Tag Archive for 'registry'

The Saga of the Corrupt Registry

Saturday while Jen was preparing some wood boxes for painting, I was trying to see if I could get Bumble (Jen’s Windows 2000 based computer) to sleep or hibernate. My motive for this was due to all of the energy conservation literature I’ve been exposing myself to lately - I figured I could save power if I got Jen’s computer to quickly sleep while not in use. I quickly found out sleep mode wouldn’t work, but I figured Hibernate would be just fine. After enabling hibernate mode, I (seemingly) hibernated the computer with no problem. This was around 5pm.

When I turned Bumble back on, it started to boot just fine, but right about the time when you expect to see the GUI come up, it would reboot. If I let it, it would keep doing this startup/reboot loop forever. I tried booting into safe mode, but I experienced the same reboot loop problem. I had no idea what was going on at this point.. I thought maybe windows was reading something in the something in the hibernation file (hiberfil.sys) that it didn’t like and then rebooting. I thought if I could only remove that file, everything would work fine.

Luckily, I had ubuntu installed on another partition (dapper drake (6.06).. a little old, but still very useful). After fighting with the wireless card momentarily (using ndiswrapper and windows based tnet1130 drivers), I was able to browse the web and find that I needed the ntfs-3g driver to write to (or delete from) NTFS filesystems. I got the appropriate driver and setup everything, but the filesystem wouldn’t mount. The ntfs driver complained the filesystem was marked as crashed and told me I’d need to run windows’ chkdsk utility. Great, I don’t have windows accessible at the moment!

I searched around a bit for some operating environment that would let me run chkdsk and found BartPE. This is a great utility that basically builds a windows livecd using whatever current version of windows you have running. As I was running Linux on my laptop at the time, I rebooted into windows (good thing I keep XP around!) then created a BartPE disc.

Booting BartPE on Bumble was a little odd - it asks (scarily) to upgrade or install a new version of Windows XP, but pressing F10 (to select a new install) just starts up BartPE. I guess that’s what happens when you use a OEM version of Windows to build a BartPE disc.

Inside BartPE, I was presented with a strange ‘mini-windows’ The PE builder replaced Windows XP’s start menu and taskbar with something very stripped down. It seemed to work however, and provided me with a minimalist working environment. I was able to open a command line window and start chkdsk.

Chkdsk ran for about 2 or 3 hours doing a full filesystem scan. This was probably unnessecary, but I wanted to be sure there would be nothing left to blame on the drive. During this time I was able to eat the dinner Jen had been very graciously slaving over for hours (awesome beef/bean/stuff enchiladas!). Finally able to mount the ntfs partition in Ubuntu, I removed hiberfil.sys and rebooted. No dice. Damn!

After lots of searching, I found that having a corrupt registry could cause this reboot loop. Thanks to this post on google groups, I found old registry from feb 2005. This registry was so old it was basically useless, but it let me boot the computer at least! I then tried a variety of old and new registry file combinations until I found the corrupt file - of course the biggest and most important one, the software hive.

At this point I was able to boot into Windows 2000, but in a weird environment with user accounts but no settings or software registry. I tried to find registry recovery tools until around 1:30am. Among the various tools, I found Microsoft’s corrupt registry repair tool but I didn’t have the 6 floppies the tool required. I was so tired that I figured I’d get floppies in the morning at Staples, and went to bed.

Sunday morning, having made prior commitments, I went to spar briefly at 9 with some friends from Tae Kwon Do. We finished up around 10, but Staples was still closed. Cursing the gods of retail, I went home and did some more searching for corrupt registry repair tools.

Now that I’d had a chance to sleep, I quickly found RegDatXP. Its info page mentioned loading corrupt registry files in a newer version of windows (xp, vista). Apparently Microsoft realized the importance of registry files and built in corruption recovery systems to these later versions.

Feeling glad for once that I keep Windows XP on my laptop, I loaded the corrupt binary registry file in Windows XP’s regedit tool (file -> load hive). I assigned it to a temporary key under HKEY_LOCAL_MACHINE (tempKey). Regedit bitched that the file was corrupt, but loaded it anyway. I was able to open the temp key and see software entries. Huzzah! I first exported a .reg file, then unloaded the hive.

I copied the hive and .reg files back to Bumble, opened the repaired hive in regedt32 (on Bumble) and was able to browse the hive without trouble! I tried to import the hive into the live system, but (of course) it said I couldn’t. I then went back to Ubuntu and (after saving everything - can’t ever have too many backups!) replaced the operative software hive file with the repaired original hive (these files are in C:\WINNT\system32\config).

Finally, I booted Windows 2000 and everything worked fine! Yay! I didn’t have to buy any tools of questionable quality or content! I didn’t have to use 6 floppies (although that probably would’ve worked had I not had Windows XP sitting around as well). Huzzah!

Lesson learned: Don’t trust Microsoft when they say Hibernate works! In fact, don’t change any settings in a working Windows install, ever. Especially Windows versions older than XP (which has better recovery tools built in). Also, for good measure, Microsoft sucks! ;) Use Linux! ;) If Jen just used Ubuntu all the time, not only would she not be able to run half the software she uses daily, she would also not be subject to time wasting breakage like this :).

So, here’s the short fix if this happens to you:

  1. Get BartPE and run chkdsk to ensure your filesystem is intact.
  2. Backup your current registry hives (C:\WINNT\system32\config). Backup your backup hives too, just to be sure (C:\WINNT\repair\*.*)
  3. Figure out which combination of new and old registry files breaks your system.
  4. Copy the bad files to a working Windows 2003 or newer install.
  5. Load bad hives in regedit on the newer Windows.
  6. Unload now fixed hives, copy back to broken system.
  7. Place hives back in place while not booted into broken system.
  8. Go back to hatingenjoying your windows install!