Registry corruption causing boot loop
I was running Norton Antivirus and my machine (W2K SP1) spontaeously rebooted. This has never happened before.
Now when I boot I get a blue screen that flashes up with some message about the registry and then the machine tries to reboot again.
(Note that this problem was not caused by a virus.)
What is the best way to fix this?
1. Create an emergency boot floppy and try to copy back the backup registry file? (Where is the registry now and what is the backup copy of the registry called - SYSTEM.BAK?)
2. Boot from the W2K CD and use the repair option? (I have had bad experiences with that option on NT4.)
3. Boot from a CD and run registry checking software? (I can't seem to boot into Windows from the W2K CD - it only allows you to run setup.)
Andrew.
Now when I boot I get a blue screen that flashes up with some message about the registry and then the machine tries to reboot again.
(Note that this problem was not caused by a virus.)
What is the best way to fix this?
1. Create an emergency boot floppy and try to copy back the backup registry file? (Where is the registry now and what is the backup copy of the registry called - SYSTEM.BAK?)
2. Boot from the W2K CD and use the repair option? (I have had bad experiences with that option on NT4.)
3. Boot from a CD and run registry checking software? (I can't seem to boot into Windows from the W2K CD - it only allows you to run setup.)
Andrew.
Try hitting F8 at bootup. It should allow you to get into safe mode, where you can remove the failed installation.
Hi,
I would start here... Repairing, Recovering, and Restoring an Installation of Windows 2000.
http://www.microsoft.com/windows2000/techinfo/reskit/samplechapters/fndc/fndc_rec_uctu.asp
Cheers,
T.
I would start here... Repairing, Recovering, and Restoring an Installation of Windows 2000.
http://www.microsoft.com/windows2000/techinfo/reskit/samplechapters/fndc/fndc_rec_uctu.asp
Cheers,
T.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
can you describe the blue screen more precisely? STOP 0x???
did you make backups of the box?
Last known good config may work.
Repair nearly always helps but restored very old registries if you don't have a ERD.
did you make backups of the box?
Last known good config may work.
Repair nearly always helps but restored very old registries if you don't have a ERD.
aphillips I suggest everyone have a backup of the system state handy incase of disasers like this one. After you fix it up with a repair or reinstall.. Do yourself a favor & backup the system state with ntbackup.. Last week it saved my ass twice...
ASKER
Thanks to all who posted replies and tips. I will investigate them all until I find a solution. I have replied to the simple ones I have already tried below.
tonnybrandt wrote:
> Try hitting F8 at bootup. ... safe mode ...
For some reason I didn't think that would work. Anyway I have tried it and it doesn't work. However, this time when it reboots it doesn't display any message. I have also tried "Last Known Good Configuration" but with the same result.
I also tried the recovery console. This is an option in setup after you go into the "Repair Windows Installation" option.
In the recovery console I copied SYSTEM32\OPTIONS\SYSTEM.AL
franka wrote:
> can you describe the blue screen more precisely?
It says "STOP: C0000218 (Registry File Failure) ..." I think, since it only flashes up for a small fraction of a second.
> did you make backups of the box?
I have all application data backed up but I suspect that it is safe on the disk anyway. I don't have backups of the OS/config. I had the whole system set up so that I could quickly make a Ghost image of my boot/OS drive (C:) to a spare FAT partition. But MSDOS cannot access the partition, because (I think) it is at the end of the 15Gb disk. And I haven't got around to creating a Ghost image by any other means.
>Repair nearly always helps but restored very old registries if you don't have a ERD.
I tried these with NT4 a couple of times (once when installing SP4 ruined the system). The repair option and the ERD never worked for me under NT4 so I have never bothered with them.
Andrew.
tonnybrandt wrote:
> Try hitting F8 at bootup. ... safe mode ...
For some reason I didn't think that would work. Anyway I have tried it and it doesn't work. However, this time when it reboots it doesn't display any message. I have also tried "Last Known Good Configuration" but with the same result.
I also tried the recovery console. This is an option in setup after you go into the "Repair Windows Installation" option.
In the recovery console I copied SYSTEM32\OPTIONS\SYSTEM.AL
franka wrote:
> can you describe the blue screen more precisely?
It says "STOP: C0000218 (Registry File Failure) ..." I think, since it only flashes up for a small fraction of a second.
> did you make backups of the box?
I have all application data backed up but I suspect that it is safe on the disk anyway. I don't have backups of the OS/config. I had the whole system set up so that I could quickly make a Ghost image of my boot/OS drive (C:) to a spare FAT partition. But MSDOS cannot access the partition, because (I think) it is at the end of the 15Gb disk. And I haven't got around to creating a Ghost image by any other means.
>Repair nearly always helps but restored very old registries if you don't have a ERD.
I tried these with NT4 a couple of times (once when installing SP4 ruined the system). The repair option and the ERD never worked for me under NT4 so I have never bothered with them.
Andrew.
is it like this:
STOP: c0000218 {Registry File Failure}
The registry cannot load the hive (file):
\SystemRoot\System32\Confi
or its log or alternate.
It is corrupt, absent, or not writeable.
so which hive is the problem?
STOP: c0000218 {Registry File Failure}
The registry cannot load the hive (file):
\SystemRoot\System32\Confi
or its log or alternate.
