Restore or turn on a registry key on C drive from a different harddrive

[chevyavalanche]

Here's the situation:

I turned off a registry key that somehow disables my mouse and I can
no longer use the drive as it boots up ok to the msconfig dialog box
(the one that states you modified something) and then I can go no
further. I can't tab or do anything at this point. The mouse is
there on the screen but it doesn't move. I know the exact registry
key that I need to turn back on but I just can't get to it. I've
tried booting into safe mode and this doesn't work as my mouse doesn't
work there and I've tried booting into last known good configuration
and that doesn't work either. I've tried usb and ps2 mouses and
neither move but they show up on the screen.

I have another bootable hard drive in my PC so can I boot into it and
then somehow turn on the registry key in my C drive? I do have a
system state backup as well.

This is a strange situation which I've never encountered before but
I've gotten to the point to where I need to be careful as I've turned
off the computer several times from the 'on' button (after tried a few
things) and now my desktop goes into error mode.

 

[John John]

Did you try booting to the Last Known Good Configuration? Could you
confirm your operating system, are you using Windows 2000 or Windows XP.

John

 

[Pegasus \(MVP\)]

Here's the situation:

I turned off a registry key that somehow disables my mouse and I can
no longer use the drive as it boots up ok to the msconfig dialog box
(the one that states you modified something) and then I can go no
further. I can't tab or do anything at this point. The mouse is
there on the screen but it doesn't move. I know the exact registry
key that I need to turn back on but I just can't get to it. I've
tried booting into safe mode and this doesn't work as my mouse doesn't
work there and I've tried booting into last known good configuration
and that doesn't work either. I've tried usb and ps2 mouses and
neither move but they show up on the screen.

I have another bootable hard drive in my PC so can I boot into it and
then somehow turn on the registry key in my C drive? I do have a
system state backup as well.

This is a strange situation which I've never encountered before but
I've gotten to the point to where I need to be careful as I've turned
off the computer several times from the 'on' button (after tried a few
things) and now my desktop goes into error mode.

Boot into Windows with your other bootable disk, then use
regedt32.exe to open the System registry file that has the
problem. You can now reverse the change you made.

 

[John John]

Sorry, I see you already tried that. You can edit the offline registry
with Regedt32 (Winows 2000), see here for easy to follow instructions:

http://www.rwin.ch/xp-live/regedit.htm

John

 

[chevyavalanche]

Sorry, I see you already tried that. You can edit the offline registry
with Regedt32 (Winows 2000), see here for easy to follow instructions:

http://www.rwin.ch/xp-live/regedit.htm

John

Thanks for the quick replies! I've never done this before so here are
a couple of questions:
1) I will boot into my F drive. Then I want to access my C registry
so in looking at the instructions (thank you), how do you know you are
actually in the C registry?
2) Once I'm in the C registry, how do I modify or turn 'on' the
service? In Msconfig you either put an 'x' in the box or not but in
the registry, how do you do this?

 

[John John]

Thanks for the quick replies! I've never done this before so here are
a couple of questions:
1) I will boot into my F drive. Then I want to access my C registry
so in looking at the instructions (thank you), how do you know you are
actually in the C registry?

You should know just by looking at the files on the disk, you know your
user files and so on, you should know by looking for your files which
disk contains the broken installation. You can also run the SET command
at a Command Prompt and the SystemRoot= or the windir= will tell you
which installation is currently booted and running.

2) Once I'm in the C registry, how do I modify or turn 'on' the
service? In Msconfig you either put an 'x' in the box or not but in
the registry, how do you do this?

The backup for the registry entries disabled by msconfig are stored at:

HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg

From the information there you will have to rebuild the deleted entry.

John

 

[chevyavalanche]

You should know just by looking at the files on the disk, you know your
user files and so on, you should know by looking for your files which
disk contains the broken installation. You can also run the SET command
at a Command Prompt and the SystemRoot= or the windir= will tell you
which installation is currently booted and running.


The backup for the registry entries disabled by msconfig are stored at:

HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg

From the information there you will have to rebuild the deleted entry.

John

John,

Thanks so much for the help. Have you ever had to do this? How do I
rebuild or turn on the key? This is the key that needs to be turned
back on:
HKLM\System\CurrentControlSet\Services\WControl\c:\xxxx.exe

Once I get this key back on, when you save and 'Unload Hive', does
this put it back into the C drive registry? Also, when the entry is
created as a folder called "system offline", does this stay in my
other drive or is it removed when I 'Unload Hive'? Again, thanks for
the help!

