New Posts  All Forums:Forum Nav:

Error message

post #1 of 3
Thread Starter 
I'm getting the following error message on boot up of Sager 4760/XP Pro/1 gig RAM:

"STOP: c0000218 {registry file failure} \systemroot\system32\config\software or it's log or alternate. It is corrupt, absent, or not writable."

I am unable to proceed past that point. Any ideas?
post #2 of 3
If neither Safe Mode nor Last known good configuration are accessible
(as seems to be your case) there remains only one eventual possibility
to restore Windows without reinstalling it.

1) Start PC from Windows Setup CD and press R in due moment to
enter Recovery Console (DOS-like environement with command line).
2) Check, whether the corresponding registry file (corrupted or not) is present at all.
For the purpose goto the directory C:\Windows\system32\config
(if Windows on your PC is in C:\Windows), writing
"cd windows\system32\config"+Enter if the command prompt is "C:" or:
"cd system32\config"+Enter if you are in the directory "C:\Windows".
Then write "dir"+Enter, to see files in this directory.
If there are files "software" and "software.log", there is a chance that
those files can be restored (if they are corrupted).

3) Start command "chkdsk ...". Here "..." means option, which I forget how
it looks like exactly (/P or, may be, /R?). To see how this option looks like,
write the command "help chkdsk".
Step 3 in fact is useful even if there are no file "software" discovered on step 2,
because in any case the file system is, evidently, corrupted.
chkdsk will run long enough (1-2 hours if one chooses the option cheking
HDD for all bad sectors) but it deserves to be done. In my case
it was enough to restore Windows completely.

4) Try to start Windows. If it succeeds (even in Safe Mode),
you can start ordinary Windows Restore procedure rolling the system back
to some of its previous states.

5) If 4) fails, then one needs to repeat step 1) entering Recovery Console again.
There are 2 ways to restore registry files:

6a) Easy way: Copy the file "software" (and, may be other registry files, if they
are corrupted/disappeared) from the directory
C:\Windows\repair to the directory C:\Windows\System32\config.
(run command "help copy", to see its command line option, etc.
The bad thing about easy way is that the files in C:\Windows\repair
reflect the "simple" state of OS, where the system knows nothing about
software that was installed on PC after Win installation. But if
you can start Windows restore as in 4) -- you are OK.

6b) Not so easy way. Registry files from all snapshots of Windows recovery
are saved within the directory "C:\System volume information".
But this directory is inaccessible even for "Administrator".
There are, as far as I remember, commands in Recovery Console,
permitting one to change access rights of any directory.
Write "help" to see all command available to find the needed one(s).
If you succed to enter the directory "C:\System volume information",
and write "dir", you will see the directory with very long name
like "restore_{bla-bla-bla-bla}". Enter this directory, writing
"cd restore_{bla-bla-bla-bla}". Writing "dir" you'll see a number of subdirectories:
Rp0,Rp1,...,RpXX, where XX corresponds to the last in time system save.
Inside any of this directories there is the subdirectory "snapshot", containing
some earlier version of all registry files, but with changed names.
Say, the file "software" is renamed as "REGISTRY_MACHINE_SOFTWARE".
Copy all files from this directory prefixed by REGISTRY_MACHINE_
to ...\system32\config as in step 6a),
restoring, of course, their original names without prefix.
Do not copy files with prefix "REGISTRY_USER_", except, may be, the file
"REGISTRY_USER_DEFAULT".

7) If you succed in step 6a) or 6b) then
check your system for viruses and trojans.
Such kind of registry files corruption
is caused often by these creatures.

8) Forbid "File and printer sharing", "Remote desktop assistance" and,
especially, "Remote Registry" service.
And check, whether "Administrator" password is not blank!
This, together with "File and printer sharing" switched on, permits
to ANYBODY do ANYTHING on your PC. In particular, delete all registry files,
install keyloggers and other trojans, etc.
post #3 of 3
Thread Starter 

Thank you. It worked as described.

New Posts  All Forums:Forum Nav:
  Return Home