• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Computer no longer recognizes its own operating system...

B

bovinda

Senior member
Problem: When my computer starts up and is about to boot into Windows XP, a screen comes up that says:

Windows could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM
You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM. Select "r" at the first screen to start repair.

Background: This problem started when I let RealPlayer auto-update itself to whatever the newest version is (I needed it to watch a financial aid video for school). When it prompted me to restart and I did, I got the above screen.

What I've tried:
1. Following its instructions, but no repair option is available using a Windows XP Home or Pro CD.
2. I loaded the repair console from the XP CD instead, and entered bootcfg /rebuild as per a website's instructions. But it says something about one or more unrecoverable errors and can't do it. Entering chkdsk also doesn't work anymore, giving a similar response.

What next? I've never had anything like this before. Is there any way, any way at all, to fix this without doing a clean install?

The system, just in case:
AMD 64 3400 (754)
Gigabyte GA-K8N Pro mobo
1 gig Corsair RAM
Windows XP Home

Thank you in advance for any and all help!!!
 
Edit: All of the steps below apply, but given that you're having disc problems, I'd be checking that hard drive...reseat the ide cable...might want to clear the bios or redetect the drive via the bios's detect feature.

A couple of things...

First of all, the first "R" you see in the XP setup is for the Recovery Console. It's not a repair install.

That only comes when you get past the first step, and let it go to the end of the setup process, and it will ask you if you want a new install or repair an existing install.

That's when you will be given another "R" option for repair.

However, that's going to leave you a lot of reinstalling to do (SP2, probably, and other hotfixes).

Here's a way to get back to your pre-Realplayer problems. It's tedious, but if you follow the instructions EXACTLY, you will get your system back to just the way it was.

Read the instructions, and follow them! Print them out to have them handy as you go through the process. Don't skip steps!

It involves using Recovery Console to restore your original registry hives (one, at least, is corrupted). Then, once you can do that, you can use System Restore to get back to where you were before the crash. But again, following the instructions explicitly is the only way.

Here's the info:

http://support.microsoft.com/kb/307545

 
Slikkster, thank you for all the great suggestions, I will definitely give that a try this evening. The Repair Install option is the one that never came up after I allowed the set-up screen to come up, so I thought the computer was not recognizing that XP was on there anymore.

My only concern with the linked solution is that it mentions that these instructions are not recommended for OEM installs (which this particular computer is--I forgot to say that). I don't understand from their explanation why that is, though. And anyway, what have I got to lose at this point, huh? I will give it a try this evening, and I will follow the instructions to the letter, like you say.

My other question is--I had turned off system restore so that viruses wouldn't be able to hide out in there in case I ever got infected. Would I still be able to use the system restore function after I fix the registry? Anyway, like I said, I will give it a try and let you know how it goes. Thank you, Slikkster. :beer:
 
Sorry, but since you turned OFF System Restore, the link I provided won't help you at all.

This is why I am so adamantly opposed to turning OFF System Restore. I've never been sure why people advise this. If you've contracted a virus or worm and clean it out, it's a very easy matter to toggle OFF System Restore and toggle it back ON again so that you won't have worries about getting the infection again. But now you see the downside of leaving it OFF all the time. It's unfortunate.

Edit: You can use the link I provided to get your system working again if you take it up to Step 6. (in other words, step 6 is exit recovery console). Do all the steps up to and including Step 6.

Here's what you will be left with, however:

This will restore your registry to the point it was right after you first installed XP. In other words, all your third-party software and post-install hardware will be have to be reinstalled. All of your software will still be physically on the pc, but XP will have no knowledge of it since you're "restoring" the first registry that XP saved when it installed Windows.

