Download the Registry Restore Wizard here:
http://viceroy.web1000.com/files/regreswiz.zip
It's the latest version. Dump the files into the folder I mentioned, and rebuild.
There were some issues with earlier versions of the restore wizard.
What do you mean "two steps into it"? Exactly where did it fail? Did you see any restore points?
OK, let's do this manually. I just checked this procedure, and it will work just fine. I say that knowing that somehow or someway, you'll probably have some other issue with it, lol, but it SHOULD work
Forget about the Registry Restore Wizard for now. Just boot up with BartPE.
Now, from the menu, choose the A43 File Manager from the menu. You'll see it come up on the screen. It looks a lot like Windows Explorer.
Now, repeat the process. In other words, open a second instance of A43. You might find that you will have to shrink the window to see the second window behind it. Don't minimize it, just make the windows smaller.
Ok, cool? You should have two separate windows/applications on screen now of the A43 file manager.
Ok, one the first iteration/window on the left side, click on the C: drive icon so it opens up its subfolders.
Now, scroll down the list until you get to the:
"C:\System Volume Information" folder.
Ok, now, click on that folder, and you should see
something like this:
"_restore{8021500D-3D7F-4A8D-8EAB-2F7F9C21092D}"
I say
something because the series of numbers/letters inside the brackets on your laptop will be different from mine. The common thread is that it will start with:
"_restore{xxxxxxx-xxxx-xxxx-xxxxx-xxxxxxxxx}" where "x" equals your numbers/letters.
Now, you may have more than one "_restore{blahblahblah} folder. But the one with your restore points should have a plus sign on the folder name to show that it has sub-folders. You're specifically looking for subfolders that other folders that start with:
"RPxx", where "xx" equals a number. Each of your restore points will have a number, starting with 1. The most recent number will be the highest number you see. Make sure you scroll down to see them all to choose the highest RP. My highest RP is:
RP118
Your number will be different, of course, but I use this as an example. I obviously don't want to chose RP62, because that restore point is months old, probably, and would cause me to have to reinstall all kinds of programs and drivers. I want the most recent GOOD restore point. To be safe, you might want to choose the second to most recent, because that will absolutely be a good restore point. But you can always repeat the process with BartPE if the first one doesn't work out by choosing a slightly older (lower) restore point.
So now, after clicking on the highest folder with RP in its name, my path would look like this:
"C:\System Volume Information\_restore{8021500D-3D7F-4A8D-8EAB-2F7F9C21092D}\RP118\"
Now, once I click on RP118, there are sub-folders inside that one, too.
I'm only interested in one sub-folder: The "snapshot" sub-folder"
"C:\System Volume Information\_restore{8021500D-3D7F-4A8D-8EAB-2F7F9C21092D}\RP118\snapshot" is where I'm at by clicking on snapshot.
Inside the snapshot folder are backups of your registry "hives". We are only interested in one of these files (aka hives).
The ONLY file we want to use in this folder is labeled "_REGISTRY_MACHINE_SYSTEM".
Don't do anything with that file right now. Just leave that A43 window open in the snapshot subfolder of your highest RPxx folder.
Now, move over to the second window/iteration/instance of A43 on the right. Here, we want to open the following folder:
"C:\WINDOWS\system32\config"
This folder is where your registry hives live, and this folder is where your corrupted System hive is.
In this folder, you will see most of the following files:
AppEvent.Evt
default
DEFAULT.LOG
default.sav
sam
SecEventEvt
security
SECURITY.LOG
software
SOFTWARE.LOG
software.sav
SysEvent.Evt
system (<--------- This is the file that needs to be replaced)
SYSTEM.LOG
system.sav
etc. etc.
The file named "system" (no file extension; just "system") is your corrupted system file.
Right click on that file, and choose "Rename". Rename the file to something like "system.bad". You can rename it to anything, really, but please just rename it to "system.bad" for now so Windows ignores it.
It takes a few seconds for A43 to complete this in BartPE. You can right-click with your mouse inside the folder and choose "Refresh" to make sure the file name was changed.
Now, lets' go back to the A43 window/iteration/instance on the left side; the one with your "snapshot" folder opened up.
Find the file "_REGISTRY_MACHINE_SYSTEM". You can either right-click and drag it over to the A43 window/iteration/instance on the right that's opened up to the ""C:\WINDOWS\system32\config" folder, or you can just right click on the file itself and then choose "Copy". Move the mouse over to the other A43 window (system32\config) and right-click on the folder window and choose "paste".
Either way, you should now see the file named _REGISTRY_MACHINE_SYSTEM in your C:\Windows\System32\Config folder, with the other files mentioned above, including system.bad.
Now, right-click on the _REGISTRY_MACHINE_SYSTEM file in the C:\Windows\System32\Config folder that you just copied/pasted, and choose "Rename".
Rename it to "system" (without the quotation marks!)
You've just replaced your corrupted system file with your backed up restore point system file.
Make sure it's simply named system with no file extension or periods or any of that. Just system
Now, you're done.
Exit out of A43. Reboot the PC, making sure that you remove the BartPE disc. All should be well with the world. If it's still bad, repeat the process above, but choose the second highest RPxx folder\snapshot sub-folder for the file.
Facebook
Twitter