My XP crashed and I wonder if it's done by virus.

[baby]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing. I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

 

[Kinell]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing. I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

Based on the limited evidence, this doen't sound like a malware
problem. I'd first check for a hardware fault.

The prime suspects would be memory and/or hard disk. If you don't
already have them, use a working PC to download and create boot
diskettes for MEMTEST86 and the diagnostic utility from the website
of the mfr of your hard drive. Create boot diskettes for each and
run both tests on your PC.

 

[David]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing. I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

Hi,

Your XP installation disk has utilities.
If you insert the disk, it will give you an option to repair a current
installation.
Try Fixboot for example.

Good luck.

Regards

David.

 

[Duane ;-\)]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing. I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

Google or Dogpile.com are your friends.

http://www.computerhope.com/issues/ch000465.htm

Duane

 

[Colon Terminus]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing. I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

Kinell has nailed it.
Hardware problem.
RAM or hard disk.
Follow his instructions and test your memory and HD.
You also might wanna upgrade to the latest BIOS.

 

[Zvi Netiv]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode".

Did things degrade gradually, i.e. was the multiboot menu available for a few
startups after the computer crashed, or didn't it show even once after the
crash?

Now it even tell me NTLDR is missing.

By "now" you mean that you have been trying things, unsuccessfully, until it
ended this way? What did you try, exactly, to deteriorate the condition to the
current one?

The answer to the above questions is important to determine the exact problem
and suggest a recovery plan.

I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

You are on a false track and what you need is disaster recovery, not AV! To
further investigate, then please answer the questions above and do as follows:

Download RESQ from www.resq.co.il/resq.php and prepare a bootable RESQ floppy
(should be done on a Win 98 PC, as instructed in the ResQ welcome message). If
Win 98 is not available to you, then download also the FreeDOS boot floppy maker
from www.resq.co.il/iv_tools.php#FreeDOS To make a RESQ boot floppy with it,
do as follows:

Format a floppy from the CMD shell (don't use Windows' native formatting) from
the command line FORMAT A: /U Open the FreeDOS self-extract archive and let it
make the floppy bootable. Now open RESQ.EXE, clear the two check marks
(overwrite files, and [don't] execute Makeresq) then press the 'unzip' button.

Boot from the RESQ floppy just made (leave the diskette write-enabled in the
drive) and when at the A: prompt, run RESQDISK /ASSESS

ResQdisk will go through an assessment cycle of the hard drive and will write
its findings into a text file report named RESQDISK.RPT, in A:\. Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report by pasting the text file into your follow-up.

If the problem is what I think it is, then make sure to write nothing to the
drive until having fully assessed its condition. Some of the advice you were
given ("Fixboot" for example) may cause more damage than help!

Regards, Zvi

 

[Mich]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing. I'm wondering if Mcafee or Norton has
anyway to create a floppy disk that I can use to scan my
computer like the old days. How to create one?

********************************************

The NTLDR does go missing once in a blue moon, this is how to replace it,
The other posts in the thread are right about possible HW issue's too.


Using the Recovery Console, copy the Ntldr file from the Windows XP CD-ROM
to the root directory of the current active partition. Follow these steps:
1. Start your computer by using the Windows XP Setup floppy disks or by
using the Windows XP CD-ROM.
2. At the "Welcome to Setup" screen, press F10, or press R to repair.
3. Press C to start the Recovery Console.
4. Copy the Ntldr file from the Windows XP CD-ROM to the root of your system
partition by using the following commands, pressing ENTER after each
command:

1. Type cd .. to go to the root of drive C. (Note the space)
2. Type the letter of the CD-ROM drive
3. Type cd i386 to change into the right directory
4. Type Copy ntldr c:
5. Type Exit

If the partition was not formatted by using Windows, you might also need to
run the Recovery Console fixboot command to make the active partition
bootable.

After you can boot into Windows, it is recommended that you use the Windows
Disk Management snap-in tool to reset the original system partition as the
active partition, and then restart the computer.

Mich...

 

[Zvi Netiv]

********************************************

The NTLDR does go missing once in a blue moon, this is how to replace it,
The other posts in the thread are right about possible HW issue's too.

The NTLDR does go missing for many reasons, of which the genuine disappearing of
the file, or its corruption, are in minority! The more frequent causes are the
incorrect setting of the drive in the CMOS, certain changes in the partition
table (e.g. changed number of heads), changes in the boot sector BPB, and a
corrupted MFT.

Using the Recovery Console, copy the Ntldr file from the Windows XP CD-ROM
to the root directory of the current active partition. Follow these steps:

Risky advice!

Just as you won't apply bypass surgery right away to every patient that is
brought into ER with pains in the chest, you don't start repairing right away
every time that you see "NTLDR is missing". If the problem is any of those
described above, then by rushing with the repair console, you risk doing more
damage than help, to the point that you may convert a recoverable problem into
full blown disaster.

There are several methods to test whether it's safe to copy NTLDR or apply the
repair console procedure.