I use a program called "Erunt" to backup all my registry hives every day, so if I ever had the problem you did, I could easily get my registry back in order. Of course, that won't help you know, but for the future, here it is:

http://www.larshederer.homepage.t-online.de/erunt/
 
D'oh! So if I'm not misunderstanding, turning off System Restore killed all previously backed up registry "hives" except for the very first original ones installed with my original installation? So ALL the programs on there won't show up at all, even though their code is technically on the hard drive? Man. What a bummer. I turned it off 'cuz people who know a lot more than me seemed to think it was a good idea, but I see now why there's mixed feelings about it.

I guess the question then would be why shouldn't I just do a clean install, huh? Well, I will still go through the steps in the link so I can recover some files. But otherwise, would a clean install just make more sense?

Thank you for the link to the program, I will definitely use that from now on. (And I'll also turn system restore back on.)

Hey, hypothetically speaking, if I were to only replace the system registry hive (since that's the only one the computer said was corrupted), do you think that would be "bad"? I see the link warns against doing that very thing for probably good reasons, but would it be worth giving it a try just to see? Or is that unrealilistic? (I don't have the experience and/or knowledge to judge--I'm guessing it's a silly idea, but I just thought I'd check for opinions.)

Anyway, thank you again Slikkster.
 
As I go back and read the original problem, I think all of this might be moot.

You have a problem with your hard drive. Any attempt at repair of XP at this point probably won't even work.

I think the RealPlayer install was just the catalyst, not the problem.

What you need to do is fix the drive problem, first of all. It's probably has at least one bad sector.

So, here's what I would do:

Use the recovery console from the CD to access your drive. Go to the following folder:

C:\WINDOWS\SYSTEM32\CONFIG


Try to copy the System, Software, Security, and Sam files to another folder. Just to be sure, too, if there are other System.xxx files, copy those, too.

Now, once done, type this at the command line:

chkdsk c: /r

This will attempt to repair any bad sectors. This might take all night, so set it and forget it, as they say. After it's done, try to boot up again normally.

Note: When you toggle OFF System Restore, all former restore points are lost.
 
Yipes. Should I try to follow the original link's directions first? Or should I just jump straight to trying to repair the bad sector? And then try to boot up, and failing that, should I follow the original link's instructions?

What about it makes it sound like a bad hard drive? How could the evil RealPlayer update act as catalyst for that? Anyway, I will give all this a try then! Thank you for the help Slikkster.
 
Glad to help. I would try repairing the bad sector(s) first, and actually then trying to boot up without making any changes to your System file. (but copy the files I mentioned to another folder first...System, Software, Security, and Sam, and all other System entries, like System.bak, system.sav, etc. I don't want you to MOVE these files; just copy them.)


Why do I think it's a drive problem? Well, because you have "unrecoverable errors", which means chkdsk can't read the drive in certain spots.

I'm not saying it's a fatal drive problem, but running chkdsk with the /r switch will have chkdsk try to recover and mark those sectors.

My point is that it's possible that just getting the sectors fixed or at least marked might permit your system to work correctly, or at least allow for other repairs to take place. So, let it do it's thing, and then see if you can boot up normally after it's done and you exit recovery console.
 
OK, so in the recovery console, under C:\, I entered "dir" and it says "There is no floppy disk or CD in the drive." I tried entering "chkdsk c: /r". I hit ENTER and after a few seconds it says "The volume appears to contain one or more unrecoverable problems." Hmm. The thing is that this computer has two hard drives, and neither of them is recognized from the recovery console, though I can switch to it (it's the E drive). This seems so strange. When I try to "chkdsk" on the E: drive, it also says "The volume appears to contain one or more unrecoverable problems." 🙁

So is it just one bad hard drive affecting the other? Should I try to reinstall and then do something? Any thing else worth trying? Could they both have crashed?

I'm going to try and recover the company's original image from the hard drive right now.
 
Well, I was able to recover from ABS' hard drive image. I'll just have to reinstall all the programs, but oh well. What I was wondering about though was: is there something I can do now to check the disks for errors, er, bad sectors? Both of the drives are accessible now through XP. I'm going to put Norton Internet Security back on, reinstall SP2 for XP, and then start re-loading all the programs back on.

