[blackbear]

Hi! I got the c0000218 Registry File Failed error. I tried Safe Mode, System Restore back to Friday and still got the error. Following support.microsoft.com/kb 307545 Part 1, I used the Recovery Console on my machine from when GeeksToGo helped me with a virus problem and can now, boot into Windows.

Trying to do part 2. c:\System Volume Information\ only shows 2 _restore# from today and 01/31/2008 which has a RP0 and RP1\snapshot from 01/31/2008. This is really old. I'm not sure where the restore points that I saw on the System Restore calendar went to? Or, don't they backup the Registry files? Whatever files it is using now, brought me back to a long time ago before I even changed to a WorkGroup.

Before GeeksToGo helped me, I had done an ERUNT on 07/31/2010. Also, from within Regedit, I did a Export Registry on 8/31/10. I have removed Robohelp and installed a different version since then (lost Key when cleaned up virus). And the ERUNT would have been before the combofix and all the updates of Java, Adobe..., so it is old too. Would have GeeksToGo made any backup copies of anything I could possible hunt for and use?

Do I need to use the _restore# files? Or, can I use any of the other files? If not, do I just reinstall everything that doesn't match with the programs actually on disk?

Thanks

[Advertisements]

Registry files are part of System Restore, so if any points have been created it would include the state of the registry at that point in time.

Regarding the file mentioned in the KB article listed, those files (in the repair folder) are of the state of the system when it was first installed. It specifically says on the article: "This registry [in Windows\Repair folder] was created and saved during the initial setup of Windows XP. Therefore any changes and settings that occurred after the Setup program was finished are lost."


The exporting of the registry in Regedit does not in in itself back up the registry. In its simplest format it's nothing more than effectively a text document, which you should not import back into the system as it stands now because it resolve nothing. In fact it will probably make things worse.

Your most recent Erunt backup is dated July 31st, so since you appear to have no other copies available, the only thing you can do is try the "Emergency Scenarios" option in the Readme File for this program, if you can't do it from within Windows:
http://www.larsheder...erunt/erunt.txt

[Neil Jones]

Registry files are part of System Restore, so if any points have been created it would include the state of the registry at that point in time.

Regarding the file mentioned in the KB article listed, those files (in the repair folder) are of the state of the system when it was first installed. It specifically says on the article: "This registry [in Windows\Repair folder] was created and saved during the initial setup of Windows XP. Therefore any changes and settings that occurred after the Setup program was finished are lost."


The exporting of the registry in Regedit does not in in itself back up the registry. In its simplest format it's nothing more than effectively a text document, which you should not import back into the system as it stands now because it resolve nothing. In fact it will probably make things worse.

Your most recent Erunt backup is dated July 31st, so since you appear to have no other copies available, the only thing you can do is try the "Emergency Scenarios" option in the Readme File for this program, if you can't do it from within Windows:
http://www.larsheder...erunt/erunt.txt

[Macboatmaster]

Sorry to come in on this BUT if the ERUNT backup is BEFORE Geeks Malware Forum helped with the VIRUS removal DO NOT use that ERUNT to restore your registry.
Registry keys are a favourite place for malware.
You could end up with more problems than you have now

Would have GeeksToGo made any backup copies of anything I could possible hunt for and use?

This forum will not have made any backup copies of anything useful to you in this case.


See this on the three likely causes of registry corruption
1. Power failure or hard switching off, rather than normal shut down.
2. Hardware fault
3. Process writing to registry when computer is shut down

http://support.micro....com/kb/822705/

Edited by Macboatmaster, 28 September 2010 - 04:45 PM.

[blackbear]

Hi! Thanks. I won't use ERUNT files. When I go into Programs, Accessories,... System Restore. It shows dates highlighted 9/13, 14, 17, 21, 24, 28. Could these Restore files be located someplace other than c:\System Volume Information (only _restore# there were 9/28/10 and 1/31/08)? It isn't writing new data into the files even though they have the old date, right? 9/13 was the RoboHelp install. The other dates are Software Distribution #.#. Should I search the whole disk? There wouldn't be anything login name specific as the login screen was for the domain instead of workgroup?

KB 30754 Part 2: talks about replacing the old backup files with the Restore Point files, making it sound like I should be somewhat close to where I was before I got the error?

Thanks

[Macboatmaster]

Open My Computer, Click the Tools tab, then Folder Options and View tab. Check to show "Hidden Files anf Folders" and uncheck "Hide Protected Operating System Files" Agree the warnin g and then click Apply and OK.
You will then on C drive see a folder "System Volume Information. If you open that you will then see a folder Restore etc. Open that and it will show you the restore points, these should be the same restore points as you would access by Programs, Accessories, System Tools, System Restore.

Do not forget to uncheck and check as necessary to Hide Protected Operating System Files and Do Not show Hidden files etc.

Edited by Macboatmaster, 28 September 2010 - 05:16 PM.

[blackbear]

Hi! I checked and those settings were as you noted. Per the KB, it said, do not use the _restore# from today. I did a Search of the disk on SECURITY and found the Restore Points (RP#) that were missing were under the _restore# from today. The files showed up as blue (not sure what that means).

I followed Part 2 and copied and renamed the files from 9/24. Skipped Part 3 as Fat32 steps. (Very confusing instructions.) Shut Down. Rebooted and it still showed me in a Domain. Did System Restore for same date I had copied the files for and got the c0000218 error again.

Redid all steps and on System Restore I picked the 9/21 date. (It did say it will change from Domain x to Workgroup y). It rebooted and said, it couldn't restore off 9/21.

