Notebook having serious issues...

A customer called me and said her notebook worked last night, but that this AM, she has an error when she tries to log in.  The error was that the c:\windows\system32\config\system was corrupt.  I did some googling and worked out that problem.  Now, when the notebook boots, I get this:

When trying to update a password the return status indicates that the value provided as the current password is not correct (generated by lass.exe)

After tons of googling and KB articles, I've gotten no where.  I could install XP over itself, but she would have to reinstall all apps and reconfigure the notebook.  A GREAT deal of work has gone into configuring the notebook and she really doesn't want to do that.

I've checked it for sasser, used the Offline Crack to turn off the repair tool password (which did not work by the way) and I'm at a loss.  When I try to run the Repair tool after booting off the CD, no password works.  This is after I used the Offline Crack to reset the Restore Mode password to a known password.

Any thoughts?

Thanks

Cliff
crp0499CEOAsked:
Who is Participating?
 
craylordConnect With a Mentor Commented:
http://www.nu2.nu/pebuilder/start/
Instructions, no pictures. Ultimate-computing seems to be down.
0
 
crp0499CEOAuthor Commented:
I can't get to the recovery console.  It's asking for a password, even though there isn't one, not even for the admin account, and I have used the Offline Password Crack Utility to set the recovery console password to skipped and I am still prompted for a password before I can access the recovery console.
0
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

 
fruhjCommented:
You might need to pull the notebook drive and attach it to a working PC to have a look at the drive.
You can use the drive with a notebookdrive-to-40pin ide adapter or with a notebookdrive-to-USB adapter.

I can't help you on cracking the password as I've never had to do that, but once you have the drive loaded, you can use your own copy of regedit to "load hive" - and find the registry hive file in the windows directorty of the bad laptops drive.

With that you can do a lot of investigation / change registry settings etc..
0
 
venom96737Commented:
Did you use the microsoft fix for this corrupt registry by any chance and move the files located in c:\windows\system32\repair into the registry hives?  If you did this on and OEM copy you will get this password crap as OEM makes their own passwords on install that will not be in the c:\windows\system32\repair versions.  What you can do is goto c:\system volume information\restore and pick registry hives that date back to before the corrupt registry and move them to the same places as you did before this should solve your issues.
0
 
crp0499CEOAuthor Commented:
I originally booted with an OEM copy, yes.  We ran the steps in KB 307545.  At that point, we were able to get to the Repair Console.  After that KB article, we were then prompted for a password to access the Repair Console.  I can't get past that really.
0
 
venom96737Connect With a Mentor Commented:
That is the answer to your problem what i just stated if you look back at KB307545 you will see a big warning at the start that says users of OEM versions should not use this here is what its says.
Warning Do not use the procedure that is described in this article if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives.

You can repair a corrupted registry in Windows XP. Corrupted registry files can cause a variety of different error messages. See the Microsoft Knowledge Base for articles about error messages that are related to registry issues.

This article assumes that typical recovery methods have failed and access to the system is not available except by using Recovery Console. If an Automatic System Recovery (ASR) backup exists, it is the preferred method for recovery. Microsoft recommends that you use the ASR backup before you try the procedure described in this article.

slave the drive to another pc and do what i said and you will be ok.
0
 
crp0499CEOAuthor Commented:
Just so you'll know, the reading classes I took were free!

:)

thanks
0
 
venom96737Commented:
you could also boot it from a linux live cd such as ubuntu and do the fix from there as it can read the files for microsoft i dont have the link but its all over google.
0
 
craylordCommented:
This CAN be done with OEM. I have done it dozens of times myself and assisted multiple persons.

First step, skip using the recovery console if you're getting a password prompt, go straight to using BartPE. It ignores permissions because it is akin to booting knoppix. You're booting of the cd.

----
You can find Bart's Windows PE disk here -
www.nu2.nu/pebuilder/ 
A full set off instructions for Barts PE disk on this site -
http://www.tek-tips.com/faqs.cfm?fid=5362 
http://www.ultimate-computing.com/pebuilder.php This link provide a step by step with pictures. Note* you do not need to use a cd as demonstrated. bartpe can use the c:windows system directory to gather the necessary files.
----
With BartPE. you will want to browse to the c:\system volume information\_restore{somecrazylongnumber}\
You can view them by date and select one from when the pc was last working.  Within these rp folders there is a snapshot folder with multiple files. The following five are what you're looking for. (You will have to rename them when they are copied to the c:\windows\system32\config folder.)
_REGISTRY_MACHINE_SAM   will be renamed as SAM in the config folder
_REGISTRY_MACHINE_SECURITY will be renamed as SECURITY in the config folder
_REGISTRY_MACHINE_SOFTWARE will be renamed as SOFTWARE in the config folder
_REGISTRY_MACHINE_SYSTEM will be renamed as SYSTEM in the config folder
_REGISTRY_USER_.DEFAULT will be renamed as Default in the config folder
Copy them to the c:\windows\system32\config folder.
Reboot.
0
 
venom96737Commented:
lol crp i couldnt even tell good luck getting it back you can just prey she had system restore turned on or its time to reformat or place a parrallel install.
0
 
crp0499CEOAuthor Commented:
Craylord, I need some way to give you points.  Your post worked perfectly.  Within 15 minutes of reading your post, I had downloaded BartPE, booted the notebook, made the changes and rebooted to a perfect desktop three days old.

YOU DA MAN!

How can I get you the 500 points?  I don't want to take them away from Venom, as I've already given them to him, but your answer is the more correct answer.
0
 
craylordCommented:
http://www.experts-exchange.com/Community_Support/
Post a question in the Community Support forum requesting the correction. Include a link to this question. The admins will either re-open the question for grading or just change the points as you stated.

I'm glad it worked.
0
 
crp0499CEOAuthor Commented:
Thank you.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.