MBR, DLL, and NTLDR issues

[Greyfang]

2 of the 3 issues i'm having seem to be with Windows, so i thought i should post them all in one question here.  hope that's ok.

first, i'm using XP Home with Service Pack 2.  i regularly use Lavasoft's Ad-Aware, Spybot Search & Destroy, PC Tools AV, and AusLogic Disk Defrag to keep my system running smoothly.  this is a custom build, P4 3.4 OC'd to 3.65 (been that way for a while, pretty sure the OC isn't causing any issues), 2 GB DDR, and the mobo is an ASUS P4V8X-MX. 

woke up this morning and my PC was acting very strangely.  unfortunately i had visitors this weekend and evidently someone was looking at a site they shouldn't have, as i kept getting IE popups (while Mozilla Firefox is my default web browser).  ran an AV check and came up with 2 DLL infections which i can't remove as they are locked to winlogon.exe (these DLLs are qomllkj.dll and sstqq.dll).  all my attempts at attacking these have failed, and i have tried everything i could find on the net besides trying from safe mode.

which brings me to my next issue:  i can't boot from safe mode because i continue to get "NTLDR is missing" error.  yes, there is a lot of info about this on the net as well, but nothing i tried seemed to work as i keep getting "access is denied" errors when trying to copy the files from the Windows boot disk.  however, when attempting to find ntldr while in the CLI, it showed it exists but ntdetect doesn't.  one thing i found which i didn't attempt was renaming SAM to SAM.bak, then copying from Windows boot disk and then changing back, as there was a friendly warning regarding the destruction of the drive if done incorrectly, and so i thought i should get a second opinion on that method; hopefully another method is available so i can avoid this one entirely.

and finally, something i did today created a 2nd MBR on the disk, and now when my PC boots it asks which OS, and this is definitely my fault.  hurried or distracted i don't know, but it adds an extra 30 seconds to my boot time as my keyboard is a Logitech G15 which utilizes a USB port, so isn't detected at this early stage of booting.  i broke out the old keyboard and discovered that Windows boots exactly the same regardless of whether i choose "Windows XP Home" or the other entry (which just appears blank) at this point, so it seems like i just have a duplicate MBR on my system, and i would like to delete it if it's possible to do so without corrupting or otherwise losing the rest of the data on the disk.  if not, it's not that big a deal since i can still boot, but i'd like to erase the entry which asks me to confirm which OS if i can.

hope i've given enough info to address these problems without being too verbose.  any help would be greatly appreciated.

[Greyfang]

forgot to mention that whatever my PC picked up also deleted every restore point i had and created a new one dated yesterday as "Last Known Good Configuration."  very tricky indeed, but since i am more specific in my restore point descriptions, i wasn't fooled.  so, System Restore isn't an option either.

[patio]

Put your XP CD in and reboot.
At the 2nd prompt window hit R to enter the Recovery console.
After it finishes loading at the command prompt type in fixboot and hit Enter.
Re-boot the machine.
Repeat the above processs except this time at the command prompt type fixmbr and hit Enter and re-boot.

You should be good to go...

[Greyfang]

thanks for the advice, my MBR is now fixed, and i'm able to access safe mode. 

but unfortunately, i'm still unable to do anything with the viruses, as they're still locked onto windowslogon.exe.  any advice there? 

i also still have 2 MBRs, i think, as it still asks me which OS to run, but if there's nothing i can do about that without risking my partitions, i wouldn't be surprised.

but i really want these DLLs off my machine.  any further advice on the subject?

[patio]

Follow the same process as before this time type in fixmbr from the command prompt in the Recovery Console....re-boot.

Then Click Here

Follow the directions and one of our Resident Experts will be along shortly to assist...

By the way...Welcome to Computer Hope !

[Greyfang]

thanks for the welcome   

there are a lot of PC assistance forums on the 'net, but yours has the strongest reputation.  glad to be here.
(k, enough sucking up   it's well-earned on your part, though)

initially, i did as you advised... entered the Recovery Console, typed "fixboot," rebooted.  then re-entered the Recovery Console, typed "fixmbr," and rebooted.  that didn't change the asking at startup for an OS selection.  just want to verify, you're saying i need to do the Recovery Console and "fixmbr" a 2nd time?

and thanks for the link to the malware page, i'll check that out now.