 

[John John]

Thanks so much for the help. Have you ever had to do this? How do I
rebuild or turn on the key? This is the key that needs to be turned
back on:
HKLM\System\CurrentControlSet\Services\WControl\c:\xxxx.exe

That doesn't sound like a valid registry key, where did you obtain that
information?

You say you disabled the item in msconfig, right? Can you export the
HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg key and post
the contents here?

There is no HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key on a dormant
Windows installation, you won't see a CurrentControlSet key when you
load the hive of the broken machine. The CurrentControlSet is created
from one of the numbered control set when the computer is booted, it is
a copy of the Control Set that was used to boot Windows. The registry
contains numbered Control Sets such as:

HKEY_LOCAL_MACHINE
\SYSTEM
\ControlSet001
\ControlSet002
\ControlSet003

You may not have an 003 key it depends on if you have previously failed
hives. When the Windows is booted Ntldr reads the contents of the
HKEY_LOCAL_MACHINE\SYSTEM\Select key to decide which Control Set will be
loaded depending on which startup option you selected, the startup
options are:

-Current
-Default
-Failed
-LastKnownGood

Default is the Control set that normally boots. By looking at the Data
Value of the option in the Select key you will know which Control Set to
edit, for example if Default has Data value 0x00000001 then
ControlSet001 is the Control set that normally boots Windows, that is
the Control Set that you must edit.

Once I get this key back on, when you save and 'Unload Hive', does
this put it back into the C drive registry?

Yes, you *must* unload the hive, the changes are saved when the hive is
unloaded.

Also, when the entry is
created as a folder called "system offline", does this stay in my
other drive or is it removed when I 'Unload Hive'?

No, when you unload the hive it will delete the temporary hive.

Again, thanks for

the help!

You're welcome. By the way, you are trying to repair a Windows 2000
installation, right?

John

 

[chevyavalanche]

That doesn't sound like a valid registry key, where did you obtain that
information?

You say you disabled the item in msconfig, right? Can you export the
HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg key and post
the contents here?

There is no HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key on a dormant
Windows installation, you won't see a CurrentControlSet key when you
load the hive of the broken machine. The CurrentControlSet is created
from one of the numbered control set when the computer is booted, it is
a copy of the Control Set that was used to boot Windows. The registry
contains numbered Control Sets such as:

HKEY_LOCAL_MACHINE
\SYSTEM
\ControlSet001
\ControlSet002
\ControlSet003

You may not have an 003 key it depends on if you have previously failed
hives. When the Windows is booted Ntldr reads the contents of the
HKEY_LOCAL_MACHINE\SYSTEM\Select key to decide which Control Set will be
loaded depending on which startup option you selected, the startup
options are:

-Current
-Default
-Failed
-LastKnownGood

Default is the Control set that normally boots. By looking at the Data
Value of the option in the Select key you will know which Control Set to
edit, for example if Default has Data value 0x00000001 then
ControlSet001 is the Control set that normally boots Windows, that is
the Control Set that you must edit.


Yes, you *must* unload the hive, the changes are saved when the hive is
unloaded.


No, when you unload the hive it will delete the temporary hive.

Again, thanks for


You're welcome. By the way, you are trying to repair a Windows 2000
installation, right?

John

John,

Yes it is a Windows 2000 installation.

The key appears to be valid as I use a program to view all running
services and it displays the registry key they belong to. If you
thought the xxxx was bogus, it is because I didn't show the real
program name. It really is ccmagent.exe. I believe what this shows
as I have used it a couple of times before and it was correct. I
won't know for sure until we get back into the registry of course. It
will be the Default setting then. I am still baffled as to why the
last known good config does not work.

Can't post anything now as I'm at work. I'm going to a PC repair
place shortly with your directions to see if we can get this
resolved. I will keep you posted.

 

[John John]

John,

Yes it is a Windows 2000 installation.

The key appears to be valid as I use a program to view all running
services and it displays the registry key they belong to. If you
thought the xxxx was bogus, it is because I didn't show the real
program name. It really is ccmagent.exe. I believe what this shows
as I have used it a couple of times before and it was correct. I
won't know for sure until we get back into the registry of course. It
will be the Default setting then. I am still baffled as to why the
last known good config does not work.

Can't post anything now as I'm at work. I'm going to a PC repair
place shortly with your directions to see if we can get this
resolved. I will keep you posted.

Ok, good luck with the repair. Do you have a recent Emergency Repair
Disk (ERD)? If yes, did you backup the registry when you made the ERD?
If yes you may be able to get out of the predicament with the ERD or
by copying the backup hives from the WINNT\repair\RegBack folder to the
WINNT\System32\config folder, this will work if the backup is fairly
recent, if the backups are old it may not work as well.

