IT Employment

Ask something
Discussion Locked

Windows 2000 NTLDR & Virus

0 helpful
12 replies

by mrs_doctor_jones

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Day 1: Win 2k Pro machine fails to boot because ntdetect.com is missing.

Day 2: 3 computers fail to boot at separate times (including computer from day 1) because ntldr is missing. Run virus scan on all machines on network (even ones withoutproblems) and all come up clean. Reformatted and reinstalled Win 2K pro on machines with problem.

Day 3: Yet another computer (that had not had problems in the previous days) fails to boot because of missing ntldr.

Sounds like a virus, but it isn't being detected by norton.

any thoughts or suggestions. this is only happening to win 2k machines. company officers are threatening to knock everyone back down to win 98 which would be more trouble than its worth.

12 replies

by jellimonsta

Did you recently install and new hardware or software on theses machines? Or did you recently perform any service pack installs for W2K on these machines? I have seen problems with the installation of SP3 on Win 2000 for machines that were partitioned as FAT32.
I would verify your systems are configured as NTFS and that no new hardware or software has been configured before I suspect a virus outbreak. Although it is worth your while to make sure you have the most current virus definitions for NAV. There are new releases pretty much every day. It is OK to have virus protection but if the definitions are outdated it is like having a glass shield.

by mrs_doctor_jones

There were no new changes to the machines hardware, software or otherwise in the past two months (any changes made earlier were done to individual machines, they weren't global changes). They are running sp2, which came with the os copies. (after seeing the problems that everyone had with the latest sp for xp, we were afraid to install to 2000 sp.)

The operating systems were installed on clean formatted drives with NTFS (not installed over 95 or 98)

all of the machines are running the norton virus definitions released on 11/20 (wedns).

by lordinfidel

Creat a ERD from a machine that boots.

Boot of a cd on the failed machines,

Repair, Use ERD. Select boot.

This actually happens often and they are probably unrelated to each other.

I have a box here that I actually need to keep a ERD taped to it because it keeps losing ntldr.

Even though I have rebuilt the machine 3 times, every 4 months or so it will just wig out.

by mrs_doctor_jones

Is this a common thing with 2000? I don't want to back down to 98 but i also don't want to have to keep reformatting the drives all of the time.

HOWEVER...We've had 2000 on our machines for about 6 mos now with no problems. I still find it strange that this happened all of a sudden on four machines within 3 days.

by lordinfidel

But, It does happen.

It's not like you can say, 'every 4 months this will happen'.

But it does happen.

Like I said, I have a machine that I keep a ERD strapped to it because I know that it will eventually fail. I beleive that it has to do something with the hardware and not the OS.

Since all of my installations are done off of the same source CD, I can't fault the media.
Especially since all of the other 2k systems do not share the same issue.

In any event, this is why you makean ERD.

I always do 3 things when I am done building a machine.

1. Install the 2k pro cd, from a cmd line got to
%cdrom%\I386
type winnt32 /cmdcons
(This installs the recovery console which makes life alot easier for this sort of thing.
2. from cmd prompt type ntbackup
Create a ERD, export registry to it.

3. (keep ntbackup up) go to your c:\ drive
create a folder called sysstate, assign full control only to admins and system. Remove all other permissions from it.From ntbackup, go to backup, check off system state, back it up to the folder you just created.
I always label them the date and version. So if it was today it would be 11250201.bkf If it was the second version it would be 111250202.bkf
(note using the date format as a serial is a very good habit; we use it extensively in BIND but use the 2002111201 format)

So If you can not restore ntloader from the recovery console, then you can restore it from the ERD and then use SySstate backup to get your system back to the way it was.

by rojiru

Sounds like it could be a hardware related issue. Try updating the bios on one PC first and monitor.

by mrs_doctor_jones

Unfortunately, after all of the reformatting and reinstalling we did last week, all of the 2k machines failed to boot this morning (again).

Although it's not to my liking, we've been instructed to reformat all of the drives again and install 98SEon all machines.

We will have on 2KPro machine left today which is the "server." It too will be reformatted tonight with 98 installed on it.

by jellimonsta

Was your environment initially a workgroup environment anyway? You said you are reformatting the 'server' and installing 98SE. Is this an actual server class system or simply the 'main' workgroup PC class system that has majority of file shares and network resources?
If you were initially in a domain environment with an AD 2000 domain, I really would look at all other options before formatting a server and installing 98 on it.
Have you tried replacing the HDD in the suspect machines? Did you try the recovery console? chkdsk /r and then use the manual recovery option? I had to use both on a couple of 2K machines here and then copy a few files from the media CD because of NTLogon problems.

by mrs_doctor_jones

We were always in a P2P environment with one machine having all of the shared files and folders. There was never any true server application installed.

As of today, all machines have been reformatted with 98SE except for the "server" which will be taken care of tonight.

The reason that it was felt that we needed to be so drastic was that so many machines became corrupted within a 3 day period. Then after everything had been reformatted (completely) and 2000 reinstalled, the same machines crashed again.

The plan is to start testing one machine with 2000 in the next couple of weeks. If it proves stable for a while we will then add it to another machine and so on.

by lmayeda

We have 40-50 PCs, most of them are running on W2k, a few NT4's and XP's and maybe 1 or 2 W98's. I have NEVER had a boot failure on any of the W2Ks or XPs. The NT4's and W98's are older (3-5 years) and therefore more susceptible to hardware issues. My boot failures on a couple of the NT4's were resolved by swapping out the memory chips. How old are your computers? What brands are they?

by mrs_doctor_jones

We've had no problems with the 98 machines.

The 2k machines range in age. They are all no-name brand machines which worked fine until last week when they all decided to break at the same time.

For info purposes here's the breakdown:
(1) PIII 533 all original parts except for NIC
(1) PIII 667 HD, NIC and Video Card all replaced in last 6 mos
(3) PIV 1.8 - (2) 6 mos old, (1) 1 yr old

by mrs_doctor_jones

1. Could somehow a problem in the network wiring, hub, router, etc. be causing these machines to have problems, despite the fact that it's only the Win2K machines that are suffering?(i'm not actually sure what type of equipment we are running, i just know that it's at least 6.5 years old)

2. Since we are not running true server software, could it be the we are functionally (NOT legally) using the software the wrong way (we're using Win2K Pro on the "server") and thus running into problems?

HAPPY THANKSGIVING EVERYONE!

This discussion is closed to new replies.