[dahlarbear]

i also still have 2 MBRs, i think, as it still asks me which OS to run, but if there's nothing i can do about that without risking my partitions, i wouldn't be surprised.

I doubt you have two Master Boot Records (unless you're using multiple hard disk drives?), but your system is telling us you have two installations of Windows XP Home on your hard drive.  Is this possible?

Because your system believes multiple operating systems exist, it presents a menu asking which one you wish to boot into.  If you don't select one after a set amount of time (default is 30 seconds), it will boot the default operating system.

The following hidden system file "C:\Boot.ini" identifies and locates the operating systems you may select from.  It is a relatively small text file.  If you can locate it and "post" a copy of its contents, we should be able to identify what the problem is.

[patio]

es.
It will do no harm to run it a 2nd time.
Easiest path to the bootini is Start/Run and type in msconfig and hit Enter.

[Greyfang]

i'll run it a second time then, soon as i can log onto my profile... and post what i find in the boot.ini file.

the malware which i'm attempting to eradicate has become quite a nuisance   

i'm checking to see what advice awaits me on that front now.

[Greyfang]

the boot.ini does show 2 operating systems.  these are the contents:

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS=""
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect NoExecute = OptIn

[dahlarbear]

1.  I don't think you posted the entire "boot.ini" file.  From what you did post, I recommend the following content for your file:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Home Edition" /fastdetect /NoExecute=OptIn

You can reduce the boot delay (before the default selection of an operating system) by setting the "timeout" value (in seconds) to a lower value or to zero if you don't want the boot menu displayed at all.  Setting the value to "-1" will display the boot menu indefinitely.

You must get the "syntax" correct.  Otherwise your system may not boot into your hard drive operating system.  (But you can use recovery console from Windows XP Install CD to recover or use other means to correct the boot.ini content.)

Please note, options are preceded by an "/", so it should be "/NoExecute=OptIn" not "NoExecute=OptIn".

Both of your operating system entries are pointing to the same place (disk, partition, and directory) on your hard drive.  Since only one version of Windows XP can physically exist in the same directory (e.g. "Windows"), they are both pointing to the same operating system.  So eliminate the following from your current "boot.ini":  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS=""


2.  The "boot.ini" file by default is "read-only", "system", and "hidden".  So you might have to temporarily change these if you're unable to access or edit it.  You may use simple "text" editor, utilities from within Windows XP, or Windows XP recovery console to edit or rebuild the file from scratch.  The following links should help you decide which method you wish to use.  When you know what you don't know, ask, and someone will help you.

http://vlaurie.com/computers2/Articles/bootini.htm

http://support.microsoft.com/kb/289022

http://www.computerhope.com/issues/ch000492.htm

http://www.computerhope.com/issues/ch000648.htm

[patio]

Make sure to save a copy before proceeding as bootini.old so if things go awry you can revert back to the original...

[Greyfang]

thanks to you both!  i used the edit function on Startup and Recovery to delete the superfluous operating system from the boot.ini file.  you guys rock!   

[Greyfang]

hey guys, long time no see   

tried to enter safe mode today, and instead of getting the appropriate menu it's asking me to designate a boot device.  once i do that, it loads Windows and bypasses the safe mode screen.  went to the BIOS to make sure that only one HD is designated as the boot device, which is the case.  i can even see the safe mode screen flash before the screen asking me which boot device to use comes up, but then i can't get back to it.  may i trouble you again for your sagely advice? 

[dahlarbear]

This isn't something I've seen before.  So I'm not sure how much help I can provide...

Can you provide the exact text where "...it's asking me to designate a boot device"?

How are you attempting to enter Safe Mode?  By tapping the F8 function key repeatedly (once a second or less) as the system is starting up?

Still using Windows XP Home Edition SP2?