLDR is mentioned too. The
corruption that happened (however it did) was not in this code; using Fixboot on
the partition left it unbootable. To confirm the suspition, I'll have to, at
some later time, rename NTLDR on the (now bootable) partition, to make sure the
boot code really uses it and will miss it.

- The partition looked fine, but in Repair Console, bootcfg /repair (or whatever
the option was called to rebuild boot.ini) said that there was no valid Windows
installation. I think that's important, although all files and directories were
fine (read below).

- I restored the partition to its (almost) exact state from right before the
crash, by doing the following:
- using the Paragon boot CD, I backed up the malfunctioning partition
- restored from the previous backup (weeks old); this restore was booting fine
- from the backed up malfunctioning partition, I copied the system folders
(D&S, Windows, Program files, System Vol.Inf. and Recycler), replacing their
current contents
- booted into this chimeric disk and did a system restore to the last restore
point (created a couple of hours before the crash).

That's it for now.
 
Back
Top