[Mac_Quazi]

thanx 4 replying so quick gerryf. the micrsosft article I used to fix my windows from logging off immediately was

http://support.micro...kb;en-us;307545

Obviously it didnt work, so now I have to get those files that I deleted back from mdtmp. is that possible? In the article I only got as far as Part One, but it didnt work, so now my xp is worse than it was before.

Im hoping I can fix this and run BartPE regix.cmd again, What do you think? Am I right? What are the chances of it working?

Your help is much appreciated

Edited by Mac_Quazi, 10 May 2005 - 08:14 AM.

[Advertisements]

can you post the contents of your refix.cmd?

[gerryf]

can you post the contents of your refix.cmd?

[Mac_Quazi]

The thing is I cant really post it, cuz I'm not at home now. But heres what's happening in more detail.

The computer that keeps logging off is not mine, Its my friends. I made a copy of the BartPE disk for her and she told me what happens over the phone.

I ran bartPE regfix from my own computer and it all worked fine, its copied all files and it was ok, but for my friend it couldnt find the path for some reason.

Basically what I did was I told her to her most recent _restore folder and and copy and paste the file name into "Run", after locating the regfix.cmd, while she was doing what I told her, i was running it all at the same timeeverything worked fine for me, but with her it didnt work.

The 1st time i ran regfix.cmd on my pc i had a problem. after the _restore{........} i forgot to put a back slash before typing in RP7, i didnt realise this 1st, but when i restarted the pc, it said my sstem file is missing and for me to insert the recovery console disk. I ran BartPE again and this time after _restore{......} i put \RP7 and this time all the files copied and my computer booted as normal. I expected the same to happen for my friends computer but hers didnt and now her xp wont boot at all and says the system folder is missing, so its worse than before.

The instructions i followed were from here

http://www.tek-tips....qs.cfm?fid=5362

sorry i cudnt post my regfix contents but i hope my problem is a bit more clear to you now. if u still need the contents of the regfix, i'll try and post them later from home.

Thanx

[gerryf]

to get those files back, all you would need to do is type the following

copy c:\windows\tmp\system.bak c:\windows\system32\config\system <enter>
copy c:\windows\tmp\software.bak c:\windows\system32\config\software <enter>
copy c:\windows\tmp\sam.bak c:\windows\system32\config\sam <enter>
copy c:\windows\tmp\security.bak c:\windows\system32\config\security <enter>
copy c:\windows\tmp\default.bak c:\windows\system32\config\default <enter>

I don't think that's the problemm though.

[Mac_Quazi]

Ok thanx, Im gonna try that. But its worrying that you think that its not the problem. What do you think the problem could be? Is it a lot worse than i think it is?

I wont be able to follow ur instructions till late this evening or tonight. Is there anything I can try after following your instructions?

thanx

[gerryf]

I was still looking

Here is the content of the CMD file

c:
cd\
md tmp
copy c:\windows\system32\config\system c:\tmp\system.bak
copy c:\windows\system32\config\software c:\tmp\software.bak
copy c:\windows\system32\config\sam c:\tmp\sam.bak
copy c:\windows\system32\config\security c:\tmp\security.bak
copy c:\windows\system32\config\default c:\tmp\default.bak

del c:\windows\system32\config\system
del c:\windows\system32\config\software
del c:\windows\system32\config\sam
del c:\windows\system32\config\security
del c:\windows\system32\config\default

[I]Copy "C:\System Volume Information\%1\snapshot\_REGISTRY_USER_.DEFAULT" c:\tmp\Default
Copy "C:\System Volume Information\%1\snapshot\_Registry_Machine_Security" c:\tmp\Security
Copy "C:\System Volume Information\%1\snapshot\_Registry_Machine_Software" c:\tmp\Software
Copy "C:\System Volume Information\%1\snapshot\_Registry_Machine_System" c:\tmp\System
Copy "C:\System Volume Information\%1\snapshot\_Registry_Machine_Sam" c:\tmp\Sam[/I]
copy c:\tmp\software c:\windows\system32\config\software /y
copy c:\tmp\system c:\windows\system32\config\system /y
copy c:\tmp\sam c:\windows\system32\config\sam /y
copy c:\tmp\security c:\windows\system32\config\security /y
copy c:\tmp\default c:\windows\system32\config\default /y

pause

See the %1?

