ntldr is missing, ctrl alt del

Hi there,

I tried to help my boss by cleaning his computer, because it was acting funny and had malware on it. Specifically conduit, productivity toolbar 3.1, and wajam. I uninstalled conduit one, tried productivity one but it wouldn't uninstall, finally used revo uninstaller to uninstall it, wajam was found by malware bytes scan I did next.
Malware bytes scan found 125 items, all related to those three above. I deleted them all. It said I must restart my machine. I did.
Now it comes up with a black screen of death and the message NTLDR is missing press ctrl alt del to start.
When I press ctrl alt del, it goes right back to the black screen, same message.
Help! Please help me to get his computer to restart, I'm used to seeing a screen that's blue and will give me an option to restore to last known good point.
Help please!
Rebecca.

 

I am also researching options of what to do on the internet, if I should not be doing this please let me know. I'll keep you posted on what I do and what the results are. Thanks.

 

So I tried the instructions located here:
http://www.resoo.org/docs/ntldr/ntldrismissing.htm
And instead of getting the try this options I got bootable CD could not be read, press any key.
When I pressed any key it repeated the message, pressing ctrl alt del got me out of that message and right back into my original message of ntldr is missing, press ctrl alt del.

Please help! I feel terrible that I broke his computer.

Thanks.

 

Sorry, I'm so panicked I forgot to tell you, his computer is running Windows XP Pro SP3. Thanks for any help anyone can give me. The information on this site
http://support.microsoft.com/kb/320397
is confusing to say the least and doesn't seem helpful so far, I'm worried about doing more damage in the long run, so I'm going to wait for a response from you guys.

Rebecca.

 

Thank you, I mistakenly thought it was malware related because that was the last thing I did before this happened. Will the replies still appear with this thread?

 

No, I've found two discs for Windows XP Home Edition, but I can't seem to find the disk for the XP Pro installed on this computer. If I can find them would it help?

 

There is no disk to be found anywhere. So I'm working without an install disk or recovery disk.

Thanks again for your help.

 

So I'm trying it and following instructions but I keep getting stuck. When I get to the part where it says get the files from the dos folder, then it says "Error - The specified drive is currently used by other applications. Please close them before formatting the device."
I've tried 3 different usb drives, the third one being a new one I just went out and bought, the smallest they sold was 4GB, so I can't use one that's less than 2GB as it suggests.
Is there another way to get the files from the instructions screen to the usb drive? Are we sure the other computer will even boot from a usb?
I'm going to try a CD-R right now to see if that works. A 700 MB one.
I'll let you know how it goes, I'm doing it right now.

 

So I managed to get the file downloaded for the CD-R disc. I tried to burn it to the disc using the program he said: isorecorder. But I couldn't find it in the program list, and whenever I tried to copy the contents to the CD it opened CD Recording Wizard, which I think is a windows program and not the one he wanted me to use. It seemed to do it, so I did, but it bothered me that the program I was supposed to use didn't open when it should have.
I put the CD in the computer, tried #1 first, it simply took me back to the list of ten items to try. So I tried #2. I got error message #2. The results were the same for 2-8. When I tried 9 it froze the computer on the dos screen and nothing would work, not esc, not arrow keys, nothing. so I restarted the computer by turning it off and then on again.
When I got back in I tried #10, it took me back to the list again like #1 did. I tried #1 again, I got as far as seeing the Windows XP load up screen, one swipe of the bars at the bottom saying it's thinking, and then back to the list of 10 choices. So I figured that was a good sign and did #1 again. This time I got the dos screen showing to choose to start normally, and other choices including safe mode etc. I tried starting it normally, it would not start, reverted to the 10 choices again. Tried that twice, no go, so then I tried choosing "Last known good configuration". It loaded Windows. I was able to sign on and am now in Windows.
Does this mean it's fixed? What time period did it go back to? Is it possible it went back to a time period when there was malware on the computer? Basically I'm afraid to touch it now, is it safe to shut it down and try to restart? Should I check for malware again? How do I ensure it will restart normally next time? Should I set a restore point in case I need it to one day go back to last known good configuration?
Thanks for your help so far, I guess I need reassurance now that everything is ok, or suggestions on what to do if it's not ok. Is it ok to remove the disc now? Should I reset the boot options to the hard drive instead of the disc drive?
Thanks for your time. Looking forward to his computer working, felt like a heel all day for breaking it by simply cleaning it. Ugh.

