Any way to recover from a corrupt registry?

bovinda

Senior member
Nov 26, 2004
692
0
0
My computer won't boot because somehow it corrupted a file in the registry. :(


1) I tried doing a repair install with the back-up disk, but there's no option for it.
2) I tried using the repair console, but everytime I try to chkdsk or follow these instructions from Microsoft to recover, it says "Access denied" and "One or more unrecoverable problems are present on this volume."

Here's the error message when I try to start:

Windows could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM
You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM. Select "r" at the first screen to start repair.



Here's my hardware:
AMD 64 3400 (754)
Gigabyte GA-K8N Pro mobo
1 gig Corsair RAM (XMS series, 2 x 512 DDR sticks, 32MX8 PC-3200)
Windows XP Home (OEM install)
Radeon 128 9800 Pro
Soundblaster Audigy 2 ZS Platinum
Antec 1000AMG case, with 530W Fortron Power supply
Two WD 120 GB hard drives
Sony DVD ROM
Plextor CD burner (PX-W5224TA)
Floppy drive
8-in-1 card reader sort-of-deal
Phone modem (PCI card)

A complete history of the proble is here. But the point is I need to recover if at all possible from it. Is there any thing I can try?

EDIT: I had SP2 and all current security fixes, patches, etc. installed, and I did have Norton security suite 2005 installed, updated, and running.

EDIT 10/18 at 7:00 PM: How can I modify the contents of my hard drives? I can't figure out to do it. It's been blocked with the recovery console and with Knoppix, as far as I can tell.
 

Kibbo86

Senior member
Oct 9, 2005
347
0
0
Dude, burn a Knoppix disk, boot into it, move any files you need to onto your second HD, and reformat. If you have NTFS on your second drive, try to find a spare HD and format it into FAT32, then copy your files onto it.

Or you could run Knoppix from your dvd and burn your files with your Plextor.

What do you mean there was no option on your backup disk? Was it a factory-issue Windows disk? Does it read as corrupted? You should be able to repair from there.
 

elkinm

Platinum Member
Jun 9, 2001
2,146
0
71
Kibbo86 is right. The easiest option is to backup and restart. You can try to restore it and you might have your software installed.

Backup as much of your system you can just in case.

Backup all your registry files as listed in step (2) that you tried as well all the hive files in those folders. If you used system restore also backup the system restore folders and those registry hives.

Now rename or move the Windows\system32 folder windows\ or even better the entire windows folder. Then rename or move your all your my documents and settings folders.

Now reinstall windows with the same windows folder you used before and with the same user names.
You will have a clean windows install.

Now restore your system restore folder and try doing a system restore. This might work and you will have some if not all of your old functionality. You may need to copy all your files that you backed up from the windows folder as there may be dlls and system files from you programs.

Otherwise, perform the same steps to manually recover the registry but only recover one file at a time. Most likely not all of your hive files were corrupted so you can recover some info.

Then move the files you backed up from your documents folder to their proper locations and you should have all your icons and start menu program entries.

If this works, simply clean up what you backed up files and continue.

Good Luck
 

Wolfesden

Junior Member
Mar 24, 2005
5
0
0
well ... I'll get bashed again, but here goes: for those who want a very simple means of dealing with this very problem,as well as any messed up or missing OS issue, buy and install GoBack. It keeps a constant snapshot of your HDD on the fly, in a totally seperate place. It loads before Windows and so you don't need Windows to "boot" to use it or restore your 'puter to a working state. Why is it better than other often touted methods ... system restore, windows repair, load linux and copy HDD to another HDD, etc? Because it is much simpler, quicker, and it restores your system "exactly as it was" at an earlier time/date. This means not just system and OS files, but your work, data, pics, music, etc. which system restore doesn't touch. Won't help AFTER missing data bits, corrupt registry problems, viruses, trojans and installs-gone-bad occur, so act now. And yes, frequent back-ups are the best habit to have, but problems can happen between back-ups. Sigh .. so let the nay-sayers begin ...
 