*sigh* Thank you for all the help Slikkster. If there's anything else I should be aware of or that I need to do (besides keep the System Restore on and use ERUNT), let me know and I'll do it. I really do appreciate it--you and others like you make these forums what they are.
 
Well, sure, you can now run Chkdsk freely on both drives. If you have the time, like overnight, run the full diagnostics (meaning check the drives for bad sectors in addition to bad files.)

But this you can setup right from Windows. Go to My Computer. Now, RIGHT-click on your C: drive. This will bring up a menu. Left-click on Properties. A box will come up. Left-click on Tools. The first item in the Tools Menu is "Error-Checking". Click "Check Now". Click on both boxes under Options. Click Start.
Windows will no doubt tell you it can't check this drive at this time, but would you like to schedule it to be checked at next boot...click on Yes for that.

Your C: drive will then be scanned for both bad files AND bad physical sectors on the hard drive.

Do this for your other hard drives as well. However, they will most likely be checked from within Windows, vs. at boot. But, if it says you need to schedule it for next boot, so be it.


Sorry you had to resort to the drastic measure of restoring an image, but sometimes that's what it takes. Doesn't seem like you feel you're losing much info this way.
 
Thanks Slikkster, I will do all that tonight. Yeah, fortunately almost all of my actual files were not on the hard drive that was fudged, so it's just a matter of reinstalling many, many programs.

So I will run those, and if I do find any bad sectors, will it direct me as to what action to take? And if I don't, can I assume it was evil RealPlayer working my computer over?

OK, thanks Slikkster. Again, I am grateful for your time and energy, even if there wasn't a quick and clean resolution.
 
If it finds bad sectors, it will try to read information from them to move it elsewhere. In any case, it will mark any bad sectors as bad and will remove them from the available drive map, so nothing else will ever be written there.

As for RealPlayer, they would be out of business if this happened as a matter of course on people's machines. I'd tend to think it wasn't that, but just a coincidence of time.
 
Unrecoverable means unrecoverable at least as far as the filesystem goes. The only way to correct is to format. This doesn't necessarily mean the physical drive is bad. Check your system event logs for event IDs in the 50s (delayed write failures etc) as well as 9 and 11s. These can give you and indication of drive failure.

But, just to be clear: Unrecoverable means unrecoverable. A chkdsk /r will mark bad sectors for you which isn't a bad thing but it won't clear this up.

FYI guys, there are a couple threads over in the OS forum writen by myself, dclive and sianath that cover the missing or corrupt system hive (as well as the Stop 0xC0000218 variant for the software hive). It's a fairly common problem and the recovery steps are straightforward but LONG to type. Have a look Slikkster - you could probably link to it next time.
 
Can you link to the exact threads you're referring to? I found one about the system hive that was pages long. Didn't get a chance to read through the whole thing, but it seemed to require a parallel install to load the hive (after renaming) for repair, etc.

I already know about the repair folder, and that's almost useless.

Personally, with Erunt (freeware), I'm not concerned in the least about hive corruption, as I know I have a backup of all hives one day old at most to go back to.

But I'm assuming you're referring to others who are experiencing the problem that didn't have backups.

Links, please. Thanks.

 
I found a "link to the link" but it appears the original thread has expired from the server 🙁

Even if you have failed to keep them updated your repair hives can be used to get you booting long enough to actually fix the problems with your registry.

It only takes a single bad cell to stop the OS from loading a hive. Regedit in XP can make corrections, or if the damage is such that regedit bugchecks you can use chkreg to fix the hive.

Link to MS article on how to fix this problem

Link to w2k version of chkreg (works with any NT 4.0 or 5.x registry)

How to Maintain Current Registry Backups in Windows NT 4.0 and Windows 2000 ( and XP )
 
Lol, Smilin...I had already linked to the MS page you linked to. Read my first post in this thread (fourth post down). You'll see I linked to the main page you're referring to.