 

So I tried to restart it and it came back with the same ntldr error message. So I put the disc back in, did what it said with copying the files to the C drive and changing start up options to 1 second.

This doesn't seem like a true fix to me but rather a work around. Is there a way to truly fix it?

I look forward to your advice. I'm going home for the night and will readdress this in the morning.

Thanks for your help and the help of that developer who created the disc.

Please let me know if I should do something else, I'm scared to run cleaners on it or do much else without instructions. I had no idea malwarebytes could do that.

 

Wow, being responsible for your boss's computer. That probably carries more potential risk than being put in charge of your boss's kids. You've got some big brass ones, my friend. In any case, you restored the system by using the Last Good Configuration which consists only of system settings. That's good because now we know that you probably didn't delete or corrupt any necessary boot-related files when this thing blew up. Can't say for sure because I don't know what is on that boot disk of yours. Creating a restore point is certainly a good idea, regardless of potential malware. You just want to make sure the system boots again. To that end, I suggest that you run the Windows System File Checker by doing the following:

• Click on Start Button
• Choose "Run"
• When the Run box opens, type the following: sfc /scannow
• Note there is a space between "sfc" and "/scannow"
• Click OK or press Enter

The program will check to see if any system files or settings are corrupt and if so, replace or repair them. It should take about 10 - 15 minutes to finish.

Then you should scan the system again with the Malwarebytes Anti-malware program. Don't worry about doing anything bad to the system - you're only going to scan the system (full scan). Don't clean up or delete anything.

When you finish those tasks, check back here and tell us what happened.

 

Think you will need to see if you can get your hands on an installation disk of Windows XP SP 3.

I have seen this site referenced here on MG before, so I will pass it on to you:

http://dreamsupport.us/

Go down to "Lots More Windows XP Tools" and click the link. Follow the instructions to get to the next page. Beyond the link is a page with more links. Select Windows XP. Choose the FOR-CLIENTS version...

:major

 

So i tried the first advice, and i got stopped almost immediately with this error message: files that are required for windows to run properly must be copied to the DLL cache. Insert your windows xp pro sp3 cd now. This happened many, many times, so i canceled that program and moved on to the second advice. I'm burning the XP disc now (using a DVD because that's all i had) and then I'll go back to the first advice but put the disc in this time.

 

So i put the windows XP disc in when it suggested i do so, now a blue window popped up saying what do you want to do. The choices are: install windows XP, learn more about the set up process, install optional windows components, perform additional tasks, check system compatibility. Do i close this window and let the run command do its thing, that window is still open behind this one, or do i choose an option? If so, which option?

 

Before I heard back from you, the background run task had finished, so I closed the blue window and continued with the instructions, running malwarebytes. It found nothing! Does this mean we're finished and it's safe for me to give back to my boss?

Should I remove the start up from "1st choose this" to some other option?

Thanks for all your help, it's helpful to have that disc now in case it asks for it again.

 

PS, I don't know how to remove the program that original rescue disc had me install, so if it's supposed to be starting up using something other than the "1st try this" option, then I'll have to do something to it because as of now it still starts up that way.

Thanks.

 

@hometechy...

Think you are finished. You'll be able to impress your boss with the XP Pro disk when you give the PC back to him/her LOL.

Just recommend reboot and then surf around the internet some and play a YouTube song or some HD video. Then start MS Office or the largest program on the PC and run it to make sure everything is normal. Then reboot again as a final test.