Skitzer

Diamond Member
Mar 20, 2000
4,414
3
81
Wolfesden ..... Not bashing you but how can your reply possibly help him in his current situation?
 

ThePiston

Senior member
Nov 14, 2004
861
0
76
if yo ucan get to the desktop hit ctrl/alt/del and go to task manager. type in
%SystemRestore%\system32\restore\rstrui.exe and this will bring up System restore.
 

SoulAssassin

Diamond Member
Feb 1, 2001
6,135
2
0
Boot into the recovery console, go to c:\windows\system32\config, do a "dir system*.*", there should be at least one file named system.sav or system.bak or something similar, if so rename "system" (no extension) to system.busted, and rename the most recent system.sav or whatever to just "system". Reboot. That may not get everything exactly back to where it was but it should get the OS to boot.
 

Wolfesden

Junior Member
Mar 24, 2005
5
0
0
Skitzer is right, so my apology to bovinda. Sorry about your trouble; been there and suffered that. My suggestion will not help this case, but we can and must learn from one another. The only dog I have in this fight is that GoBack has proven useful many times for me and others, and I'm just trying to suggest a preemptive path that someone else may find to be a lifeline down the road. Best wishes for a full recovery bovinda. OOWWOOOO! Wolfeman in the Wolfesden
 

bovinda

Senior member
Nov 26, 2004
692
0
0
Hey guys,

I can't seem to do anything thru repair console. I can't seem to change directories at all; just hitting DIR makes it say "There is no floppy disk or CD in the drive." If I type "e:" it will switch to my other drive, but hitting DIR gives the exact same response. If I try to change directories (say, "cd windows") it also says "There is no floppy or CD in the drive."

Linflas, I started trying to follow the directions in your link, but just entering the first line makes it say "Access is denied." SoulAssassin, I can't seem to change directories to get to your suggestion.

Kibbo86, it is a factory-issue disk (it says Magnell Recovery on it). But when I try to enter do a repair install either with it or a real Windows XP cd, neither has the option to do the repair install after I pass the EULA. They just show several Unknown Partitions, IIRC, and the option to do a clean install, but no repair install.

I'm going to try your Knoppix suggestion (it's downloading now). But isn't there some way to restore it from the System Restore point? Isn't there anything I can do other than reformatting?

I certainly can't get to the desktop. I think I could recover from the factory image, but I might as well reformat then, 'cuz everything would be lost anyway.

Any other ideas?
 

bovinda

Senior member
Nov 26, 2004
692
0
0
OK, something new happened. I tried to go to the XP install screen to check for the Repair install option once more, but it wasn't there. So I hit "r" anyway. Nothing seemed to happen, but a few seconds later I got a bluescreen saying Windows had been shut down to prevent damage to the computer, etc. etc.

The error message was this:

*** STOP: 0X0000008E (0XC0000005, 0X8081C09C, 0XF7D01798, 0X00000000)

Does that mean anything significant?

EDIT: A quick google search suggested the0x0000008E message is a RAM problem, but I just did 25 passed with Memtest86 for about 9 hours last night, and not one error. Also, this happened (corrupted registry) in the past once before (6 months ago) with identical symptoms, and the only resolution I found then was restorying to the factory original. I don't want to this time! Please help!
 

Evander

Golden Member
Jun 18, 2001
1,159
0
76
Maybe this'll help, it did for me when I couldn't boot into windows (safe mode or otherwise). It describes how to manually do a system restore. I couldn't find the original thread i made in tech support forum, so here's a cut and paste of the the saved html (only difference is I used a second hard drive and set up xp on that instead of using BartPE):

Boot into BartPE (don't install XP, else your restore points will be overwritten)
Go into the following folder:
C:\System Volume Information\_restore{71835D45-16FD-4262-BA4A-8B6C0540FEBD}\RP8\snapshot

(Yours may be RP55, for example, but the point is, go into that folder, to a recent restore point from when things worked - look at the dates - and file the SAM, software, security, and System files)

Go to c:\windows\system32\config and back up those 4 files into c:\windows\system32\config\backup.

