Virus attack - ntldr missing

vinzbiz · 08-18-2003, 09:14 AM

Hi,

My pc was attacked by a virus and on re-booting, it says "NTLDR is missing" and "press any key to continue". No amount of key-pressing can load the windows.

I have tried console recovery with the "fixboot C" and "fixmbr C" commands but to no avail. (I dared not use "fixmbr" without entering the device name because there is a warning that the partition table info may be lost. I am also not sure if the way I use the command is correct, and would appreciate any comment on that).

I have even tried re-installing Windows, also to no success. My operating system is Windows 2k.

My question is, is there any way I can retrieve the data from the hard-disk before taking the last resort, i.e. reformatting the whole thing? There doesn't seem to be any way to access the D: drive (where the crucial data is stored) via DOS at this juncture.

Any help/comments will be appreciated. Thanks.

meese · 08-18-2003, 09:34 AM

Make that drive a slave in another pc. (Make sure you have an updated antivirus program running

). You should be able to read and copy the data from the bad drive even though you can't boot the drive.

zskillz · 08-18-2003, 01:57 PM

what meese says is surefire. that will get the data.

the only workaround for this problem that i have found is to install windows again OVER the old version... it will ask you when you boot if you want to install a new version or repair...

choose to install...

it will then search for previous version of the OS and give you the option to repair that version... this time choose repair. you will lose all the service packs and the critical updates and the such, but as far as I have found, the remainder of the OS is completely intact. accounts still exist and other programs still work just fine.

-Z

vinzbiz · 08-18-2003, 08:35 PM

I am now reinstalling Windows and this time it's working! Thanks guys, all of you. You're the greatest :-)

sup3rcarrx7 · 08-18-2003, 10:05 PM

Hey vinbiz i've had that problem at least FIVE times in the past two days. What i did was insert my Windows 2kpro Setup disk and choose to Repair, then choose the Manual repair and it'll eventually find a bad file (it found the same file you have corrupt) and then choose to 2nd option. The 2nd option will re-install every dll file and exe file that is in your WinNt folder, so be prepared to be dealing with IE 5 for a while until you update again. Hope this helps.

vinzbiz · 08-19-2003, 06:11 AM

Hi sup3rcarrx7, I tried that, but the machine failed to boot from the CDROM for no apparent reason. So I had to boot from the floppy, go through the 4 boot disks, and choose to install windows. After that the puter re-boots itself and this time it correctly starts from the CDROM, but it never ask me if I'd like to repair. It simply reinstalled Windows.

Still, it's bad news... the virus seemed to also delete all the crucial MSWord documents I tried so hard to recover. I've tried many data recovery softwares out there (Demo versions), and to my short-lived joy, they are able to correctly find the files and recover them, but they all come out as gibberish Word Documents. Sigh... anyone got anymore ideas, please?

meese · 08-19-2003, 06:28 AM

The msblast virus did not corrupt files. Although it caused the pc to reboot and what not, it did not destroy files. The first thing you should have done before reinstalling anything on the drive was try to backup your data. For one you don't know when the data got corrupt, was it before the reinstall, caused by the virus or what. Second, you don't want to take the chance that a reinstall can go bad and jeopardize your data.

vinzbiz · 08-19-2003, 11:13 PM

Thanks for the advice. I have learnt from this experience to never take chances when it comes to puters. BTW, it's not the msblast that got my puter, but the Worm_Oror.L.