Just for the record for this type of problem, with the CD for installing Windows, when the menu pops up, you would select Install Windows XP and then from the next menu select the Repair Windows option. This preserves files and programs, but all the updates must be reinstalled from Microsoft with the exception of service packs. Don't think you will need to this the way it sounds from your posts...

One question...do you still have to use the "1st try this" CD to boot? You may need to run the XP repair...not sure but I don't think so, if inserting the disk during an SFC /SCANNOW is what you did. Usually SFC /SCANNOW repairs fix the problem...

 

Thank you so much everyone for your help! You saved my neck as far as my boss is concerned. He's impressed I knew where to go for help and I talked you guys up alot!
It seems to be working ok, except for still starting the rescue way.
I can't thank you guys enough. Is there a way to donate to the cause? You've helped me so much, the least I could do is give a little bit back.
Thanks a million my majorgeek friends. I couldn't have done it without you guys!

 

@hometechy...

You're welcone.

Someone around here can probably help you get rid of the unnecessary start options if you would like to stick it out.

I can't tell if the fix you ran that added the files (the 1-10 options fix) actually added the extra boot options or if they are just on the disk (not the xp disk...the other one). If that disk is still required to boot, that would be something I would want to have repaired for sure, and it can be repaired. If that disk isn't needed to boot and there are just some extra options during the boot sequence, the choice would be yours whether you would like to have them removed. In this case, one of the big guns might have to help you fix the master boot record (MBR) or something along those lines...

These kinds of problems are often left in the wake of malware removal. It's difficult to remove the malware without damaging Windows to a certain degree, because some malware alters system files. Simply removing the alterations can leave a hole in the system. For example, I doubt ntldr was actually missing. Actually, probably what was missing was a reference to one of the malware files removed, the malware having altered ntldr so that Windows, operating on altered instructions in ntldr, would be required to look for the malware file to complete the sequence. The whole thing is really sleazy..

 

Thanks for the advice and info. I did transfer three of those files that do the "1st try this" options to the C drive. If I remove them, the computer should restart by itself now that we fixed the system files, correct?

I'll try removing them tonight when he's not using his computer and see if it restarts.

Thanks again! Is there a way to donate to major geeks?

 

@hotetechy...

I thought after all these posts I would have known this, but I didn't. I was sure it was possible to donate, but apparently a thanks and as much of a recommendation as is deserved from the site is all that the MG staff accepts.

However, LOL, maybe you could stop by the shop and patronize the Major by buying something coooool:

http://shop.majorgeeks.com/

Just kidding, actually, but, while searching for a way to donate, I noticed the store for the first time today. Lots of great miscelanity...

Let us know if you have any troubles after removing the files. Not sure if that is all there is to the extra boot menu, but I guess removing them is the only way to find out. Won't cause any damage that can't be fixed anyway...

 

Hey hometechy, one last thing. Given that the computer was infected, you should really do another system scan using a full-fledged antivirus scanner, in addition to the Malwarebytes scan. If there isn't a scanner installed on the system you can use an online scanner at:

http://forums.majorgeeks.com/showthread.php?t=149856

 

HI AtlBo:

I finally got a chance to try removing those files that I had pasted into the C drive, the ones recommended by the ntldr disc to copy over. After doing the fix with the Windows XP disc it was supposed to make it so the computer would start without those files pasted in there.
Instead as soon as I restarted I got the same ntldr message.
So I put the disc back in and restarted the machine, and repasted those files into the C drive so it'll start again without that disc.
I would love to fix it properly and not need to start it with the "1st try this" option. Also, his computer is very slow now, takes almost 5 minutes or more to load Outlook. Used to only take about a minute and a half.
We use comodo antivirus free that is always running, and we run CCleaner and malware bytes on a regular basis.
Sorry I can't donate, I will definitely buy some merchandise instead!
Thanks. Looking forward to it working properly again.