Copy those four files from c:\system volume .... to c:\windows\ssytem32\config.

Find and rename all files that this patch changed on your system. We'll assume that's just the file it renamed as .original, so find out where it put the file and replace it with the original.

Reboot and let us know what happens. You're essentially putting a backup registry back into place. If the problem was with the registry, that will fix it.

And does the safe mode no network config do anything different?


-------------------------
mail: bluescreens at gmail dot com; pls include URL of the topic & your AT alias. Microsoft antispyware tool: AntiSpyware MPSRpts


Date Posted: 09/05/2005 10:16 PM Posted By: Evander(Member)

I tried BartPE, but when I boot the cd it gets as far as the windows logo with the blue progress bar endlessly going back and forth, waiting a little while the cd stops accessing, so it's not gonna load.
Is there another way? I never even knew about the C:\System Volume Information folder, it doesn't show up even if i show all files\folders including hidden. If I try to access it directly, it says "access denied", but I guess it must be there b/c it doesn't say no such file\folder.

edit: to answer your question, none of the safe modes act any differently



Edited: 09/05/2005 at 10:17 PM by Evander

Date Posted: 09/05/2005 10:21 PM Posted By: dclive(Golden Member)

quote:
Originally posted by: Evander
I tried BartPE, but when I boot the cd it gets as far as the windows logo with the blue progress bar endlessly going back and forth, waiting a little while the cd stops accessing, so it's not gonna load.
Is there another way? I never even knew about the C:\System Volume Information folder, it doesn't show up even if i show all files\folders including hidden. If I try to access it directly, it says "access denied", but I guess it must be there b/c it doesn't say no such file\folder.

edit: to answer your question, none of the safe modes act any differently



It's there. You need to add yourself to the Security tab (in properties) and you'll be able to open it.

If you can't boot the OS, how can you see the folder?

If PE won't boot that box, chances are your PE CD is bad, but test it - use it to boot another PC. If it works on the other box, it's starting to sound like that original PC has other issues....

-------------------------
mail: bluescreens at gmail dot com; pls include URL of the topic & your AT alias. Microsoft antispyware tool: AntiSpyware MPSRpts


Date Posted: 09/06/2005 12:53 AM Posted By: Evander(Member)

I couldn't actually see the folder, I just typed the path into file explorer:
F:\System Volume Information
and it said access denied.
Is there no other way to access it besides partPE? You mentioned the security tab, but I'm not sure exactly what you're talking about (fyi, xp on current drive has no sp1 or 2 installed (probably not enough space anyway), and if I can alter the security of my original install from the outside, that doesn't sound like much "security" is going on there).
Edit: OK, I found the setting in folder options to make the folder show, but still it says access denied

I tried again making the iso and also using a different burning program but the results were the same. I don't have another pc to try the cd out on, except for a win95 p75 laptop with pcmcia cdrom drive, which won't?boot jack from a cd. I could maybe send the iso to you if you wanted to test it. I really don't think there's anything wrong with the pc itself (it boots other cds), maybe an error with my boot cd making process, or perhaps bartpe doesn't like Japanese versions of xp.

If worse comes to worse, I did a system backup on 2 dvdrs some months ago just prior to installing sp2. Although some programs would need to be reinstalled to get where I am now, at least I would still have full access to all my files and restore them easy enough.



Edited: 09/06/2005 at 12:58 AM by Evander

Date Posted: 09/06/2005 01:28 AM Posted By: Evander(Member)

Ok, I found out how to gain access to the folder. For anyone who's wondering:
http://www.theeldergeek.com/system_volume_information_folder1.htm
Now I'll try using those files


Date Posted: 09/06/2005 02:12 AM Posted By: Evander(Member)

Tried using the restore files from 2 days, made no difference. That patch is evil. Guess I've got no choice but to format


Date Posted: 09/06/2005 06:35 AM Posted By: Evander(Member)

