Solved Windows 7 blue screen crash/hard drive booting issue/NTLDR missing

[altek]

Hey all,

Came across a problem recently on my 9 month old rig.

Specs are in my profile.

Anyway, I had 3 hard drives set up: my main SSD which runs Windows 7, a USB external 1 terabyte and a 500gig SATA Western Digital. I believe the 500gig SATA was failing or malfunctioning. I was getting error messages that the drive was bad a while back, but never got around to fixing or removing it because I was lazy and it still worked (read/write). I kept some junk media and files on it but other than that didn't touch it. Well my rig started acting funny a few days ago, I thought it might have been a worm or malware. I ran my usual combination of programs and security. I like to keep my system pretty clean. I did find a few threats but took care of them. I hadn't ran them for a bit, so I thought nothing unusual. Well, my PC started crashing randomly and giving me issues until 1 time I noticed my 500gig SATA was corrupt or something. All the data on it was gone and it was reading 200gig instead of 500gig. I was still able to read/write to it though. Still kept having the crashes and freezing.

I removed the SATA, wiped the SSD and re-installed a fresh copy of Windows 7. Everything went without a hitch. Windows runs fine, everything went normal. Computer is running beautiful, but I am still having a crashing issue. It happens randomly. Happened twice when watching movies off my external and twice now while just browsing the web. The system will freeze forcing me to manually restart or it will freeze and a blue screen will pop up saying the system crashed and it's dumping memory yada yada and force me to manually restart. If I leave it to restart on it's own, it will boot and I get a variety of boot error messages. NTLDR is missing, press CTRL ALT DEL to restart or some other boot message. Once I manually restart, Windows will start up normally, but has recognized it shut down improperly.

I read it might have something to do with my boot order or the external, so I removed that off the boot order list and made sure my SSD was my main hard drive and boots first. I checked my system and CPU temps, everything seems normal. I am not sure what it could be. I have a fully clean install. The only thing rolling over is all my media files on my external. But could my external really cause the system to crash like that? I have no idea what it is and it seems Windows will run fine for a determined amount of time. A few hours or more until it happens randomly. Doesn't seem to be a pattern. I also read NTLDR is only associated with Win XP and BOOTMGR is for Win 7 so I don't know what is going on there. I am going to take apart my machine later and check all the cables and everything, but this is a pretty new machine with no previous problems. I keep it clean, but it's not to say I don't get malware/viruses. But if it was that, you would think the format would take care of it. And if it was my corrupt SATA causing it through the boot manager/order, that would be solved by removing it. So far, it's been 2 hours and Windows is running fine. Anyone have a scrap of an idea or had this problem before? I know it's a bit vague and could be many things, but I think it has something to do with my hard drives or it's a virus/worm (but I don't see how). Thanks.


UPDATE: Windows freezes around every hour or so forcing me to manually restart. If I leave it frozen, it will restart itself after a while giving me the "NLTRD is missing" error.

 

[Carl Lawrence]

Have you done an anti-virus scan?

 

[karlsnooks]

altek,
Well let's rule out malware, but before you do would you please fluff out those specs so we don't have to pull teeth to get to some info that helps us to help you.

Update your SevenForums System Specs
User CP (located on the top menu bar) |
Your Profile | Edit System Spec (left-hand column)

To gather info, use Speccy (my favorite) or SIW or System Info

In the System Manufacturer Block, enter:
Ø Manufacturer and Model OR Custom build.
Ø ADD the word laptop, desktop, netbook or tablet.
For example:
Toshiba Satellite L305D notebook.

Provide full windows version info, for example:
MS Windows 7 Ultimate SP1 64-bit

Use the “Other Info” block for Optical Reader,
Mouse, touchpad, wifi adapter, speakers, monitor, etc

Scroll down and click on SAVE CHANGES.

With Speccy, you can select with your mouse/touchpad info from the display
and paste that info into your specs.

SIW is a marvelous program, but the free version does not offer
this capability.

===========================================
===========================================

With that out of the way, let's get rid of any and all malware.

HOW TO USE MICROSOFT'S OFFLINE MALWARE REMOVER
Windows Defender Offline
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.
· is a free standalone, bootable malware and virus remover from Microsoft.

Download Windows Defender Offline (about 785 kB)
You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.


INSTALLATION:
· Requires an Internet Connection.
· Insert 512 mB or larger USB stick into a usb port.
· Run the downloaded program--mssstool64.exe or mssstool32.exe
· NEXT button
· Choose the option On a USB flash drive that is not password protected
· NEXT button
· NEXT button
.
The install program will:
· format the usb stick using the NTFS format.
· download less than 230 mB.
· name the USB stick WDO_Media32 or WDO_Media64
· use less than 300 mB.

How to UPDATE the Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download less than 65 mB.

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.

 

[altek]

OK. I pulled as much of my system spec information as I could.

I have ran multiple virus scans, spyware, ad-aware, malwarebytes, CCleaner, etc scans, but I also just completely re-installed Windows on a freshly formatted SSD drive. I will re-run AVG and I will run the Windows Defender Offline posted above and see what happens. I know it's just a step-by-step process, but I don't see how it could be malware or a virus, but I'll see what shows up. I'll report back later. Between posts, I had to restart 1 more time because Windows froze again.

 

[karlsnooks]

Good job an filling out those specs and glad to see that you have SP1 installed.

I will await your completion of running WDO.

All of those others are NOT offline programs.

I will not attempt to chase down any problems until WDO has given you clean bill of health.

