Can't run programs or connect to internet

[Dr Jay]

Hi

Seems the malware is just too prevalent. Would you like to try the Kaspersky Rescue Disc environment, and we can try to disinfect without the operating system being loaded?

I have a feeling there is something hidden beyond the scope of our search.

[Xerinous]

At this point I'm up for just about anything. So long as it doesn't affect certain files that are rather important and for some reason were never backed up.

[Dr Jay]

• Kaspersky RescueDisk
  If you encounter problems running the RescueDisk, you can get further assistance at the Kaspersky Support Forum.
  

If you are not sure how to burn an image, please read How to write a CD/DVD image or ISO. If you need a FREE utility to burn the ISO image, download and use ImgBurn.

Let me know how it goes.

[Xerinous]

Well this is strange. Ran the scan, it found and removed six infections. Problem is now I can't boot the computer. Says something about "(some letter, it's cut off the side of the screen)TLDR is missing" then gives the option to reboot, nothing more.

[Dr Jay]

OH..wow..I would have never imagine you having an infection in NTLDR.

No wonder why we could not find the infection. It was in the boot loader.

Problem is, the Rescue Disc probably deleted or modified the boot loader. So, we will have to fix that.

This is one of three possible problems:

-MBR is damaged (fixable).
-Corrupt NTLDR file (fixable).
-Misconfiguration of boot.ini file (fixable).



Now, I don't quite remember...did you have an XP CD or not? Either way, we can still work on the system.

Let me know that, so we can continue diagnosing and fixing the issue at hand.

[Xerinous]

We've got it, I'll have to ask my dad where he put it but I can find it.

[Dr Jay]

Ok. Let me know if you can find it.

We're actually getting somewhere now.

[Xerinous]

Finally some progress.

Alright I managed to find the CD. Ready for whatever's next.

[Dr Jay]

Let's attempt to fix the MBR first.

Reboot your computer.

Boot from the windows XP CD, press the "R" key in the setup in order to start the Recovery Console.

Select your windows XP installation from the list (usually 1). It will prompt for an administrator password. The password is probably blank, so just hit enter.

Enter the command: fixmbr at the input prompt and confirm the next question with a Y.

It should then reboot the computer. If it does not, then type exit.

Try to boot back in to Windows and let me know if it works.

[Xerinous]

Didn't work, NTLDR is still missing.

[Dr Jay]

Do the same method for the Recovery Console, except put in the following command this time:

fixboot


Let me know of the results.

[Xerinous]

Still nothing changes I'm afraid.

[Dr Jay]

NTLDR is indeed corrupt.

So, let us try this...

• Insert the Windows CD and start the computer.
• When the Welcome to Setup screen appears, press R.
• Type a number corresponding to the Windows installation you wish to repair (usually 1) and press Enter.
• When prompted, type the administrator password and press Enter.
• From the command prompt, copy NTLDR and NTDETECT.COM from the i386 folder of the CD to the root folder of the hard drive. In the example commands given below, C: is the hard drive and D: is the CD-ROM drive. You will need to change the drive letters if appropriate:

COPY D:\I386\NTLDR C:\
COPY D:\I386\NTDETECT.COM C:\

• Remove the Windows XP CD from the drive and restart the computer.

[Xerinous]

Great. More problems. Attempting to copy the files results in an error of "The file could not be copied."  I made sure I was using the right drive (for some reason h: is the cd drive in recovery console, it's normally d:) after getting a few "access is denied" messages, which got me the other message.

[Dr Jay]

In the Recovery Console...

Type cd \ and press "Enter".

Type cd windows\system32\config and press "Enter".

Type ren system system.bak and press "Enter".

Type exit and press "Enter".

Your PC will reboot, go back into the Recovery Console and start from the beginning.

Then, try the command above again to replace NTLDR.