That is a variable, which is being passed from the command

regfix.cmd _restore{58222D5E-A31B-43A9-9FA2-4CAC8E0D93A7}\RP65

I think your friend just mistyped something is that ugly string, or perhaps omitted the space between cmd AND _

[Mac_Quazi]

Im sorry to be a pain, but I didnt quite understand your last post. You showed me the contents of the cmd file yeah? do I have to make sure my cm dfile is the same as yours?

By the way I asked her a lot of times to make sure theres a space between regfix.cmd and _restore, she said there was.

The thing that makes it even more complicated is that I cant go and see whats happening for myself. my friend lives far, so im only helping her over the phone and she's telling me exactly what she gets on the screen. It makes the whole thing more difficult.

By the way, i dont kno if this makes a difference but in her system volume information folder she only had one _restore folder and in that she had a folder called RP0. Isnt there supposed to be more restore points and more RP folders indside them? Is this a problem or is this normal?

Please explain the cmd file bit again. Im not an expert like yourself lol, i have a fair idea of whats going on, im still a computing student, so this is all a learning process for me

Thanx

[gerryf]

%1 = _restore{58222D5E-A31B-43A9-9FA2-4CAC8E0D93A7}\RP65

If anything is wrong in the above string--even one thing, the CMD file (just a batch file) will fail.

She should have had more restore points, yes, unless she turned of system restore.

There should only be one _restore folder, though unless she had a problem, multi-boot machine.

[Mac_Quazi]

I've just done what you said and still no luck. The first thing I did was sort that microsoft problem out where i copied all the files back the way u told me.

After that the computer booted up again as normal, but it logs me out after i log in again, but at least the computer boots this time lol, so dats a bit of progress.

then i ran the BartPE regfix and this is the contents of the cmd file

(My friend dictated all the contents of the cmd file and i typed it in manually)


F:\I386\PROGRAMS\REGFIX>c:
C:\>cd\
C:\>md tmp
A subdirectory or file tmp already exists.

C:\>copy c:\windows\system32\config\system c:\tmp\system.bak
1 file(s) copied.

C:\>copy c:\windows\system32\config\system c:\tmp\software.bak
1 file(s) copied

C:\>copy c:\windows\system32\config\system c:\tmp\sam.bak
1 file(s) copied.

C:\>copy c:\windows\system32\config\system c:\tmp\default.bak
1 file(s) copied.

del c:\windows\system32\config\system
del c:\windows\system32\config\software
del c:\windows\system32\config\sam
del c:\windows\system32\config\security
del c:\windows\system32\config\default

C:>copy “C:\system volume information\_restore{…………}\RP0\snapshot\_REGISTRY_USER_.DEFAULT” c:\tmp\Default
The system cannot find the path specified


C:>copy “C:\system volume information\_restore{…………}\RP0\snapshot\_REGISTRY_Machine_Security” c:\tmp\Security
The system cannot find the path specified


C:>copy “C:\system volume information\_restore{…………}\RP0\snapshot\_REGISTRY_Machine_Software” c:\tmp\Software
The system cannot find the path specified

C:>copy “C:\system volume information\_restore{…………}\RP0\snapshot\_REGISTRY_Machine_System” c:\tmp\System
The system cannot find the path specified

C:>copy “C:\system volume information\_restore{…………}\RP0\snapshot\_REGISTRY_Machine_Sam” c:\tmp\Sam
The system cannot find the path specified

C:\>copy c:\tmp\software c:\windows\system32\config\software /y
C:\>copy c:\tmp\system c:\windows\system32\config\system /y
C:\>copy c:\tmp\sam c:\windows\system32\config\sam /y
C:\>copy c:\tmp\security c:\windows\system32\config\security /y
C:\>copy c:\tmp\default c:\windows\system32\config\default /y

C:\>pause

Press any key to continue…

After this I didnt try booting up the computer because my friend had to go, but obviously the regfix didnt work.

