Registry recovery

Posted on 2004-08-18
Medium Priority
Last Modified: 2010-04-13
Problem description:
Running Windows 2000 SP4

In the course of attempting to establish a network connection between computers, I seem to have corrupted the registry at least. The system starts up fine, if slowly. Here are some of the symptoms:
1.      Control panel> printers is empty
2.      Control panel > Network & dial-up connections is empty.
3.      Opening any folder Explorer gives a message from AdShield before opening: Error 0x800706b5 reading the block list. AdShield is an advertisement blocking utility.
4.      Opening a file in Word gives this message: “This document could not be registered. It will not be possible to create links from other documents to this document.” several times.
5.      PowerPoint will not open a file, nor will Access. Outlook seems to work, although there is no internet connection.
6.      Looking at Control Panel>Admin Tools>Component Services>Event Viewer>System I see:
The errors are nearly all from Service Control Manager events 7001 and 7022
Information events from Tcpip event 4201
At startup first came Error from sparrow Event 4
then information from Tcpip event 4201
then information from eventlog events 6009, 6005
(Some of these events at startup will have come from Outlook trying to fetch mail, since network communication no longer available.)
7.      Looking at Control Panel> Admin Tools>Component Services>Event Viewer>Application I see:
Information from ptssvc event 105
Information from NProtectService event 3
8.      Tried to add a printer, got error message Printer operation cannot continue due to lack of resources. The print subsystem is unavailable.
9.      Tried to run the Network Connection Wizard. It hangs up at its start screen. Task manager reports it not responding. I killed it.
10.      Tried to copy a file folder from one drive to another. Drag and drop does not work. Right button copy and paste does not work.
11.      Found instructions to correct the MSOffice registry: start Office setup with /y switch. Results in error; “Invalid command line parameters.”  Even setup.exe without parameters refuses to run.

If in fact restoring the registry is in order, I am not clear on the best way to do it C:\WINNT\repair\RegBack has files only a month old and I have an ERD of the same date.  There have been very few changes in the system since that backup.  Perhaps a MS Windows critical update or two. Do I simply substitute the backup files for their counterparts in C:\WINNT\system32\config? If so which ones are likely the problem?
Question by:Dmetzstein
  • 2
LVL 44

Expert Comment

ID: 11836396
Ummm I would first look into viruses

Double Check for viruses
Online Scanners

 Norton Web Services  
Virus Detection provides an analysis of your results and offers suggestions for further action. It does not examine compressed files or fix infected files.

When Symantec receives notification about a new virus, we develop and post a solution as quickly as possible. We are committed to providing swift responses to all virus threats, including Trojan horses.

 Trend Micro HouseCall        

eTrust Online antivirus scanner

PC Pitstop Virus Scan
When the download completes, you will receive an ActiveX security dialog for the PC Pitstop virus scanner. Click Yes to install the scanner and proceed to the virus scan.

If you are currently running an antivirus package such as Norton Antivirus, it may detect our own virus detection file as a virus. If this occurs and you wish to use our scanner, please (temporarily) disable any active background virus checking software before scanning, or add our signature file (PAV.SIG) to the scanner's file exclusion list
LVL 44

Accepted Solution

CrazyOne earned 1000 total points
ID: 11836402
Note the following approcah will not replace any system files.

Can you boot to your Win2000 CD? If so then when it finally boots At the "Welcome to Setup" screen, press F10, or press R to repair, and then C to start the Recovery Console this will allow you to use the command line. From here do something like the following. Or if the file system is FAT32 you can use a Win98 bootdisk to do this. www.bootdisk.com

COPY /Y C:\WINNT\repair\RegBack\TheParticularHive C:\WINNT\system32\config\

This will replace the registry hive to the last time that hive was bacped up. Hopefully you didn't backup the registry at the time the problems started to happen.

Following is a list of the files that are the registry hives. I would suggest starting with the SYSTEM hive and then reboot and if the problem still persists do the SOFTWARE hive next. Note these files don't have a file extension on them


For the SYSTEM hive you could try the following before doing the copy method.

ren c:\WINNT\system32\config\SYSTEM SYSTEM.bak
ren c:\WINNT\system32\config\SYSTEM.alt SYSTEM

I would suggest to first BACKUP these hives from the C:\WINNT\system32\config\ to folder of your making or choice just don't back them up to the C:\WINNT\repair\RegBack\ folder.  

You will probably need to reapply any services patches that you have previously installed.

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
You do not need to be a security expert to make the RIGHT security. You just need some 3D guidance, to help lay out an action plan to secure your business operations. It does not happen overnight. You just need to start now and do the first thin…
This video tutorial shows you the steps to go through to set up what I believe to be the best email app on the android platform to read Exchange mail.  Get the app on your phone: The first step is to make sure you have the Samsung Email app on your …
Stellar Phoenix SQL Database Repair software easily fixes the suspect mode issue of SQL Server database. It is a simple process to bring the database from suspect mode to normal mode. Check out the video and fix the SQL database suspect mode problem.
Suggested Courses

599 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question