ZDNet UK

CNET NETWORKS UK BUSINESS SITES:
atlarge.com
BNET UK
silicon.com
SmartPlanet.com
ZDNet.co.uk

ZDNet.co.uk - Winner of Best Business Website 2007

You are here: ZDNet.co.uk > News > Hardware

Processors Toolkit

Recover corrupt W2K boot code

Michael Jackman Tech Republic

Published: 29 Jan 2003 09:10 GMT

When a Windows 2000 user gets an error message or a blinking cursor on startup, the usual suspects are a boot sector virus or corruption of the master boot record. But it's also possible the user has a damaged or deleted Ntldr file. Fortunately, problems with Ntldr are easy to diagnose and even easier to fix. Here, I'll show you how to use common troubleshooting tools, such as the manual repair option and Recovery Console, to handle Ntldr problems.

Signs of a corrupted Ntldr
The signs of a corrupted Ntldr depend upon the location of the bad code in the file. By using a hex editor to overwrite portions of the file and copying the bad Ntldr to a virtual OS in VMware, you can test the results of tampering without danger to your main system. In some cases, you may see the bootstrap menu and be able to select an operating system to run, only to have the machine hang at the Starting Windows progress bar. In others, your system may freeze immediately after the CMOS power-up test. In either case, the file may be damaged in a way that prevents any error messages from being displayed. In some cases, you may still be able to boot directly into the Recovery Console, if it's installed.

Mimicking a corrupt Ntldr
Other computer problems can look like a missing or corrupt Ntldr. For instance, if your machine is configured with an NTFS file system and the computer hangs during startup, it could be a symptom of a fragmented system hive. This problem was fixed in a later version of Ntldr included in Service Pack 2 (as of this writing, the latest version is Service Pack 3, released Aug. 1, 2002). If you haven't yet installed this Service Pack, I recommend that you do so.

There's a workaround for this problem, given in Microsoft Knowledge Base article 265509:

Start the Recovery Console.
Change to the \Winnt\System32\Config directory.
Type rename system system.org.
Type copy system.org system.
Exit.

Copying the file to its original name creates a new, unfragmented (or nearly unfragmented) file. Though Microsoft doesn't spell this out, you can erase system.org after you boot back in to Windows 2000. Here are some other possible startup problems that can mimic Ntldr problems, and their fixes:

Black screen on startup -- corrupt master boot record (MBR), partition tables, boot sector, or Ntldr
"NTLDR Is Missing or Corrupt" Error Message During Windows 2000 or Windows NT 4.0 Upgrade"

Tools for fixing Ntldr problems
If all signs point to Ntldr as the culprit (Figure A), you can use the Windows 2000 Recovery Console or the manual repair option to fix the problem.

Figure A

Your first clue to Ntldr problems will be an error message at bootup.

Insert your Windows 2000 CD into the machine and boot from the CD. After the message "Setup is inspecting your computer's hardware configuration," the Windows 2000 Setup screen will appear. When Windows Setup is finished copying the necessary files, you'll see a menu allowing you to set up Windows 2000, repair a Windows 2000 installation, or quit (Figure B). Choose R to repair a Windows 2000 installation.

Figure B

Boot from the Windows 2000 CD and choose the repair option.

Why not use an installed Recovery Console?
As you know, you can install the Recovery Console so that it appears at boot time. You may be wondering why I don't advise booting into the Recovery Console from the bootstrap menu. Well, it's because many problems that are associated with Ntldr prevent the bootstrap menu from appearing. Therefore, you can't get to the Recovery Console, because a failed Ntldr prevents the bootstrap menu from appearing.