Solved

Notebook having serious issues...

Posted on 2006-06-14
15
250 Views
Last Modified: 2012-05-05
A customer called me and said her notebook worked last night, but that this AM, she has an error when she tries to log in.  The error was that the c:\windows\system32\config\system was corrupt.  I did some googling and worked out that problem.  Now, when the notebook boots, I get this:

When trying to update a password the return status indicates that the value provided as the current password is not correct (generated by lass.exe)

After tons of googling and KB articles, I've gotten no where.  I could install XP over itself, but she would have to reinstall all apps and reconfigure the notebook.  A GREAT deal of work has gone into configuring the notebook and she really doesn't want to do that.

I've checked it for sasser, used the Offline Crack to turn off the repair tool password (which did not work by the way) and I'm at a loss.  When I try to run the Repair tool after booting off the CD, no password works.  This is after I used the Offline Crack to reset the Restore Mode password to a known password.

Any thoughts?

Thanks

Cliff
0
Comment
Question by:crp0499
  • 5
  • 4
  • 4
  • +1
15 Comments
 
LVL 16

Expert Comment

by:craylord
ID: 16906908
0
 

Author Comment

by:crp0499
ID: 16906954
I can't get to the recovery console.  It's asking for a password, even though there isn't one, not even for the admin account, and I have used the Offline Password Crack Utility to set the recovery console password to skipped and I am still prompted for a password before I can access the recovery console.
0
 
LVL 12

Expert Comment

by:fruhj
ID: 16907040
You might need to pull the notebook drive and attach it to a working PC to have a look at the drive.
You can use the drive with a notebookdrive-to-40pin ide adapter or with a notebookdrive-to-USB adapter.

I can't help you on cracking the password as I've never had to do that, but once you have the drive loaded, you can use your own copy of regedit to "load hive" - and find the registry hive file in the windows directorty of the bad laptops drive.

With that you can do a lot of investigation / change registry settings etc..
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16907069
Did you use the microsoft fix for this corrupt registry by any chance and move the files located in c:\windows\system32\repair into the registry hives?  If you did this on and OEM copy you will get this password crap as OEM makes their own passwords on install that will not be in the c:\windows\system32\repair versions.  What you can do is goto c:\system volume information\restore and pick registry hives that date back to before the corrupt registry and move them to the same places as you did before this should solve your issues.
0
 

Author Comment

by:crp0499
ID: 16907141
I originally booted with an OEM copy, yes.  We ran the steps in KB 307545.  At that point, we were able to get to the Repair Console.  After that KB article, we were then prompted for a password to access the Repair Console.  I can't get past that really.
0
 
LVL 15

Assisted Solution

by:venom96737
venom96737 earned 250 total points
ID: 16907199
That is the answer to your problem what i just stated if you look back at KB307545 you will see a big warning at the start that says users of OEM versions should not use this here is what its says.
Warning Do not use the procedure that is described in this article if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives.

You can repair a corrupted registry in Windows XP. Corrupted registry files can cause a variety of different error messages. See the Microsoft Knowledge Base for articles about error messages that are related to registry issues.

This article assumes that typical recovery methods have failed and access to the system is not available except by using Recovery Console. If an Automatic System Recovery (ASR) backup exists, it is the preferred method for recovery. Microsoft recommends that you use the ASR backup before you try the procedure described in this article.

slave the drive to another pc and do what i said and you will be ok.
0
 

Author Comment

by:crp0499
ID: 16907232
Just so you'll know, the reading classes I took were free!

:)

thanks
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 15

Expert Comment

by:venom96737
ID: 16907251
you could also boot it from a linux live cd such as ubuntu and do the fix from there as it can read the files for microsoft i dont have the link but its all over google.
0
 
LVL 16

Expert Comment

by:craylord
ID: 16907266
This CAN be done with OEM. I have done it dozens of times myself and assisted multiple persons.

First step, skip using the recovery console if you're getting a password prompt, go straight to using BartPE. It ignores permissions because it is akin to booting knoppix. You're booting of the cd.

----
You can find Bart's Windows PE disk here -
www.nu2.nu/pebuilder/  
A full set off instructions for Barts PE disk on this site -
http://www.tek-tips.com/faqs.cfm?fid=5362
http://www.ultimate-computing.com/pebuilder.php This link provide a step by step with pictures. Note* you do not need to use a cd as demonstrated. bartpe can use the c:windows system directory to gather the necessary files.
----
With BartPE. you will want to browse to the c:\system volume information\_restore{somecrazylongnumber}\
You can view them by date and select one from when the pc was last working.  Within these rp folders there is a snapshot folder with multiple files. The following five are what you're looking for. (You will have to rename them when they are copied to the c:\windows\system32\config folder.)
_REGISTRY_MACHINE_SAM   will be renamed as SAM in the config folder
_REGISTRY_MACHINE_SECURITY will be renamed as SECURITY in the config folder
_REGISTRY_MACHINE_SOFTWARE will be renamed as SOFTWARE in the config folder
_REGISTRY_MACHINE_SYSTEM will be renamed as SYSTEM in the config folder
_REGISTRY_USER_.DEFAULT will be renamed as Default in the config folder
Copy them to the c:\windows\system32\config folder.
Reboot.
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16907269
lol crp i couldnt even tell good luck getting it back you can just prey she had system restore turned on or its time to reformat or place a parrallel install.
0
 
LVL 16

Accepted Solution

by:
craylord earned 250 total points
ID: 16907292
http://www.nu2.nu/pebuilder/start/
Instructions, no pictures. Ultimate-computing seems to be down.
0
 

Author Comment

by:crp0499
ID: 16907663
Craylord, I need some way to give you points.  Your post worked perfectly.  Within 15 minutes of reading your post, I had downloaded BartPE, booted the notebook, made the changes and rebooted to a perfect desktop three days old.

YOU DA MAN!

How can I get you the 500 points?  I don't want to take them away from Venom, as I've already given them to him, but your answer is the more correct answer.
0
 
LVL 16

Expert Comment

by:craylord
ID: 16907699
http://www.experts-exchange.com/Community_Support/
Post a question in the Community Support forum requesting the correction. Include a link to this question. The admins will either re-open the question for grading or just change the points as you stated.

I'm glad it worked.
0
 

Author Comment

by:crp0499
ID: 16914346
Thank you.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now