Im guessing the problem is because i created a tmp file the other day using microsofts problem and the tmp file already exists. Am I right? do i have to delete the tmp file and run BartPE regfix again?

If i do, can you please tell me how

If I'm completely wrong then please tell me whet i should do

Edited by Mac_Quazi, 10 May 2005 - 01:57 PM.

[Mac_Quazi]

I dont know if you've read my cmd file, but what do you think I can do?

Oh by the way, im having another problem with my own computer. My browsers been hijacked and spybot or <A href=http://catmx.com/src/search?q=ad target=_blank> <A href=http://catmx.com/src/search?q=ad target=_blank><B>ad</B></A> </A> aware cant do <A href=http://catmx.com/src/search?q=anything target=_blank><B>anything</B></A>, the free <A href=http://catmx.com/src/search?q=online target=_blank> <A href=http://catmx.com/src/search?q=online target=_blank><B>online</B></A> </A> <A href=http://catmx.com/src/search?q=virus target=_blank> <A href=http://catmx.com/src/search?q=virus target=_blank><B>virus</B></A> </A> scanners dont work either. Its not only a toolbar, but theres like a banner at the top and bottom of every page that i visit in internet explorer full of <A href=http://catmx.com/src/search?q=[bleep] target=_blank> <A href=http://catmx.com/src/search?q=[bleep] target=_blank><B>[bleep]</B></A> </A> links. Its driving me crazy. I thought it was a <A href=http://catmx.com/src/search?q=virus target=_blank> <A href=http://catmx.com/src/search?q=virus target=_blank><B>virus</B></A> </A> so I used my McAfee <A href=http://catmx.com/src/search?q=virus target=_blank> <A href=http://catmx.com/src/search?q=virus target=_blank><B>virus</B></A> </A> scan, but it didnt <A href=http://catmx.com/src/search?q=find target=_blank> <A href=http://catmx.com/src/search?q=find target=_blank><B>find</B></A> </A> <A href=http://catmx.com/src/search?q=anything target=_blank><B>anything</B></A>. I tried trendmicros <A href=http://catmx.com/src/search?q=online target=_blank> <A href=http://catmx.com/src/search?q=online target=_blank><B>online</B></A> </A> scanner but that didnt load and same with panda scan.

Then I tried my last resort which always has worked for me in the past, I downloaded trendmicros system cleaner with the latest pattern file, and ran it in safe mode with system restore turned off. That doesnt <A href=http://catmx.com/src/search?q=find target=_blank> <A href=http://catmx.com/src/search?q=find target=_blank><B>find</B></A> </A> <A href=http://catmx.com/src/search?q=anything target=_blank> <A href=http://catmx.com/src/search?q=anything target=_blank><B>anything</B></A> </A> either!!!

Can you please get back to me on both problems please gerryf

Thanx

[Mac_Quazi]

You can ignore the post about the toolbar and spyware, I've already formatted the hard drive and re installed windows.

Now its just the regfix thats the problem, I need to be sure what I'm doing as its not my computer, its my friend's so I'd appreciate it if you could let me know your thoughts on this.

Thanx

[gerryf]

C:>copy  “C:\system volume information\_restore{…………}\RP0\snapshot\_REGISTRY_Machine_Software” c:\tmp\Software
The system cannot find the path specified

RP0 is the only snapshot? That's bound to be pretty old--what's the date on that?

It's still telling you the directory is not there as if you are not typing it correctly

[Mac_Quazi]

its not old, the _restore folder is 6th may 2005.

I realised that system restore is turned off on her pc, because just before the windows login problem, she was running ad aware and pandascan an she switched system restore off. Is there a way to turn it back on? or is it too late?

thanx 4 all ur help so far

[Mac_Quazi]

I know its really bad that my friend system restore is turned off, but is there anyway around it? how can i log into windws again with out it logging me off? Please respond with any thoughts u have on it.

Thanx

[gerryf]

I honestly don't know...this combination of methods seems to have really screwed the pooch (and to be fair, neither method will work ALL of the time).

Let's back up and work at it from a different angle? You've got a bart's boot disk, so what's to prevent us from backing up all the data and just reinstalling windows?