Have a nice day,
karl

 

[altek]

One more thing to add: I was just running AVG one last time before WDO when my PC just randomly restarted. It went past the motherboard logo screen and went to a screen where it said: "Please select proper boot device and press any key to restart" or something along those lines. I had to manually restart to get my PC to boot up properly to Windows. I remember this did happen 1 time yesterday too. Just randomly shuts down and restarts out of nowhere to that "Select boot device" screen. I wasn't even touching the keyboard. I have no idea what is going on. I'll report back once I get through WDO, but I think that is a pretty important piece of information if it helps.

 

[karlsnooks]

One more thing to add:
Boot up from that WDO usb stick and be sure to run a full scan by WDO when WDO finishes the Quick Scan.

 

[Layback Bear]

Altek that is a fine job fluffing up those specs. Thanks.

 

[altek]

OK guys UPDATE: I ran all my online malware, anti-virus, spyware programs and I also ran the WDO quick and full scan (which found nothing). I am starting to see a pattern now. Windows freezes about every hour or so, forcing me to manually restart. It will run fine for another hour or so and same thing. I have been restarting my PC like crazy the past 3 days and I am really starting to get sick of it. I just formatted and re-installed Windows the other day so I don't see what the issue is. My temps seem fine. Also, if I leave the computer when it freezes it will eventually go restart and the "NTDLR is missing, press ctrl alt del to restart" screen comes up. And sometimes my Microsoft Security Essentials will crash prompting the same issue. I am hoping someone can really help me out here.

 

[karlsnooks]

altek,
now that you know how to run WDO then I need you to run WDO and submit the results. Here is how:

# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# STEP 3 ** SCRIPT OUTPUT & SCRIPT PURPOSE *******************
# ************************************************************
# --The script output and purpose is given at the very front of the script
#
# --The script output and purpose is given at the very front of the script
#
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--The system can not find the path specified
# you may need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter SET-EXECUTIONPOLICY -EXECUTIONPOLICY REMOTESIGNED
# ************************************************************

# ************************************************************
# Zips up your log files from Windows Defender Offline
#  and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# ************************************************************

function New-Zip {
    param([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [String] $Path, [Switch] $PassThru, [Switch] $Force )
    Process { if (Test-Path $path) {if (-not $Force) { return } }
    Set-Content $path ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
    $item = Get-Item $path; $item.IsReadOnly = $false;if ($passThru) { $item } } }
function Copy-ToZip {param(
  [Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  Begin {$ShellApplication = New-Object -ComObject Shell.Application
  if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path = Resolve-Path $ZipFile
  $ZipPackage =$ShellApplication.Namespace("$Path")}
  Process {$RealFile = Get-Item $File; if (-not $RealFile) { return }        
  if (-not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc = 0 } 
    Write-Progress "Copying to $ZipFile" $RealFile.FullName -PercentComplete $perc}
  $Flags = 0; if ($force) {$flags = 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage.CopyHere($realFile.Fullname, $flags);Start-Sleep -Milliseconds 500}}

$divider = "#" * 79
$fileinfo = join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir = $env:windir + '\Microsoft Antimalware\Support'
$a = dir $dir  -rec -force -ea:silentlycontinue | sort-object -property lastwritetime | 
select name, lastwritetime, creationtime, lastaccesstime, length, extension, fullname
$f = $a | select name, lastwritetime,creationtime,lastaccesstime,length
$arr = @()
$arr += $f
$a | where {$_.extension -eq '.log'} |Select fullname |
foreach ($_.fullname) {
$c = $divider
$d = $_.fullname;
$e = get-content -path $_.fullname
$arr += $c, $d, $e
}

$arr | out-file $fileinfo
$ziploc = $env:userprofile + '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

# ************************************************************

 

[altek]

The moment I right clicked powershell after copying the script, I seen it paste and the powershell prompt closed. Was that supposed to happen?

 

[karlsnooks]

Look at the very top of the script. Read. Upload the file.

Do not paste into a post but rather attach the zip file.

 

[altek]

OK. Sorry about that. I believe I attached it now.

 

[altek]

I am still pondered as why it's giving me the NTLDR error when that is associated with Windows XP. I also configured my boot order to boot off my SSD drive with Windows on it first now.

 

[karlsnooks]

altek,
Go back and don't just pay lip service to WDO. Run WDO, run a full scan of ALL of your drives. When finished, reboot and run the script anew.

 

[altek]

I don't understand. What do you mean lip service? I ran WDO just like you posted before. I loaded it onto a thumb drive, followed ALL the directions. It ran a quick scan and then I ran a full scan of ALL my drives. What's the problem with my scan log?

 

[karlsnooks]

Your logs indicate that you must have a super top-secret computer to have run a full scan by WDO (or any anti-malware software) in that period of time.

 

[altek]

Alright.. I'll re-scan WDO. But I am telling you I ran it the other night. Both quick and full scans. I'll report back.

 

[altek]

Rescanned with WDO all drives. I did quick, full and custom just to be sure. So if there is something wrong with the log then we have another issue.

 

[karlsnooks]

HOW TO POST A SNAPSHOT OF DISK MANAGEMENT DISPLAY
Run disk management:
WIN | type DISKMGMT.MSC | ENTER
This method gives you a display without the unneeded navigation pane.
WIN=key with Microsoft logo on top.

Maximize the output of Disk Management:
Maximize the output of Disk Management:
ALT-Spacebar key combo | X key (selects Maximize) |
Drag the field separators (such as between Status and Capacity) to show entire field.


Make a snapshot:
WIN | type SNIPPING | ENTER | New
Drag the cursor around the area you want to snip.
File | Save as | select save location and name | Save


Post the snapshot:
Post a File or Screenshot in Seven Forums