blue screen c0000218 registry file failure

[stu_summers]

Received blue screen of death and c0000218 registry file
failure warning. Cannot get into safe mode. Start up disc
is not responding... Help... Windows 2000

 

[Dave Patrick]

You didn't mention the hive, if the software hive is corrupt, it may be
possible to rename the software hive found in;
%windir%\system32\config\software
to software.old
then copy the most recent backup found in
%windir%\repair\regback
as
%windir%\system32\config\software

If that fails you can copy/ use the file
%windir%\repair\software
This file is an image of the hive at the time the OS was installed, so you'd
have to reinstall all software. This being the case you might just as well
blow it away and start a new install. (note: this would at least allow you
to start the OS to make any necessary backups prior to wiping the drive.)

Else if the system hive, and assuming you already tried LKG, It may be
possible to rename the system hive found in
%windir%\system32\config\system
to system.old
then rename
%windir%\system32\config\system.alt
to
%windir%\system32\config\system

You can also try using the most recent backup found in
%windir%\repair\regback

If that fails you haven't much choice but to copy/ use the
original-as-installed system hive from
%windir%\repair\system
to
%windir%\system32\config\system
You'll need to reinstall the device drivers for any hardware added since the
original OS install.


To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks.
Press ENTER at the "Setup Notification" screen. Press R to repair a Windows
2000 installation, and then press C to use the Recovery Console. The
Recovery Console then prompts you for the administrator password. If you do
not have the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Once the password has been
validated, you have full access to the Recovery Console, but limited access
to the hard disk. You can only access the following folders on your
computer: %systemroot% and %windir%

 

[John Durham]

Dave I have a similar problem as a result from an
infection. The attacker was (I think) tring to set my
machine up to boot over the LAN. I saw multiple cmd.exe
open in the task manager and rebooted. The machine will
not boot now. I have partioned off another section and
loaded windows 2000 there to get as much of my data as I
can. I get that the winsrv.dll can't be found in the
default path. My question is how can I modify the
registry of the partion that won't boot using the tools
available when the machine is booted under the second
partion? and secondly, how can i determine the default
path so I can change it back to c:\winnt

Thanks,

John

-----Original Message-----
You didn't mention the hive, if the software hive is corrupt, it may be
possible to rename the software hive found in;
%windir%\system32\config\software
to software.old
then copy the most recent backup found in
%windir%\repair\regback
as
%windir%\system32\config\software

If that fails you can copy/ use the file
%windir%\repair\software
This file is an image of the hive at the time the OS was installed, so you'd
have to reinstall all software. This being the case you might just as well
blow it away and start a new install. (note: this would at least allow you
to start the OS to make any necessary backups prior to wiping the drive.)

Else if the system hive, and assuming you already tried LKG, It may be
possible to rename the system hive found in
%windir%\system32\config\system
to system.old
then rename
%windir%\system32\config\system.alt
to
%windir%\system32\config\system

You can also try using the most recent backup found in
%windir%\repair\regback

If that fails you haven't much choice but to copy/ use the
original-as-installed system hive from
%windir%\repair\system
to
%windir%\system32\config\system
You'll need to reinstall the device drivers for any hardware added since the
original OS install.


To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks.
Press ENTER at the "Setup Notification" screen. Press R to repair a Windows
2000 installation, and then press C to use the Recovery Console. The
Recovery Console then prompts you for the administrator password. If you do
not have the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Once the password has been
validated, you have full access to the Recovery Console, but limited access
to the hard disk. You can only access the following folders on your
computer: %systemroot% and %windir%


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft MVP [Windows NT/2000 Operating Systems]

Received blue screen of death and c0000218 registry file
failure warning. Cannot get into safe mode. Start up disc
is not responding... Help... Windows 2000

.

 

[Dave Patrick]

Inline reply:

Dave I have a similar problem as a result from an
infection. The attacker was (I think) tring to set my
machine up to boot over the LAN. I saw multiple cmd.exe
open in the task manager and rebooted. The machine will
not boot now. I have partioned off another section and
loaded windows 2000 there to get as much of my data as I
can. I get that the winsrv.dll can't be found in the
default path. My question is how can I modify the
registry of the partion that won't boot using the tools
available when the machine is booted under the second
partion?

* I'm not sure I understand. Modify it to do what? If repair in mind it
depends on what the damage is. Check the Symantec and or MacAfee web sites
for some info on virus damage and or removal.

and secondly, how can i determine the default

path so I can change it back to c:\winnt

* Afraid I don't know what this means.

 

[Stu_Summers]

Dave,
Thanks for message yesterday... but...

Copied setup disks and ran setup.
Renamed system to .old and system.alt to system
Could then run from CD
However machine keeps restarting after 2000 startup screen.

Could not find \repair\regback so then copied
repair\system to system32\config\software
Still no joy...

Any suggestions,
Stuart.

-----Original Message-----

rename %windir%\system32\config\software
to software.old
copy %windir%\repair\regback
as %windir%\system32\config\software

If that fails copy %windir%\repair\software

Or rename
%windir%\system32\config\system
to system.old
then rename
%windir%\system32\config\system.alt
to %windir%\system32\config\system

Also try using the most recent backup found in
%windir%\repair\regback

If that fails copy
%windir%\repair\system
to %windir%\system32\config\system

Setup CD or the Windows 2000 Setup floppy disks.
Press ENTER. Press R to repair a Windows 2000 installation.
Press C to use the Recovery Console. The
RC then prompts for administrator password
You can only access the following folders on your

computer: %systemroot% and %windir%

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft MVP [Windows NT/2000 Operating Systems]

Received blue screen of death and c0000218 registry file
failure warning. Cannot get into safe mode. Start up disc
is not responding... Help... Windows 2000

.

 

[Dave Patrick]

If you really did
copy repair\system to system32\config\software
this obviously won't work.

So I take it the system hive was corrupt, after copying the \repair\system
the machine now boots to the logon screen?