?
Solved

NTDetect Failed after I boogered the registry

Posted on 2009-02-23
38
Medium Priority
?
1,900 Views
Last Modified: 2012-05-06
Hello -
I had persistent problems with a BSOD and used WinDbg.  The problems, for the most part, appeared to be related to Symantec's Corporate AntiVirus program.  I deleted the program - that didn't help - so then I deleted a bunch of the entries in my registry that were apparently (I thought) related to the program and I'm guessing I went a little to far and deleted a necessary file.  In trying to boot the computer, I get a "NTDetect Failed" error flashing briefly after the BIOS screen and then it cycles back to the beginning of a reboot - over and over again.  I never get to the Windows screen with the blue progress bar.

Last Known Good doesn't work, Safe Boot doesn't work, ran chkdsk /r from Recovery Console - it found and corrected one error, but didn't fix the problem.  I ran a Repair from the Windows Install disk - that didn't work either.  I used Dell's Diagnostics and everything passed the Express Test.   I'm trying to repair the problem without installing a fresh copy of WinXP, and am running out of ideas.  Is there anything that I can do short of installing a parallel install of WinXP (C:\WINDOWS2)?  If I do that parallel install, will it work and will I be able to run my installed applications on the first WinXP installation?  Will I be able to repair the first installation of WinXP and then delete the parallel installation?  Thank you
0
Comment
Question by:classicmark1
  • 18
  • 17
  • 2
  • +1
38 Comments
 
LVL 32

Expert Comment

by:nappy_d
ID: 23712777
You said you tried a repair install.   Do you select repair at the first menu from the CD or the second Repair of the Install CD?
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23712810
Follow the steps here in the order listed pls. You can skip the chkdsk where you have already performed this step. Insert an XP CD and boot to the Recovery Console again.


Execute the following commands:

chkdsk /r  (will take a while to check the drive)
fixboot  (repairs the boot sector if damaged)
fixmbr ( repairs the master boot record if damaged)

attrib -h c:\ntldr
attrib -s c:\ntldr
attrib -r c:\ntldr

attrib -h c:\ntdetect.com
attrib -s c:\ntdetect.com
attrib -r c:\ntdetect.com

This step assumes that the CD is device "D". If not, use the proper drive letter. You can look at the mapped drives by typing "map" (without quotes) and hitting enter.

copy d:\i386\ntldr c:\ntldr
reply "Y" to overwrite
copy d:\i386\ntdetect.com c:\ntdetect.com
reply "Y" to overwrite

attrib +h c:\ntdetect.com
attrib +s c:\ntdetect.com
attrib +r c:\ntdetect.com

attrib +r c:\ntldr
attrib +h c:\ntldr
attrib +s c:\ntldr

exit recovery console and reboot.

   
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23712834
If the registry is indeed hosed, then do this:

If you have access to a CD burner, do the following:

Download the Microsoft Diagnostics and Recovery Toolset (formerly known as ERD Commander).
http://www.microsoft.com/downloads/details.aspx?familyid=5D600369-0554-4595-8AB4-C34B2860E087&displaylang=en

Download it. Run it. It will create an ISO file. The file is located in the following folder: C:\Program Files\Microsoft Diagnostics and Recovery Toolset. The file is called erd50.iso Burn the iso file to a CD. (Do not just copy it) Boot the CD. You will boot into a windows environment. From there, you have access to a great many tools, such as system restore, checking the drive, and much more. I would try doing a restore first.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:classicmark1
ID: 23713121
Hello, flubbster -
I followed your first post and I got a little further.  But now, the first screen that pops up is the WindowsXP new installation screen.  The first 3 items are already checked - Collecting Information, Dynamic Update, and Preparing Installation.  It appears to be "Installing Windows", but goes to a Fatal Error - "Data error (cyclic redundancy check).  Then a msg. about cleaning the CD.

When viewing the setup log, I get:
Error:  Setup encountered an error while trying to set system security.
An extended error has occurred.
xxx
Error:  Setup could not register the OLE Control C:\WINDOWS\system32\macromed\flash\flash.ocx because of the following error:  DllRegisterServer returned error 2147647516 (8002801c).
xxx
Error:  SYS.DLL:  Syntax error in manifest or policy file "J:\I386\asms\6000\MSFT\VCTRL\VCTRL.MAN" on line 11.   ("J" is my CD-ROM drive)
xxx
Error:  Installation Failed:  J:\I386\asms.  Error Message: Data error (cyclic redundancy check).
xxx
Fatal Error:  One of the components that Windows needs to continue setup could not be installed.
Data error (cyclic redundancy check).

If you are installing from a CD, ther emight be a problem with the disc  try cleaning the disc or using another disc.
xxx
Error:  SXS.DLL:  Syntax error in manifest or policy file "J:\I386\asms\6000\MSFT\VCTRL\VCTRL.MAN" on line 11.
xxx
Above error messages repeat at this point.
Thanks for your quick reply - any ideas?
0
 

Author Comment

by:classicmark1
ID: 23713127
Hello, nappy d -
I tried both repair methods.  - Recovery console AND repair installation.
Mark
0
 
LVL 32

Expert Comment

by:nappy_d
ID: 23713284
CRC errors (Cyclic Redundancy Check) is your HDD.  Get an external drive and backup as much of your data as possible.
0
 

Author Comment

by:classicmark1
ID: 23713316
flubbster -
I have burned the ISO file onto a CD.  It shows as the only file on the CD.  I've tried to boot the computer using the disk, but it doesn't recognize this disk as bootable.  Am I missing something?  I'm not well versed in burning disks and/or ISO files.

When I try to boot using the CD with the ISO file, it goes straight to the WinXP install screen and asks me to insert the WinXP disk, as it did before.

Thank you, again.
0
 

Author Comment

by:classicmark1
ID: 23713358
flubbster
I've now extracted the files and and burning them to a fresh disk.  Files include two directories:  Documents & Settings and I386 plus 6 files.  Does this sound right to you?

Sorry to be such a nudge!
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713384
Not right. There should be a full directory structure on the CD, not just the iso file. As a matter of fact, the iso fuile should not be there at all. Not sure what you are using to do the image burn, but I like imgburn... it is free, very fast, and does a great job.

http://www.imgburn.com/index.php?act=download

At the first screen, select to burn an image to disk. Then just browse to the file and burn away...
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713392
oh yeah... sounds good now  lol

we were typing at the same time...
0
 

Author Comment

by:classicmark1
ID: 23713481
Still won't boot from the disk - keeps going back to Setup.
Should I copy all of the files in I386 and Documents and Settings to the root on the cd?
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713525
Pls make sure that in BIOS, boot order is set to CD first. Then, make sure you press a key when it asks you to so that it boots from the CD and not the hard drive. If the CD has been burned correctly, you should see it trying to boot from there. It may take a few minutes, as it is much slower. If it appears to hang a bit during the Network portion, you can select to not install that part.
0
 

Author Comment

by:classicmark1
ID: 23713616
Just to be clear - I'm given several options with ImgBurn:
 Write Image to Disk
Create Image File from Disk
Write Files/Folders to Disk
Create Image File from files/folders
Discovery

My first try failed -  Create file -  Did I pick the wrong one?
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713666
Write image file to disk

At the top you will see "Please select a file"

click on the folder (not the one with the + on it), to browse to the location of the file.

select the file "erd50.iso"

After the file is selected, clcik on the icons at the bottom (the disk and CD), to start the image burn to CD

0
 

Author Comment

by:classicmark1
ID: 23713705
2nd Attempt w/ImgBurn -
OK - now in "ERD Commander" -

0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713721
k... the easiest thing would be to try doing a system restore at this point. You have access to it under one of the menu's in ERD.
0
 

Author Comment

by:classicmark1
ID: 23713740
OH, NO -
Now "The usage period for this boot image has expired"
Jeez!
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713814
gawd... I would assume you are doing this on a second pc/laptop... it appears that the system you are creating the ERD image on has been used to create one before. To get around it, go to add/remove programs and uninstall the program. Browse to the install folder and make sure the iso file is gone, if not, delete it manually, then make sure the entire folder is gone. Run the downloaded file again to create a new iso file. Unless you are using a re-writable CD, use a NEW CD to burn the image again.

I have done this many times, you just need to remove all the software from the install. It placaes a date within the image. I am willing to be that the system you are using has used this program before.
0
 

Author Comment

by:classicmark1
ID: 23713973
I'll give it a shot.  The system I'm using to make the CD is new, so today is the first I've tried accessing the ISO file.  Maybe it's thinking that the one I burned with Roxio is the "first one".  In any case, there's no way that I've used it for more than 30 days - I haven't had this (used) computer for 30 days and I did a clean install of Windows XP on Saturday!