Well you're not gonna believe it. I backed up all my save data from the drive, and backed up my previous preSP2 2-DVDR recovery set (in case there were read errors during recovery, I'd have spares). Also attempted to copy the associated boot floppy in case of read erros, which failed, so I made 2 new ones. Unhooked the 2.5gig HD, rebooted the system (didn't yet format b/c the recovery program will do it for me), and for some reason the floppy boot failed and went to the hard drive boot instead. I figured what the hell, I'll give windows one more chance to load. And it did! System appears to be working 100% now, except for my 2 very last installed progs before this crap all started, but I can restore those easy enough. I'm not quite sure how it got fixed, but I'm sure it was b/c of the help of those who contributed here, thank you. And a special thanks to dclive. I'll be more careful now and make DVDR backup images more frequently


Date Posted: 09/06/2005 06:46 AM Posted By: dclive(Golden Member)

Glad it works; I suggest putting SP2 on it plus all other *Microsoft* updates.

-------------------------
mail: bluescreens at gmail dot com; pls include URL of the topic & your AT alias. Microsoft antispyware tool: AntiSpyware MPSRpts


Date Posted: 09/06/2005 08:07 AM Posted By: Evander(Member)

Yep, strictly ms updates from now on (since i didn't have to use my restore dvds, sp2 is still on there. it was my 2.5 gigger that had no sp 1/2)


Date Posted: 09/06/2005 08:13 AM Posted By: dclive(Golden Member)

IC ... when you booted with that, it probably overwrote the restore information you had in system volume information folder. Can you confirm? Were there any RPxyz folders from prior to your doing that secondary install of XP on the 2.5Gb drive?
 

bovinda

Senior member
Nov 26, 2004
692
0
0
Hey Evander, so I booted the computer up with the BartPE CD I burnt. I can't figure out what to do next. I'm sorry I'm such a noob to this still. I went into BartPE's command prompt, and tried to change the directory to the c: drive by entering "c:", but it says "The device is not ready." When I type "chkdsk c:" it says it is "not available for direct access." When I try to run Chkdsk from within BartPE's system menu, it says that it can't open it for direct access. Am I doing something screwy?

EDIT: when you mention the safe mode no networking, do you mean within BartPE somehow? The computer won't boot to safemode as far as I can tell.
 

bovinda

Senior member
Nov 26, 2004
692
0
0
I also tried booting with the Knoppix CD, and I was able to see the hard drives and their files with it. Tomorrow I will try to find some way to transfer them, either to the second HD or to a CD.

Two questions: Kibbo, you mentioned finding another HD and formatting it to FAT32, since my second HD is formatted to NTFS? Can't I just transfer the files and then restore the factory image?

Secondly: is there any way to do the system restore from within the Knoppix interface?

Honestly, I still can't figure out what the problem is. I'm mystified why Knoppix can access the files and read the drives, but repair console couldn't. (I haven't figured out whether BartPE can or not yet.)

Also: any significance to the fact that my hard drives both have portable USB drives for icons? Does that relate to why repair console can't access them in any way?
 

Evander

Golden Member
Jun 18, 2001
1,159
0
76
My experience with BartPE is limited so I don't know what the problem is, and in fact when i fixed my problem I installed XP on a "junk" second hard drive which I switched over as the primary drive, and gained access to my "busted XP drive" from there and manually performed the system file transfers from the System Volume Information folder. If you can gain access from you Knoppix cd, I suppose you could do the same thing without a 2nd hard drive . Unless you run into some security settings that won't let you access the System Volume Info folder from Knoppix (I had to adjust security settings in xp from the 2nd drive to gain access, if you read the whole message).

And to answer your question, I meant booting off my hard drive in safe mode no networking. Like you, I could absolutely not boot into windows at all no matter what the mode, which is why I used a second HD with new XP install to get access. That was a 2.5GB drive, you could probably get one for sub $10 if you don't already have a spare drive.
 

LTC8K6

Lifer
Mar 10, 2004
28,520
1,575
126
I take it that it won't boot to the last known good configuration, either?

I hate it when they do that....
 

bovinda

Senior member
Nov 26, 2004
692
0
0
OK Evander, I've booted into Knoppix and I am able to access the system folder. So I will copy the original SAM, Security, System, and Software files to a backup folder like you said, and replace them with the restore ones. Are there any other files I should replace?

