Lost Regedit

[Guest]

I am trying to add keys for saved file lists to a registry cleanning utility.

When I start Regedit, through the program or Satrt/Run, I get the message'
"The application failed to initialize properly (0x0000005). Click on OK to
terminate the application."

This also occurs in SAFE MODE.

It worked about 6 months ago.

TIA
MNM

 

[Wesley Vogel]

Have you tried these?

Start | Run | Type or paste: regedit.exe | Click OK

Start | Run | Type or paste: %systemroot%\regedit.exe | Click OK

Start | Run | Type or paste: %systemroot% | Click OK |
Then scroll down to and double click on regedit.exe

See if there is a regedit.exe in
%windir%\system32\dllcache
or
C:\WINDOWS\system32\dllcache

If there is what happens if you double click on it?

Do a Search to see if there are any other copies of regedit.exe on your
machine.

Do a Search to see if there are any copies of regedit.com on your
machine.

regedit.com is probably created by malware.

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/forums/index.php?showtutorial=61#winxo

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Have you tried these?

Start | Run | Type or paste: regedit.exe | Click OK

Start | Run | Type or paste: %systemroot%\regedit.exe | Click OK

Start | Run | Type or paste: %systemroot% | Click OK |
Then scroll down to and double click on regedit.exe

Only the first one.

See if there is a regedit.exe in
%windir%\system32\dllcache
or
C:\WINDOWS\system32\dllcache

Here's the weird part, I don't seem to have a \dllcache folder on my
machine!!!

If there is what happens if you double click on it?

Do a Search to see if there are any other copies of regedit.exe on your
machine.

In %systemroot%\WINDOWS\
In %systemroot%\WINDOWS\ServicePackFiles\
In my BartPE I386 folder and the slipstreamed directory to build BartPE

Do a Search to see if there are any copies of regedit.com on your
machine.
No.



regedit.com is probably created by malware.

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/forums/index.php?showtutorial=61#winxo

""> > This also occurs in SAFE MODE.""


I was thinking of rebuilding the system soon. The missing \dllcache folder
is an indication this may be a good time.
What do you think? Or, is it possible to restore this directory via a
repair operation?

 

[Blades]

Here's the weird part, I don't seem to have a \dllcache folder on my
machine!!!

Wait, at all? As in the Command Prompt line:
dir %systemdrive%\dllcache /a /b /s
returns nothing?

What's the value of HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\SFCDllCacheDir (and while we're at it,
SFCDisable)? What happens if you run the command: sfc /purgecache?

In %systemroot%\WINDOWS\
In %systemroot%\WINDOWS\ServicePackFiles\
In my BartPE I386 folder and the slipstreamed directory to build BartPE

What happens if you try to run those copies? The same thing? If you boot
off of your BPE build?

""> > This also occurs in SAFE MODE.""

Yeah, it's not hard to add something to Safe Mode's boot. Specifically,
it's as hard as adding a key to
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal.

I was thinking of rebuilding the system soon. The missing \dllcache folder
is an indication this may be a good time.
What do you think? Or, is it possible to restore this directory via a
repair operation?

Dllcache is maintained by SFC. If SFC went south for the winter, a clean
install might not be such a bad idea.

 

[Wesley Vogel]

I was thinking of rebuilding the system soon.

Not yet.

Not everyone has a dllcache folder. See below.

In %systemroot%\WINDOWS\

One or the other. %systemroot% = %systemdrive%\WINDOWS

In %systemroot%\WINDOWS\ServicePackFiles\

See below.

By default the cache folder is %systemroot%\system32\dllcache for System
File Checker (sfc.exe) and Windows File Protection.

However, with SP2...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
ServicePackSourcePath can point to %windir%\ServicePackFiles.

The ServicePackFiles folder only exists if you have upgraded to XP SP1 or XP
SP2 and they were not included in the original install and the SP1 or SP2
upgrade was done by downloading it from Microsoft. If the Service Pack is
installed by means of a CD-ROM or a distribution share, the ServicePackFiles
folder is not created. Same for slipstreaming a Service Pack.

So you either have a dllcache folder or a ServicePackFiles folder.


Does this work?
Start | Run | Type or paste: %windir%\regedit.exe | Click OK

Or this?
Start | Run | Type or paste: C:\WINDOWS\regedit.exe | Click OK


%systemroot% is an environment variable that is the location of the Windows
root folder.