I'm going to delete everything I've done so far, go back to the link you provided, download the ISO to a new directory (on a different logical drive), burn it to a new CD, and try again.

I went to Add/Remove programs, and the only new program from today is the ImgBurn program.  The ERD program doesn't show up anywhere.  Again - I did a clean install, including format, on Saturday.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23713992
It will show up as Microsoft Diagnostic and Recovery Toolset, not ERD. Remember, you download an executable, which when run, creates the iso file, which is then burned to CD.
0
 

Author Comment

by:classicmark1
ID: 23714164
I didn't see "ERD" until I tried to boot using the newly created ImgBurn disk.  But when ImgBurn created the new disk, it automatically labeled it "ERD".  

When I booted the failed computer, as the progress bar loaded at the bottom of the screen - after the Windows screen (which had a gray progress bar instead of the usual blue one) - it said "Starting ERD Commander".  

I've now downloaded a new copy of the toolset from the link you provided (MSDaRT50Eval.msi), burned it onto a new disk using ImgBurn (it still labeled it "ERD"), put in in the CD drive of the failed computer, booted, got a gray progress bar at the bottom of the screen reading "Starting ERD Commander", then a windows screen with a gray (instead of blue) progress bar, then went to a solid gray screen, then a solid blue screen, and then (again) got the msg: "The usage period for this boot image has expired."

There's definitely something amiss, as there's no way I've used this before on the computer that is creating the disk.  Could it be that the MS Diagnostics was already on the FAILED computer (even though I don't recall ever using it)?  If so, is there a way to delete it without being able to start Windows?  If not, how do I get a "non-eval" copy of the program?

I appreciate your persistence!
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23714378
The problem is that MS bought the program and made it almost impossible to get. Try looking for an older version (2005), before MS bought them. I am looking myself.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23714386
0
 

Author Comment

by:classicmark1
ID: 23714682
Thank you, flubbster -
It is going to take over 30 minutes to download from the link you provided.  I'll let you know how it works out.  Again, thanks for taking the time to help me out.  Keep your fingers crossed!
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23714698
no problem... good luck!!

btw... not sure what you will end up with after you unrar the file. By that, I mean I am not sure if you will have an executable to run that will create the iso, or if it will already be an iso. It really doesn't matter, just be aware  :)
0
 

Author Comment

by:classicmark1
ID: 23715114
Hi, flubbster-
Success with the download - ERD Commander is up and running.  The Windows installation that needs repair indicates
"C:\WINDOWS Unsupported OS version (Microsoft Windows NT Workstation)"
The "OK" option is not highlighted - just the "Restart" button.  That takes me back to the Setup screen that will not complete.  I'm not given any option to Restore - I'm guessing because it says the OS is unsupported.  As this was a licensed version of Windows XP (passed Genuine Advantage and all that), I'm kind of at a loss.

I guess I could try a fresh install of Windows, but I'll lose everything on my "C" drive, correct (including e-mails, my C:\Temp directory, and any data files that might be on that drive)?
0
 

Author Comment

by:classicmark1
ID: 23715127
What about if I do a 2nd install of Windows (I think it's called a parallel installation)?  Would that give me access to my data, even if I have to reinstall all of my applications?
0
 
LVL 30

Accepted Solution

by:
flubbster earned 2000 total points
ID: 23715235
damn... that's a bummer.

Yes, you can do a parallel install to retrieve your files. You will have to re-install all the apps when you are done. Once you have the second install running, backup the data to another drive. Get everything you possibly can, cause you might want it later. Once you are satisfied, I would do a totally fresh install, complete with a format. Be prepared to contact microsoft by phone if needed (the number is provided on screen) for activation. It will not be an issue. Just tell the person you are repairing a system and you will get the activation number.

Keep the CD handy. It really is a great tool.

Here is a great step-by-step for the install you want to do:
http://www.windowsxpprofessional.windowsreinstall.com/installxpcdparallell/indexfullpage.htm
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23715323
hold on....
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23715353
If you have reached the point of a new install, you may want to try this first, as you have nothing to lose...

This is done using the Recovery Console, and is, essentially, a manual restore. Bunch of typing, print it out and keep it next to you, take it slow, step by step....

Let's rock....