It is corrupt, absent, or not writeable.
so which hive is the problem?
ASKER
> so which hive is the problem?
SOFTWARE hive
I went into the recovery console and copied \winnt\repair\SOFTWARE to \winnt\system32\config\SOF
Some apps lost settings and some wouldn't run at all. I have fixed/reinstalled, and everything is just about normal again. I will backup using Norton Ghost in future or at least take a copy of my registry files.
The next question is why Norton AntiVirus caused this problem. I suspect it was not NAV itself but the fact that I was running NAV to check our server files and testing an OpenGL (3D graphics) program at the same time.
A while ago I used to run 2nd Copy to continually and automatically backup certain files to the network server. Often when this was happening and I ran an OpenGL program the system would crash (just spontaneously reboot). The crashes stopped happening when I got rid of 2ndCopy.
My theory is that the network card (in 1st PCI slot) and AGP video card share an interrupt. When I do a lot of network stuff and video stuff simultaneously this causes major problems - crashes and even registry corruption. This is hard to prove but fits the facts (except that I don't know if Intel motherboards do share interrupts between AGP and PCI slot 1, although I know most motherboards do).
SOFTWARE hive
I went into the recovery console and copied \winnt\repair\SOFTWARE to \winnt\system32\config\SOF
Some apps lost settings and some wouldn't run at all. I have fixed/reinstalled, and everything is just about normal again. I will backup using Norton Ghost in future or at least take a copy of my registry files.
The next question is why Norton AntiVirus caused this problem. I suspect it was not NAV itself but the fact that I was running NAV to check our server files and testing an OpenGL (3D graphics) program at the same time.
A while ago I used to run 2nd Copy to continually and automatically backup certain files to the network server. Often when this was happening and I ran an OpenGL program the system would crash (just spontaneously reboot). The crashes stopped happening when I got rid of 2ndCopy.
My theory is that the network card (in 1st PCI slot) and AGP video card share an interrupt. When I do a lot of network stuff and video stuff simultaneously this causes major problems - crashes and even registry corruption. This is hard to prove but fits the facts (except that I don't know if Intel motherboards do share interrupts between AGP and PCI slot 1, although I know most motherboards do).
ASKER
Thanks for all the tips. I wish there were a way to split the points more fairly. However, it was lyonst who pointed me to the information I needed.
The info on the Microsoft site was OK but the best info was at:
http://www.jsiinc.com/SUBF/TIP2800/rh2809.htm
The info on the Microsoft site was OK but the best info was at:
http://www.jsiinc.com/SUBF/TIP2800/rh2809.htm
aphillips I suggest to you & everyone else who reads this to do the following...
-Run NTbackup.
-Backup the system state to a local drive..
-A restore of the system state in restore mode is quick & easy & can fix countless problems at a critial time...
-Ms should have made events or huge pop-up messages reminding people to do this every month or so...
-Run NTbackup.
-Backup the system state to a local drive..
-A restore of the system state in restore mode is quick & easy & can fix countless problems at a critial time...
-Ms should have made events or huge pop-up messages reminding people to do this every month or so...
ASKER
Housenet wrote:
> aphillips I suggest to you & everyone else who reads this to do the following...
> -Run NTbackup.
> -Backup the system state to a local drive...
I used to religiously create backups to DAT tape on my NT 4 system. Twice I had major corruptions and they were no use at all. I wasted days trying to recover the system (not to mention the time creating the backups). In the end I rebuilt everything from scratch which only took a day.
For this reason my strategy with W2K was to create Norton Ghost images of my boot/Windows drive regularly to a spare partition. It only takes about 20 minutes to boot into DOS and take an image of a 1 Gbyte partition. Unfortunately, I couldn't see the spare partition from MSDOS due to it being at the end of the disk (I think) and I never got around to creating a Ghost image via network/parallel port/Zip disks.
> MS should have made events or huge pop-up messages reminding people to do this every month or so...
I assumed (wrongly) that a copy of the last know good registry is taken whenever you reboot. I assumed this would be restored when you select "Last Known Good Config" from the boot menu.
It would make enormous sense that Windows 2000 created several backups of registry files, particularly as most people have Gbytes of free disk space nowadays.
> aphillips I suggest to you & everyone else who reads this to do the following...
> -Run NTbackup.
> -Backup the system state to a local drive...
I used to religiously create backups to DAT tape on my NT 4 system. Twice I had major corruptions and they were no use at all. I wasted days trying to recover the system (not to mention the time creating the backups). In the end I rebuilt everything from scratch which only took a day.
For this reason my strategy with W2K was to create Norton Ghost images of my boot/Windows drive regularly to a spare partition. It only takes about 20 minutes to boot into DOS and take an image of a 1 Gbyte partition. Unfortunately, I couldn't see the spare partition from MSDOS due to it being at the end of the disk (I think) and I never got around to creating a Ghost image via network/parallel port/Zip disks.
> MS should have made events or huge pop-up messages reminding people to do this every month or so...
I assumed (wrongly) that a copy of the last know good registry is taken whenever you reboot. I assumed this would be restored when you select "Last Known Good Config" from the boot menu.
It would make enormous sense that Windows 2000 created several backups of registry files, particularly as most people have Gbytes of free disk space nowadays.