Regards, Zvi

 

[Frank Booth Snr]

My XP system has Mcafee installed and the virus definition
is updated. But it crashed in mid of normal operation - Web
browsing. I wasn't doing SW or HW installation. Upon
restarting, it no longer loads Windows with either "Last
Known Good Configuration" or "Safe Mode". Now it even tell
me NTLDR is missing.....

There lies the clue. It's nothing to do withe a virus. One of your basic 3
boot up files, which includes ntldr may be corrupted and needs to be
recopied to the C:\ drive folder. What make is your computer? Do you have
an XP system disk?

 

[Mich]

The NTLDR does go missing for many reasons, of which the genuine disappearing of
the file, or its corruption, are in minority! The more frequent causes are the
incorrect setting of the drive in the CMOS, certain changes in the partition
table (e.g. changed number of heads), changes in the boot sector BPB, and a
corrupted MFT.
steps:

Risky advice!

*****************************************************


First. There is nothing "risky" about that advice.
Second. Almost nobody has to manually adjust their BIOS/CMOS settings
anymore
almost every BIOS is set to automatically detect the hard drive and is
capable of doing so without user intervention.
And the Post has no mention of CMOS changes.


Mich...

 

[David W. Hodgins]

First. There is nothing "risky" about that advice.

I agree with Zvi. If the geometry of the drive has been changed, due to
a virus/trojan/dead battery, etc., any attempt to write to the drive
will only further corrupt the contents.

Second. Almost nobody has to manually adjust their BIOS/CMOS settings
anymore
almost every BIOS is set to automatically detect the hard drive and is
capable of doing so without user intervention.

You'd be amazed at how many older computers are still on the net. Last
week, the flashable bios on my 14 month system "died". While I was
getting it replaced, I was using my old P1 backup, to access the net.
It's battery is dead, so I had to manually reset the cmos, including
overrideing the drive geometry, each time I powered it up.

And the Post has no mention of CMOS changes.

Since the bootloader cannot find ntldr, one of the probable causes is
a change to the geometry being used to access the drive. Since any
attempt to write to the drive, if this is the case, would corrupt the
contents further, it makes sense, to rule out this case first, even
if it has a lower proability, than other causes. At least, that's my
opinion.

Regards, Dave Hodgins

 

[Zvi Netiv]

First. There is nothing "risky" about that advice.

Read http://www.computerhope.com/issues/ch000465.htm. Where working geometry of
the drive is affected, the file system will show as corrupt. The last thing you
want to do in such case is to write to the drive and replacing NTLDR should NOT
be attempted as it will permanently corrupt the file system.

Second. Almost nobody has to manually adjust their BIOS/CMOS settings
anymore almost every BIOS is set to automatically detect the hard drive and is
capable of doing so without user intervention.

Indeed, and here is how drive auto-detection actually contributes to the
problem. The BIOS auto detect routine first reads the MBR of all installed hard
drives and sets the parameters in the BIOS equipment list to best match the data
in the partition table(s). The manufacturer's drive parameters govern the
auto-detection only if the partition table is inconsistent, or blank.

And the Post has no mention of CMOS changes.

Naturally. If the OP knew what the problem is then he wouldn't need asking.

Bottom line: Never copy NTLDR before checking the integrity of the destination
file system. This can be done by running a DIR C: command from the repair
console command line.

Regards, Zvi

 

[Zvi Netiv]

I agree with Zvi. If the geometry of the drive has been changed, due to
a virus/trojan/dead battery, etc., any attempt to write to the drive
will only further corrupt the contents.


You'd be amazed at how many older computers are still on the net. Last
week, the flashable bios on my 14 month system "died". While I was
getting it replaced, I was using my old P1 backup, to access the net.
It's battery is dead, so I had to manually reset the cmos, including
overrideing the drive geometry, each time I powered it up.

The computer need not to be old for that, the same effect exists on new
computers with up-to-date mobo and BIOS, due to the way the BIOS auto-detect
routine works. In all BIOSes since about '96, the autodetect procedure starts
by trying to match a best fit set of parameters to the drive, according to the
content of the partition table found in the MBR.

Since the bootloader cannot find ntldr, one of the probable causes is
a change to the geometry being used to access the drive. Since any
attempt to write to the drive, if this is the case, would corrupt the
contents further, it makes sense, to rule out this case first, even
if it has a lower proability, than other causes. At least, that's my
opinion.

Ruling out a corrupted file system is rather simple. All that it takes is a DIR
C:\ command from the repair console command line. Almost as simple as issuing
the command FDISK /STATUS before attempting FDISK /MBR. ;-)

Regards, Zvi

 

[Mich]

Read http://www.computerhope.com/issues/ch000465.htm. Where working geometry of
the drive is affected, the file system will show as corrupt. The last thing you
want to do in such case is to write to the drive and replacing NTLDR should NOT
be attempted as it will permanently corrupt the file system.


Indeed, and here is how drive auto-detection actually contributes to the
problem. The BIOS auto detect routine first reads the MBR of all installed hard
drives and sets the parameters in the BIOS equipment list to best match the data
in the partition table(s). The manufacturer's drive parameters govern the
auto-detection only if the partition table is inconsistent, or blank.


