We are getting blue screens on multiple computers with the following message:
STOP: c0000218 (Registry File Failure)
the registry cannot load the hive (file):
\systemroot\system32\config\software or its log or alternate.
It is corrupt, absent or not writable.

This has happened on 2 separate work computers as well as one Admin's home
PC that has never touched our work environment. It has been seen on 2
Windows 2000 Pro and 1 Windows XP Pro. The two work PC's were fully patched
(using MS SUS).

Have others seen this? Is this the result of a virus? Or maybe a bad patch
released by MS? Please advise if you have any relevant information!!

THANKS IN ADVANCED!!!

NicholasZ wrote:
> We are getting blue screens on multiple computers with the following
> message: STOP: c0000218 (Registry File Failure)
> the registry cannot load the hive (file):
> \systemroot\system32\config\software or its log or alternate.
> It is corrupt, absent or not writable.
>
> This has happened on 2 separate work computers as well as one Admin's home
> PC that has never touched our work environment. It has been seen on 2
> Windows 2000 Pro and 1 Windows XP Pro. The two work PC's were fully
> patched (using MS SUS).
>
> Have others seen this? Is this the result of a virus? Or maybe a bad
> patch released by MS? Please advise if you have any relevant
> information!!
>
> THANKS IN ADVANCED!!!

Take a look at this, it relates to XP but the advise is mostly the same for
W2K

http://xphelpandsupport.mvps.org/how...air_a_stop.htm



--
Steve Parry BA(Hons) MCP

http://www.gwynfryn.co.uk

I would like to clarify that I am not looking for the solution to repair the
blue screen. I am more interested in finding out what is the root cause and
if this is being caused by a malicious act like virus, worm or some other
malware as well as how many other people are experiencing this. I have had a
total of 4 blue screens in one week, three of which were identical. We
normally get one blue screen every 3 months (based on 300 PC's). Your input
is appreciated.


"NicholasZ" wrote:

> We are getting blue screens on multiple computers with the following message:
> STOP: c0000218 (Registry File Failure)
> the registry cannot load the hive (file):
> \systemroot\system32\config\software or its log or alternate.
> It is corrupt, absent or not writable.
>
> This has happened on 2 separate work computers as well as one Admin's home
> PC that has never touched our work environment. It has been seen on 2
> Windows 2000 Pro and 1 Windows XP Pro. The two work PC's were fully patched
> (using MS SUS).
>
> Have others seen this? Is this the result of a virus? Or maybe a bad patch
> released by MS? Please advise if you have any relevant information!!
>
> THANKS IN ADVANCED!!!
>

This may be of interest.

Possible Data Loss After You Enable the "Write Cache Enabled" Feature
http://support.microsoft.com/?id=281672

If the software hive is corrupt, it may be possible to rename the software
hive found in;
%windir%\system32\config\software
to software.old
then copy the most recent backup found in
%windir%\repair\regback
as
%windir%\system32\config\software

If that fails you can copy/ use the file
%windir%\repair\software
This file is an image of the hive at the time the OS was installed, so you'd
have to reinstall all software. This being the case you might just as well
blow it away and start a new install. (note: this would at least allow you
to start the OS to make any necessary backups prior to wiping the drive.)

To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks. At
the "Welcome to Setup" screen. Press F10 or R to repair a Windows 2000
installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %systemroot% or %windir%

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"NicholasZ" wrote:
| We are getting blue screens on multiple computers with the following
message:
| STOP: c0000218 (Registry File Failure)
| the registry cannot load the hive (file):
| \systemroot\system32\config\software or its log or alternate.
| It is corrupt, absent or not writable.
|
| This has happened on 2 separate work computers as well as one Admin's home
| PC that has never touched our work environment. It has been seen on 2
| Windows 2000 Pro and 1 Windows XP Pro. The two work PC's were fully
patched
| (using MS SUS).
|
| Have others seen this? Is this the result of a virus? Or maybe a bad
patch
| released by MS? Please advise if you have any relevant information!!
|
| THANKS IN ADVANCED!!!
|

We've had quite a few of these and found the following handy to get
out of trouble:

http://support.microsoft.com/kb/830570/en-us

HTH



NicholasZ <(E-Mail Removed)> wrote:

>We are getting blue screens on multiple computers with the following message:
>STOP: c0000218 (Registry File Failure)
>the registry cannot load the hive (file):
>\systemroot\system32\config\software or its log or alternate.
>It is corrupt, absent or not writable.
>
>This has happened on 2 separate work computers as well as one Admin's home
>PC that has never touched our work environment. It has been seen on 2
>Windows 2000 Pro and 1 Windows XP Pro. The two work PC's were fully patched
>(using MS SUS).
>
>Have others seen this? Is this the result of a virus? Or maybe a bad patch
>released by MS? Please advise if you have any relevant information!!
>
>THANKS IN ADVANCED!!!


Ha®®y

(E-Mail Removed)

That should always be the very last resort. Use your recent backup first.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

<(E-Mail Removed)> wrote:
| We've had quite a few of these and found the following handy to get
| out of trouble:
|
| http://support.microsoft.com/kb/830570/en-us
|
| HTH
|
|
|
| NicholasZ <(E-Mail Removed)> wrote: