Something deletes my NTLDR + NTDETECT.com

[Sven T.Eriksson]

From time to time it occurs that I want to boot my computer and the system tells me:

NTLDR missing
Press ALT+CTRL+DEL to restart.

I could repair this but I want to avoid this situation which is approx. once in a week.

Some program must have deleted these two files in the previous session.
It could not be a virus. I have checked my system with a couple of virus scanners.
No virus.

Does someone else faced this situation?

Is there a way of monitoring until the final shutdown if some (and which !) process tries
to access (delete) these files?

Sven

 

[David Candy]

If you have Pro you can audit it. Note you have to, in different places
a/ Turn Auditing On
b/ Set what is to be audited.

See help.

 

[Pegasus \(MVP\)]

From time to time it occurs that I want to boot my computer and the system tells me:

NTLDR missing
Press ALT+CTRL+DEL to restart.

I could repair this but I want to avoid this situation which is approx. once in a week.

Some program must have deleted these two files in the previous session.
It could not be a virus. I have checked my system with a couple of virus scanners.
No virus.

Does someone else faced this situation?

Is there a way of monitoring until the final shutdown if some (and which !) process tries
to access (delete) these files?

Sven

You might have some malware on your PC. Run msconfig.exe
(http://www.svrops.com/svrops/dwnldoth.htm) and have a good
look at the startup task list.

You could cure the symptoms by nailing down these two files.
Set their NTFS permissions to "read-only" for everyone, including
administrators and the system account.

 

[Guest]

If your computer has Windows XP or Windows 2000 Professional/Server, refer
http://support.microsoft.com/default.aspx?scid=KB;EN-US;320397.

If not...
- Did you recently upgrade the Operating System? If yes, what's your present
and previous operating system?
- Did you recently modify permissions?

Best of luck...

 

[Rick \Nutcase\ Rogers]

Hi,

If ntldr were missing, you would never be able to boot the system up. The
fact that it only occurs on occasion is an indication that your system is
having trouble reading the hard drive on boot. This may indicate a faulty
drive, or that the installation is damaged (file corruption). I would try
replacing ntldr with a new copy from the I386 folder first to rule out file
corruption. A drive diagnostic tool can tell you if there is a hardware
problem, these are usually free for download from the drive manufacturer's
web site.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Todd H.]

From time to time it occurs that I want to boot my computer and the system tells me:

NTLDR missing
Press ALT+CTRL+DEL to restart.

I could repair this but I want to avoid this situation which is
approx. once in a week.

The low hanging fruit on this is:
malware actively doing
hard disk hardware issues/bad sectors.