Naturally. If the OP knew what the problem is then he wouldn't need asking.

Bottom line: Never copy NTLDR before checking the integrity of the destination
file system. This can be done by running a DIR C: command from the repair
console command line.

Regards, Zvi

Funny, I have on EVERY occasion replaced the NTLDR using the technique I
posted when it went missing and not once, have I ever had a problem.
It has never been a hardware problem in any of my cases.
I stand by my post.

Mich...

 

[Zvi Netiv]

Funny, I have on EVERY occasion replaced the NTLDR using the technique I
posted when it went missing and not once, have I ever had a problem.
It has never been a hardware problem in any of my cases.
I stand by my post.

Sensible people learn from others' experience, you-know-whom learn only from
their own.

Regards, Zvi

 

[Norman L. DeForest]

Sensible people learn from others' experience, you-know-whom learn only from
their own.

Indeed.

Experience is learning from your mistakes. Education is learning from
other people's mistakes.

A medical parallel:

Constipation can cause abdominal pains. Taking a laxative can get rid of
those pains. You may have taken a laxative many times with good results.

Appendicitis can cause abdominal pains. Taking a laxative when that is
the cause of the pain can kill you. It can cause your appendix to rupture
sooner than it would have without the laxative and before you can get to
appropriate medical treatment.

After learning what a laxative can do when you have appendicitis, do you
still want to take a laxative for the next abdominal pain you get?

Perhaps nine out of ten times, constipation is the problem. Do you want
to gamble that the next time will be one of those nine?

 

[Frank Booth Snr]

Read http://www.computerhope.com/issues/ch000465.htm. Where working geometry of
the drive is affected, the file system will show as corrupt. The last thing you
want to do in such case is to write to the drive and replacing NTLDR should NOT
be attempted as it will permanently corrupt the file system.

The webpage you refer to doesn't say that at all, regarding permanent
corruption of your disk by trying to replace NTLDR on it. You are talking
twaddle. The working geometry of the drive is set up by low level and high
level formatting . Even if a boot virus was written to the boot sector,
writing NTLDR would not damage the disk. As long as the disk is physically
sound, it's possible to low format it removing all partitions and then
re-partition, high level format it and start downloading the system files
again.

 

[David W. Hodgins]

The webpage you refer to doesn't say that at all, regarding permanent
corruption of your disk by trying to replace NTLDR on it. You are talking

Zvi didn't say anything about damage to the disk, just the file system.

twaddle. The working geometry of the drive is set up by low level and high
level formatting . Even if a boot virus was written to the boot sector,
writing NTLDR would not damage the disk. As long as the disk is physically
sound, it's possible to low format it removing all partitions and then
re-partition, high level format it and start downloading the system files
again.

Have fun recovering any data, after that. The thread's been about recovering
the file system.

Regards, Dave Hodgins

 

[Frank Booth Snr]

talking

Zvi didn't say anything about damage to the disk, just the file system.


Have fun recovering any data, after that. The thread's been about recovering
the file system.

That may have been the original thread, but not the point I was replying to,
which the pp made.

 

[Robert Green]

That may have been the original thread, but not the point I was replying to,
which the pp made.

I think some posters don't quite understand what Zvi has been talking
about. To clarify the matter (I hope) here is an excerpt from a
diagnostic taken on a customer's drive this morning:

Drive 1 C: 32301 H: 240 S: 63 Size: 249GB Last LBA: 488397168


Master Boot Record (corrupted)

0 X 114 144? 111 11 126? 101 51 218129509 17019904?
0 R 116 482? 115 3 841? 114 44 729050177 543974724
0 R 101 111? 111 41 111? 115 52 168653938 0


Candidate NTFS Partition

63 M 7 0 1 1 8123 209 63 63 122832927 Unknown
63 $ 8 63 122832926 255 63 786432 7920041 47072 0 [00]


From the initial line (begining "Drive 1") note that the BIOS is
translating with 240 heads.

Next, note obvious corruption of the MBR.

Next, see the line begining "63 $", which records data from the boot
sector of an NTFS partition in the first position. The values shown as
"255 63" are the heads and sectors values from the BPB, so we know
that when the partition was formatted the BIOS was translating with
255 heads.

The discrepancy occurs because, as Zvi wrote, the corrupted MBR causes
the BIOS auto-detect to mistranslate.

If I were to rebuild the MBR without noticing this, then any attempt
to boot the system would result in "NTLDR not found...", since the
IPL's attempt to read the MFT would fail. The mistranslation would
lead to a wrong address being used (the NTFS boot sector IPL uses CHS
mode addressing if the boot partition is located inside the 8GB
threshold).

What would happen if you tried to copy over a new NTLDR in this case?
I'm not entirely sure, but I doubt it would do any damage, assuming
the partition would even mount so that you could access it from
Recovery Console, since sector addressing would be in LBA mode at that
point (I think).

The correct translation can be restored by just zeroing the MBR and
rebooting.

Also, I would note that the "NTLDR is missing" error is the result of
a corrupt MFT 9 times out of 10, at least in my experience.

Bob