It did boot, but I am back to pre Workgroup days. I thought of turning off System Restore, but it said, I would lose all restore points. I also checked and all my pre 9/21 RP#'s are gone.

Is this the best it is going to get and I need to reset my WorkGroup and reinstall everything if it doesn't run? Do you know what would cause a c0000218 to occur? Is there anything else I should check? I'm leaving it up tonight, so I don't get another restore point for tomorrow.

Thanks

[Macboatmaster]

When you selected system restore for the same date as you had carried out the instructions, you would receive the same error, the purpose of system restore is to select a date before the error.
See this
http://support.microsoft.com/kb/306084

I am not certain what you found in System Volume Information, but the restore points listed there in the folder I told you to open should have ben the same as the restore points in the calendar dates on Programs, Accessories, System Tools, System Restore.

A more comprehensive explanantion of system restore
http://www.microsoft...ew_03may19.mspx

Edited by Macboatmaster, 29 September 2010 - 06:57 AM.

[blackbear]

Hi! Thanks for the article links.

The system booted using the 9/24 copies of the files. I can't get any System Restores to be successful (and prior restore points no longer exist).

Regedit shows new programs used lately (like Kapersky). As the programs on disk would match that registry, I'm thinking I should be ok?

I will need to change to WorkGroup instead of Domain.

Is there anything else I should check? Or, run?

Is ERUNT the tool I should use to make special backups of the registry?

Thanks

[Macboatmaster]

I can't get any System Restores to be successful

Is the computer now booting without the error.
If so firstly, check you have a restore point, XP will or should have created one, to be safe, create one now.
Then go My Computer. right click the HDD carrying Windows, click Properties, Click Tools, click Error checking, click check now, click to check automatically fix file system errors, and click start, agree to reschedule for restart and do so.
DO NOT interrupt this check..

Then go START, run and type "sfc /scannow" without colons of course, you may ned to insert the XP CD if it asks for it.

Edited by Macboatmaster, 29 September 2010 - 06:00 PM.

[blackbear]

Hi! Right, I am up and running (booting off the copied Registry Files). But, I could never get a Restore to Work.

I ran the Error checking and sfc and it didn't say/display anything.

I changed back to WorkGroup. When I tried to open a Word 2007 document, it needed the compatiblity pack which was something I had installed before. When I went to Windows Update, I didn't have the Update program. I installed that. I tried Windows Update and it says I need to reinstall SP3. It looks like I'm going to have to reinstall everything that it can't run/find.

Thanks for your help.

[Macboatmaster]

System File checker does not issue a report unless it cannot find any files it needs.
Pleased you got back in the system.
Backup the registry using ERUNT.
Ensure you have system restore switched on.
Did the chkdsk report any errors see Control Panel Administrative functions, Event Viewer, Application and scroll down to winlogon entry, double click it.

As Neil Jones said in post 2, you are now back to

This registry [in Windows\Repair folder] was created and saved during the initial setup of Windows XP. Therefore any changes and settings that occurred after the Setup program was finished are lost."

Please ensure that you DO HAVE virus protection before connecting to the net.

Edited by Macboatmaster, 29 September 2010 - 06:06 PM.

[blackbear]

Hi! I don't see a winlogin entry in my Application Event Log. I recalled from August I got some found.00#'s that I think were from chkdsk errors. I checked and I don't have any new found.00#'s. So, I don't think it found any errors.

I'm wondering when my system files got reset back to Windows XP SP2? Is it when I did Recovery Console? Is there any way to make that be a SP3 Recovery Console in case this happens again?

I'm assuming I will need to reinstall all the Windows update patches. As I had already done these, is there someplace I can delete them? Or, will it know they are already downloaded and just need to be installed?

In 307545 Part 1, you use the original windows registry files. But, in Part 2, you copy your system restore registry files over those. So, currently, my registry files have the latest entries (even the Robohelp I installed on 9/13). I think it's because I could never get the System Restore to work that things aren't matching up?

Do you know of a place to get the Windows Update SP3 download that is only 66.9 MB? I was going to download it so I would have it on disk to use if this happens again. But, they only show a big 318 MB file available for download on the download site.

Thanks

[Macboatmaster]

If you go to Event Viewer - Application
- immediately after Chkdsk - you'll find an Entry called 'winlogon' - if you Click on that you'll get a Summary
This is a copy and paste from a web page on chkdsk.

[Macboatmaster]

The Recovery Console is NOT service pack related.
It is simply a way of using the commands to run chkdsk, fixmbr, fixboot and many other items when Windows will not load.
The easiest way to do what you are asking is to purchase an external hard drive and when your system is up and running with all updates and service packs, create a COMPLETE image of the hard drive. This together with separate backups of all your personal data - kept up to date - is the failsafe way.
Recovery partitions on branded computers have the weakness, that if the hard drive fails, as against the Windows file systems, you have lost the ability to use the recovery partition.
There is the other option of copying your XP CD and then slipstreaming in to it the service pack 3.
There is also the option of copying the XP CD to the external drive, this is useful if for some reason the CD becomes damaged.
A further option is to load the recovery console onto the hard drive and you then have access to it without the CD.
The choices really are endless.

Slipstream SP3
http://wiki.eeeuser.com/slipstreamsp3

Install Recovery Console as boot option
http://www.aade.com/.../XPrecovery.htm

Additionally as you have XP Professional you do already have installed BackUP with the option to create a full image backup with recovery on an ASR floppy. The full backup should be on an external drive. See Start, Programs, Accessories, System Tools, Backup.

Edited by Macboatmaster, 30 September 2010 - 05:44 PM.

[Macboatmaster]

To answer the other question on your last post. Yes you will need to download all updates