However, as you will notice from reading this whole thread, he had turned OFF system restore, which left him unable to take advantage of the easiest way to get back to normal.

Your third link on how to make backups of the registry is useful, but you will see that my link to Erunt -- http://www.larshederer.homepage.t-online.de/erunt/ --makes it so much easier. And, it saves backups by the day (not overwriting previous day's backups). Loads automatically upon startup, by default. Freeware.

I will look into the checkreg utility. Kind of funny that the size is 93KB, and MS says it takes 6 floppies to download it. I'm assuming those floppies are the setup discs.

I'm wondering if the BartPE can be used to run checkreg. Are you familiar with BartPE?
http://www.nu2.nu/pebuilder/
 
Yeah, I skimmed some :blush; sorry for the repost.

I've heard of Erunt before (nothing bad) but never used it myself. For people I fix I've never had chkreg fail me unless the hive is like chopped in half or something. I've got backups for myself.

The reason that thing takes so many floppies is it is actually a combination of Setup+checkreg. It makes a self booting set of floppies that boot/repair then quit. I use the MS Internal (completely unsupported) version which is standalone and has defrag capabilites. An oversized system hive (~10.5MB on NT/2k/XP) that ntldr can't hold in it's memory (16mb NT/2k/XP, 64mb 2k3) will generate the same error. It also has a verbose output mode so you can see what got fixed and what got truncated.

I've heard of WinPE once or twice (hehe I used to do tech support for it at MS among other things). It's not really a product ready for the consumer world so MS isn't so happy about Mr. Bart spreading it around. Chkreg just needs a 32bit Windows environment to run so it should be fine in WinPE. You might be able to snag the core CHKREG.EXE from that 6 floppy image somehow. It would make a kewl addition to a PE disc.
 
I guess the biggest question I would have is, what's actually causing the hive to grow exponentially? What is comprising the growth, just stray characters? Sounds like some sort of cancer.

I mean corruption is corruption, but what that usually means to me is that some normally readable data is in some scrambled form. This problem sounds like it's more of a condition whereby extraneous data in large amounts is somehow embedded in the registry hive.

By the way, I'm a skimmer myself, and have been burned on more than one occasion when someone says "hey, I already did that...see above!", lol.

You should give Erunt a whirl just to see what it does. It saves daily backups (appears to be 30 days cycle) of the registry hives, in addition to ntuser.dat and usrclass.dat files. Defaults to saving them in a folder called "Erdnt" as a \windows subfolder, but you can tell it to save anywhere.

I currently have Erdnt folder backups of 3/9/05-today, each in its own individual folder, so lots of backups to choose from.
 
Thanks you guys. I guess I am being unfair to RealPlayer, of course. I'll do all the checking for bad sectors and what not tonight. Hey, I have a different problem with another computer if either of you guys feel like chiming in. 🙂 It's going on at this link: http://forums.anandtech.com/messageview...atid=32&threadid=1562539&enterthread=y if either of you feel like getting in on the action. 😉 Anyway, thanks you guys.

EDIT--scratch that, I got that other problem fixed too.
 
Originally posted by: Slikkster
I guess the biggest question I would have is, what's actually causing the hive to grow exponentially? What is comprising the growth, just stray characters? Sounds like some sort of cancer.

I mean corruption is corruption, but what that usually means to me is that some normally readable data is in some scrambled form. This problem sounds like it's more of a condition whereby extraneous data in large amounts is somehow embedded in the registry hive.
Click to expand...

The hive isn't stored in the same tree like fashion that you view it. It's stored in a cell structure of some sort for high access speed. When you add and remove keys and values whitespace can get left over. This builds over time naturally but plateaus at a certain point. It's not unlike the way a disk fragments.

