On Fri, 7 Jul 2006 15:14:02 -0700, langholme
Thats the point! kb915092 is very informative but how can you run an
executable program on an operating system that will not load in safe, normal,
command prompt or any other mode?
From the same or compatible operating system that is not booted from
the (damaged, corrupted, infected, etc.) hard drive.
Alas, out of the box this is not possible with XP, unless you make
your own bootable CDR using Bart PE (do a search for "Bart PE"). Even
then, certain tools that assume they are running from the same Windows
installation they are to work on (e.g. if they involve the registry)
won't work as expected, requiring careful assessment on the part of
the user or tech as to whether the Bart plugin RunScanner will help.
OTOH, if you've lost a registry hive, you may be able to replace that
hive via Bart CDR boot or from another XP installation running on
another PC (NB: Never allow an XP hard drive to boot in the wrong PC!)
The generic approach is:
- ensure hardware is OK (RAM, HD)
- rename away the bad hive file
- find other hive files of that name
- copy the latest-dated one to the active location
You rename away the old hive file so that it is not overwritten, so
that if you mess up, you can Undo back to where you started.
You first check hardware (MemTest86, HD Tune) because if the hardware
is bad, anything you try to do could make things worse.
There are two sets of registry hive files in XP:
1) The system-level files
These reside in System32\Config, and have no file name extension. You
won't see them properly, if at all, unless Explorer (or 3rd-party
shell) shows hidden and system files, and shows file name extensions,
else the associated fallback and log files will appear to have the
same name as the "real" hive files - which are...
- SYSTEM
- SAM
- SECURITY
- DEFAULT
- SOFTWARE
....and the associated file types are, AFAIK,...
- *. (no extension) = the "live" hives
- *.sav = original installation-time hives
- *.log = logging file, I presume (too small to be a hive)
- *.evt = no idea, sorry! (too small to be a hive)
2) The user-level files
This is a single NTUSER.DAT file that resides in the user account's
base directory (or for system, in System32\Config\systemprofile).
Notice that unlike Win9x, XP does NOT maintain backups of the registry
hives, to fall back to if something goes wrong. The "last known good"
state is merely a copy of a few keys that is AFAIK physically stored
in the same file as the "live" ones, so that anything that eats the
file will also eat the fallback.
However, if you have System Restore running, then copies of the
registry hives will be kept as part of each restore point. Once you
aren't running the Windows installation, these can be searched for (I
use Agent Ransack running from Bart PE CDR) and copied about,
including over the damaged hive files you want to replace.
You can attempt an "easier" fix by doing a System Restore, which will
cause all monitored files (including all of the registry) to fall back
to the state at the time the restore point was made. However, AFAIK
that can only be done from the stricken installation, so if that
installation cannot boot, you have a problem.
If you do favor the System Restore fallback option, then you could try
this (I've never done this, so use at your own risk...)
- from Bart or other PC's XP, rename away existing active hives
- copy the .SAV equivalents in as active
- if this boots up, do a System Restore rollback from there
You don't easily do that, because
- of difficulties doing that
- you don't know what the tool will do if run when OS not booted
Bart PE can, if USB is in when Bart boots, but the second factor is
what would make me nervous about trying it.
------------ ----- --- -- - - - -
Drugs are usually safe. Inject? (Y/n)