I think your instructions are great, and the only part I'm not clear about is this part:
Find and rename all files that this patch changed on your system. We'll assume that's just the file it renamed as .original, so find out where it put the file and replace it with the original.
Er...which files should be named .original? And what exactly do I do? Sorry, not sure why it's so confusing for me...:confused: BTW, good idea about the cheap hard drive, maybe I'll try that if this doesn't work.

LTC8K6, yup, I can't boot to the last good configuration either.
 

bovinda

Senior member
Nov 26, 2004
692
0
0
Oh, one other last thing...how do I know which restore point to use? There are 193 of them! It seems like almost one per day, from looking at the dates. It was working fine right up until the moment it spontaneously restarted, and I haven't made any adjustments to anything other than updating XP last week. Anyone got any advice how far back to try and restore from?
 

Evander

Golden Member
Jun 18, 2001
1,159
0
76
That part about the files being named .original doesn't apply to you- in my case i used a 3rd party system patch that screwed up my system. It took a system file like whatever.dll, updated it and backup up the original as whatever.dll.original
So I deleted the updated dll and renamed the backup to the previous name. But like I said, you needn't worry about this

I had many restore points too (take up alot of space don't they). In my case, I chose a backup from the most recent date prior to my XP boot failure. So if you had troubles on 10/17/2005, try something earlier like 10/15/2005. That's your choice, just choose something from a date when you know your comp was working fine. I suggest you backup your 4 system files already in c:\windows\system32\config
also (put them for example in c:\windows\system32\config\backup or someplace safe, again that's up to you)
Hope it works
 

bovinda

Senior member
Nov 26, 2004
692
0
0
So I tried to create the backup folder, and I can't do it anywhere on my C drive. I can't modify my E drive either. I took the hint from Evander's link about modifying security stuff by trying to go into properties, select permissions, select the option to allow owner/user to "View and Modify Contents" of folders, but it keeps saying it is unable to do it. For any folder on either hard drive, as far as I can tell.

So I can view all the files. I can make folders and copy things to them on the desktop. But I am completely unable to modify the hard drives themselves in any way, it seems.

This seems to be a fundamental problem of whatever happened--I can't access the hard drives to modify them. Is there any other way I can access them? Does anyone have any ideas??? Does Knoppix have any other way to do it?

EDIT: Might this have anything to do with it being an OEM installation of Windows (done by ABS)?
 

Evander

Golden Member
Jun 18, 2001
1,159
0
76
Well, I'm surprised knoppix let's you try and alter your xp security settings. When I altered them, I only knew how to do it from the 2nd hard drive with XP installed, and it worked for me. Maybe knoppix users know how to make it work for you, but since I have no experience with that I'll leave it to the pros
 

bovinda

Senior member
Nov 26, 2004
692
0
0
Thanks Evander. This is the farthest I've gotten, at least I can view the files...


Anybody know how to access and modify the hard drives? :confused:
 

bovinda

Senior member
Nov 26, 2004
692
0
0
OK, I found a version of BartPE that allowed me to access and modify my drives (evidently the version I had didn't have any drivers for SATA drives associated with it). I deleted the System, Software, Security, SAM, and Default files from the config file and copied the REGISTRY_SYSTEM, etc. (or however they are named exactly) files into the config folder. I rebooted the computer.

I can now access a list of options if I press F8 while it's first booting (list Safe Mode, Safe Mode with Netoworking, etc.). That's new!

But if I select Safe Mode, or Last Known Good Configuration, or Start Windows Normally, it still gives the same error message.

However, it's a little different when I try to go into Safe Mode. It first lists several files, and then the error message, as below:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\system32\ntoskrnl.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\system32\hal.dll
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\system32\KDCOM.DLL
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\system32\BOOTVID.dll
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\system32\config\system
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\system32\config\system.alt

Windows could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM.
Select 'r' at the first screen to start repair.



Is this progress? What should I try now? Does this mean anything?