John

 

[chevyavalanche]

Ok, good luck with the repair. Do you have a recent Emergency Repair
Disk (ERD)? If yes, did you backup the registry when you made the ERD?
If yes you may be able to get out of the predicament with the ERD or
by copying the backup hives from the WINNT\repair\RegBack folder to the
WINNT\System32\config folder, this will work if the backup is fairly
recent, if the backups are old it may not work as well.

John

Don't have an ERD. Backed up System State last Friday. Can I do the
same with this back up as you suggest with ERD?

 

[John John]

Don't have an ERD. Backed up System State last Friday. Can I do the
same with this back up as you suggest with ERD?

It depends on how you made the System State backup, you would have to be
able to extract the files from the backup.

John

 

[chevyavalanche]

It depends on how you made the System State backup, you would have to be
able to extract the files from the backup.

John

I used the W2K Backup wizard and backed up the Sys state.

 

[John John]

I used the W2K Backup wizard and backed up the Sys state.

Along with the .bkf backup file (that you placed in a location of your
choosing) NTBackup should have also created backup copies of the
registry hives and placed them in the WINNT\repair\RegBack folder. Take
a look in there and look at the timestamp on the hives. You can copy
them to the System32\config folder to replace the broken hives.

John

 

[chevyavalanche]

Along with the .bkf backup file (that you placed in a location of your
choosing) NTBackup should have also created backup copies of the
registry hives and placed them in the WINNT\repair\RegBack folder. Take
a look in there and look at the timestamp on the hives. You can copy
them to the System32\config folder to replace the broken hives.

John

Is this an automatic thing that NTbackup does? My PC is at repair
shop now so I can't verify this.

 

[chevyavalanche]

Is this an automatic thing that NTbackup does? My PC is at repair
shop now so I can't verify this.

Update: PC repair shop says that the 'load hive' command stays grayed
out and does not work. Is there a trick to it? He followed the
directions above that you provided the address to and I printed it out
for him.

 

[John John]

Is this an automatic thing that NTbackup does? My PC is at repair
shop now so I can't verify this.

Yes, when using NTBackup to back up the System State data a copy of the
registry files is saved in the \repair\regback folder.

John

 

[John John]

Update: PC repair shop says that the 'load hive' command stays grayed
out and does not work. Is there a trick to it? He followed the
directions above that you provided the address to and I printed it out
for him.

With Windows 2000 it cannot be done with Regedit, he *must* use
Regedt32. He must also bring forth either the HKEY_LOCAL_MACHINE or the
HKEY_USERS pane and he must click on and highlight the root key
HKEY_LOCAL_MACHINE or HKEY_USERS, once the root key is highlighted he
will be able to load the hive of the broken installation. If he is
doing this with XP he can do it with Regedit but he must still highlight
one of the root keys mentioned above, he will only be able to load the
hive when he highlights one of the keys.

Also, see my other post, when you did a backup of the System State data
a copy of your registry hives was placed in the WINNT\repair\RegBack
folder, he can use these copies to try to bring the machine back up.

John

 

[chevyavalanche]

With Windows 2000 it cannot be done with Regedit, he *must* use
Regedt32. He must also bring forth either the HKEY_LOCAL_MACHINE or the
HKEY_USERS pane and he must click on and highlight the root key
HKEY_LOCAL_MACHINE or HKEY_USERS, once the root key is highlighted he
will be able to load the hive of the broken installation. If he is
doing this with XP he can do it with Regedit but he must still highlight
one of the root keys mentioned above, he will only be able to load the
hive when he highlights one of the keys.

Also, see my other post, when you did a backup of the System State data
a copy of your registry hives was placed in the WINNT\repair\RegBack
folder, he can use these copies to try to bring the machine back up.

John

Can he just 'drag and drop' the regback into the C drive location? Is
it that simple or do you have to import or anything like that. Thanks
for being patient with me as I have never dealt with a situation like
this.

 

[John John]

Can he just 'drag and drop' the regback into the C drive location? Is
it that simple or do you have to import or anything like that. Thanks
for being patient with me as I have never dealt with a situation like
this.

He can just rename the files in question with a .old extension, or to
reduce clutter in the config folder he can move them out to a temporary
location for the time being, if the repair is succesful they can then be
discarded.

Move the following hives out of the \WINNT\System32\config folder:

default
SAM
SECURITY
software
system

Then copy the same respective backup hives from the
\WINNT\repair\RegBack to the config folder and see if the machine can be
booted.

John