Typing or pasting %systemroot% into the Start | Run box opens to the Windows
folder on whatever drive it is located. I.e. C:\WINDOWS or C:\WINNT.

systemroot definition from C:\WINDOWS\Help\glossary.chm
[[The path and folder name where the Windows system files are located.
Typically, this is C:\Windows, although you can designate a different drive
or folder when you install Windows. You can use the value %SYSTEMDRIVE% to
replace the actual location of the folder that contains the Window system
files. To identify your systemroot folder, click Start, click Run, type
%systemroot% and then click OK.]]

%windir% is an environment variable that is the location of the system
folder.

Typing or pasting %windir% into the Start | Run box opens to the Windows
folder on whatever drive it is located. I.e. C:\WINDOWS or C:\WINNT.

Windows XP can be installed in either WINDOWS or WINNT.

If %systemroot% and %windir% are the same, then obviously %windir% is easier
to type.
--------------------

The environmental variable Pathext shows a list of file extensions that are
considered to be executable and regulates which extensions do not need to be
typed in a Command Prompt or the Run command.

The Path environmental variable and a registry entry, App Paths,
control what paths do not have to be typed.

Since typing regedit without the extension in the Run command does not work
for you something is messed up with your PATHEXT.

Open a command prompt...
Start | All Programs\Accessories\Command Prompt
or
Start | Run | Type: cmd.exe | Click OK |

I wonder if this...
Start | Run | Type: cmd | Click OK |
will work for you?

Anyway, when the command prompt is open, type: path and hit Enter.

You should see something similar to this...
PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem

Then type: set and hit Enter. Look for PATHEXT.

You should see something similar to this...
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

At a minimum you should have...
PATHEXT=.COM;.EXE;.BAT;.CMD

Post back with what you find.

Or you could have typed: echo %PATHEXT% and hit Enter.

Or you could have typed: echo %PATH% %PATHEXT% and hit Enter.

XP doesn't care if it's UPPERCASE, lowercase or MiXeDcASe.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Wesley Vogel]

Paste the following line into Start | Run and click OK...

%windir%\system32\dllcache\regedit.exe

regedit.exe normally exists in
\WINDOWS
and
\WINDOWS\system32\dllcache
or
\WINDOWS\ServicePackFiles

The regedit.exe in \WINDOWS is the one that gets used. The other
one is for backup. If Windows File Protection is working correctly, the
following should help.

WFP uses the files in dllcache or ServicePackFiles to replace messed up
system files.

Try this.

Open %windir%
Size the window so you can also see your Desktop.
Scroll down to regedit.exe.
Left click and drag regedit.exe to your Desktop.
Wait just a minute.
Now scroll down clear to the bottom of the WINDOWS folder.
Is there a new regedit.exe there?

If there is a new regedit.exe delete the one on your Desktop.
Close the WINDOWS folder.

If there is NOT a new regedit.exe drag the one on your Desktop back into
the WINDOWS folder.
Close the WINDOWS folder.

If there is a new regedit.exe in the WINDOWS folder, you'll see something
similar to this in the Event Viewer under System, listed as Information;
Windows File Protection:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 08-Dec-06
Time: 2:25:52 PM
User: N/A
Computer: MYPENTIUM450
Description:
File replacement was attempted on the protected system file
c:\windows\regedit.exe. This file was restored to the original version to
maintain system stability. The file version of the system file is
5.1.2600.1106

Start | Run | Type: eventvwr | Click OK | Click on System in the left
hand pane and look for Windows File Protection

If the above does not work, run sfc.exe.

System File Checker (sfc.exe) replaces screwed up system files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

sfc /scannow scans all protected system files immediately and replaces
incorrect versions with correct Microsoft versions.

System File Checker takes a while to run.

If you have XP Home and it asks for your XP Pro CD, see this KB article...

You may be prompted to insert a Windows XP Professional CD when you run the
System File Checker tool in Windows XP Home Edition
http://support.microsoft.com/kb/897128

If SFC.EXE did anything it will be listed in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK | Click System |

Windows File Protection will be listed under the Source column. Look at any
Windows File Protection entries.

Explains a whole bunch about sfc.exe.
scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html
----------

dllcache is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files labeled
System and Hidden) in Windows Explorer.These files are required to start and
run Windows. Deleting or editing them can make your computer inoperable.Are
you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Sorry for the delay. I was building a retro system for the kids.

Paste the following line into Start | Run and click OK...

%windir%\system32\dllcache\regedit.exe

This works. Regedit starts.

Open %windir%
Size the window so you can also see your Desktop.
Scroll down to regedit.exe.
Left click and drag regedit.exe to your Desktop.
Wait just a minute.
Now scroll down clear to the bottom of the WINDOWS folder.
Is there a new regedit.exe there?

Yes there is a new regedit!!! But, it doesn't work either.

MNM