1. Boot the Recovery Console from the Windows XP installation CD.

2. When you're at the Recovery Console command prompt, change into the root directory of the system drive with the cd command (i.e., cd \).


3. Change into the System Volume Information directory by typing cd system~1 on most machines, or cd "System Volume Information."


(The filenames with ~1 are generated by default to provide backwards compatibility with programs that only recognize 8.3-format filenames. It's possible to disable 8.3 filename generation on NTFS volumes to gain some speed, but the speed gained by doing this is generally pretty small and it can have the unintended consequence of making it impossible to use 8.3 filenames in contexts like this. If you can't use 8.3 filenames to navigate, 8.3 name generation might be disabled. See Microsoft's support document called How to Disable the 8.3 Name Creation on NTFS Partitions.

4. The System Volume Information directory contains a folder name _restore followed by a GUID in curly braces. Change into it by typing cd _resto~1; if that doesn't work you'll have to type cd "_restore{GUID_STRING}", with the full GUID string in place of GUID_STRING.


5. In the _restore directory are a group of subdirectories starting with the letters RP and followed by a number. These are the different restore points available for that volume.

6. Check the date on each directory and look for one that corresponds to a date before you began experiencing problems.

7. Change into the appropriate directory. If the directory is named RP74, for instance, change into it by typing RP74.

8. Inside that directory will be a subdirectory named snapshot; change into that directory as well (cd snapshot)

9. The snapshot directory holds backup copies of the SOFTWARE and SYSTEM Registry hives, named _REGISTRY_MACHINE_SOFTWARE and _REGISTRY_MACHINE_SYSTEM, respectively.

10. The target directory for these files is \Windows\System32\Config, and the hives there are named SOFTWARE and SYSTEM. Rather than overwrite those files entirely, you can rename them to something else. Typing ren \windows\system32\config\software \windows\system32\config\software.bak and ren \windows\system32\config\system \windows\system32\config\system.bak will rename them to software.bak and system.bak, respectively.

11. Copy in the backup hives: copy _REGISTRY_MACHINE_SOFTWARE \windows\system32\config\software and copy _REGISTRY_MACHINE_SYSTEM \windows\system32\config\system.

12. Type exit to leave the Recovery Console and restart the computer.


   
0
 

Author Comment

by:classicmark1
ID: 23715499
You stopped me just in time.  I'm trying it now, I'll let you know soon!
0
 

Author Comment

by:classicmark1
ID: 23715589
Hello -
Only got to #3.  At cd system~1, I got "Access is denied".
And I thought this was going to be a 15 minute fix when I started this morning!
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23715780
Type: cd \  

Then click enter

Type: cd windows\system32\config  

Then click enter

Type: ren system system.bak  

Then click enter

(note the spaces between ren and system, and then between system and system.bak)

Type: exit

Then click enter

 now the computer should restart

continue with the procedure. you should have access now.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23715783
gonna be heading out now... time to go home. will check in when I get home. good luck!
0
 

Author Comment

by:classicmark1
ID: 23715822
Thanks for everything.  I've already started a parallel install.  I will try to repair the old one using the above method when the new one is finished.  I'll keep you apprised.  Thank you, again.
Mark
0
 
LVL 12

Expert Comment

by:rionroc
ID: 23722074
Darm! I like this post.  The author seems so active, this a kind of post I like.

To Sage flubbster, I agree to all your comments, specially the ID: 23715780, its so technical.

Some additionals:
When you can boot on windows, try to empty you pagefile, set it to 0, enable for cached applications to refresh in ram, After many applications opened, turn it back on.


Great is our GOD.
:)
rionroc:
0
 

Author Closing Comment

by:classicmark1
ID: 31550144
Although the final result was a clean (parallel) re-install, flubbster's help was great and helped me learn a bundle about rescuing a BSOD situation.  It was my fault by boogering the registry in the first place, and has taught me that turning off the System Restore option is NOT a good thing.  The parallel installation of WinXP (instead of a new install) enabled me to save virtually all of my data, including e-mails, address book, and a complete list of Program Files that I would need to reinstall.  Thank you for your patience, persistence, and understanding.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 23723325
Sorry it did not work out for you, but I am glad you were able to get all the files off the system. Hang on to the CD you made... you never know when it will come in handy..

It was a pleasure working with you on this.

Take care  :)
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
This article is about my experience upgrading my consulting machine to Windows 10 Version 1709 (The Fall 2017 Creator Update)
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question