Poorly written 3rd party apps and drivers sometimes access the registry too much or in an unusual manner and you can get excessive whitespace. With the software hive this is very rarely a problem. With the system hive it can get to be a problem quickly. The pre-2003 version of ntldr only has 16mb of space for boot-start services/drivers plus the whole system hive. If everything can't fit you get a missing or corrupt system.ced error.

Even with badly behaving 3rd party apps/drivers hitting the registry it usually take a long time for the hive to get oversized. I have seen a few instances where it would grow rapidly and this was a real problem. SAN problems are one example. A SAN with crappy drivers/firmware, switch problems etc can sometimes cause drives to disappear and reappear to the OS. When this happens the mounteddevices key can get excessively large for one. If the driver for the device adds some "extras" when it installs you can also get piles of entries in the registry.

If the installer is well behaved you get excessive whitespace in the registry that will build up over time beyone the "plateau". If it's not well behaved it will leave entries behind and the hive will grow rapidly. I've seen them getting out of size in a matter of days.

Growth aside, corruption is often something as simple as a cell being expanded so more data can be added then the box has a power failure or something and the data never gets added. It's also just a file like any other on the disk. All sorts of crap can happen during an ungraceful shutdown or drive/controller problem. Windows is freakishly protective of these files. It journals changes to the registry (the .LOGs) and also runs two simultaneous copies (the .ALTs) of each hive to try and stop problems. Sometimes sh1t just happens tho.

For your curiosity, here's the partial output from a chkreg run I did the other day. We had a server throw a drive, and as often happens the raid controller didn't handle it 100% gracefully. We replaced the drive, but booted to a Stop 0xC0000218 (corrupt software hive)....

----------
Fatal: Invalid Hive file Length (15433728) ... fixed
Invalid Base Block CheckSum (0x2859b5cc) ... fixed
Invalid backward link in security cell (0xe6d808) ... fixed
Number of Bins in hive: 2547
Total Hive space usage: 90.59%
ValueList 0x1 for key 0xd88668 dropped!
KEY:\Classes\CLSID\{CB632C76-8DD4-11D1-ADDF-0000F87734F0}\MiscStatus
Used free cell 0xdee020 ... unable to fix
Data cell corrupted in Key Value (0xc14b78) ... fixed
KeyValue not allocated cell 0xdee3f0 ... deleting value
KEY: \Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-267015059-170048233
7-630672053-4200\GroupMembership has a bogus value at index 7
.
. (about a page of corrections then the summary...)
.
KEY: \Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-267015059-1700482
337-630672053-3315 has a bogus value at index 2
KeyValue not allocated cell 0xdee1e0 ... deleting value
KEY: \Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-267015059-1700482
337-630672053-3315 has a bogus value at index 5

SUMMARY:
Cells, Size, Category
38408, 3889456, Keys
73842, 2417512, Values
12014, 423168, Key Index
33530, 520664, Value Index
1221, 353424, Security
60103, 4296456, Data
2613, 3422872, Free
221731, 15323552, Total Hive

30009 (78.13%) compacted keys (all related cells in the same view)
--------------
 
Cool...sounds like checkreg might be a good idea to run even if no obvious problems exist. By the way, the author of Erunt also has a registry optimizer that doesn't do repairs, but does remove slack space from hives. It's called NTRegopt. Free.

From the FAQ:

Introduction
------------

Similar to Windows 9x/Me, the registry files in an NT-based system
can become fragmented over time, occupying more space on your hard
disk than necessary and decreasing overall performance. You should
use the NTREGOPT utility regularly, but especially after installing
or uninstalling a program, to minimize the size of the registry files
and optimize registry access.

The program works by recreating each registry hive "from scratch",
thus removing any slack space that may be left from previously
modified or deleted keys.

Note that the program does NOT change the contents of the registry in
any way, nor does it physically defrag the registry files on the drive
(as the PageDefrag program from SysInternals does). The optimization
done by NTREGOPT is simply compacting the registry hives to the
minimum size possible.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top