I was called in this weekend to troubleshoot a production NT server that when rebooted only gave the error “NTDETECT failed”. After booting from a NTBOOT disk a discovered that NTDETECT.com was missing. I copied the NTDETECT from the floppy to theserver and rebooted. System up and working. Not feeling very sure on why a system file would suddenly show up missing, I checked another server that runs the same processes as this server and discovered that NTDETECT was missing from this server as well. I then checked our other servers and did not find any more missing NTDETECT. So upon coming in today I had the two servers checked again to insure they were still okay and NTDETECT was missing again. I’m going to turn on auditing to see ifI can find when the files are being deleted and hopefully by whom. That said has anyone seen this before? I checked for any know viruses that would target NTDETECT and only found the Melissa virus. This machine does not have Outlook on it or the Microsoft Office suite. So I think it can’t be this. Please send me your thoughts. Thank You.
