Registry keys deleted by accident +more

Status
Not open for further replies.

PipeRifle

Beta member
Messages
5
Due to an unfortunate pop-up click by her boyfriend, by roomate's HP Omnibook 4150 went haywire and mad crazy with spyware, malware, virii, you name it. It was almost back to normal after extensive anti-spyware and virus cleaners ran through it, then, at the last second, some bad stuff went down.

The following registry keys were deleted in an attempt to remove an error message which was believed to be part of a virus:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
"Class"="hdc"
@="IDE ATA/ATAPI controllers"
"Icon"="-9"
"Installer32"="SysSetup.Dll,HdcClassInstaller"
"TroubleShooter-0"="hcp://help/tshoot/tsdrive.htm"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
"Class"="hdc"
@="IDE ATA/ATAPI controllers"
"Icon"="-9"
"Installer32"="SysSetup.Dll,HdcClassInstaller"
"TroubleShooter-0"="hcp://help/tshoot/tsdrive.htm"


1st one Named Class, type REG_SZ, data: hdc
2nd one Named Installer32, type REG_SZ, data: SysSetup.Dll, HdcClassInstaller


Because of this (I am suspecting), Windows now refuses to boot up in any fashion. Being a Windows 2000 machine, there is no built in command prompt to attempt a registry restore, and since I cannot get into windows, there is no way to cut and paste the keys from a working machine, assuming that would even work anyway.

The biggest problem: This laptop has no floppy drive, as well as the owner no longer having her Windows CDs. Perhaps with a recovery CD or a boot disk, it would be no problem, but these are not an option.

Upon any attempt at startup, normal, safe or otherwise, the computer immediately shuts down and emits a few beeps before turning completely off. Even attempting to replace the OS by upgrading to Windows XP results in the computer shutting down immediately after the initial DOS-based system scan.

I was wondering if anyone had any ideas for options on replacing the deleted registry keys short of obtaining another copy of windows and running the recovery program. Also, reformatting is not an option, none of the data on the computer has been saved.

Perhaps someone knows of a way to load a windows 2k recovery program via a CD that I could burn with my working computer? Or any other program that would let me get into regedit without going through windows? Any help would be appreciated. Thank you.
 
Since the owner has lost her Windows CDs, the only thing that I can think of is borrowing the CD from someone with the same operating system (aren't I lame? :) Rhetorical). What needs to be done is what you've already said: Repair the OS using the CD to copy the necessary files.

Ok another idea...

There is a site (I think it's something like bootdisk.com) that has many different Windows boot disks that you could download and try. I'll do a search on the net and try to find it for you. You could burn the download to CD and see if that works...
 
I've found someone with Windows 2000 discs that I hope will work. I'm not sure if they are pirated ISOs burned to CD, or if they are legit. I feared that would be my only option, short of a wipe and reinstall.

I did attempt to download disks from bootdisk.com and make them into bootable CDs, but even attempting to put the diskette image onto the floppy generated read errors on two different computers. Also, I fear that since Windows 2000 uses a set of 4 diskettes, using an emulated bootable CD would result in the first CD finishing, and then checking the A: drive for the next. While I'm sure there are workarounds to this, it would probably involve tampering with the BIOS first boot drives and more (and is kind of moot since the diskettes refuse to copy). Hopefully my pal's windows disks will help, otherwise I may have to wipe it and reinstall a copy of Windows XP (which I do have ready to go)

In that case, does anyone know any good ways to clear everything off a computer? There are some utilities on The Ultimate Boot CD that I downloaded, but I'm not sure on the best one, or the best way to do it. I'm sure there are other threads here that address these issues. For now, I'll see what happens and keep you posted. Thanks for the help, guys.
 
Just a few notes on this problem... The keys you have indicated are not the problem. The problem is something abit more complex. The keys you have indicated are not actually used by the system.
The way that the system works, is when you boot into windows, the system reads from the last successfull boot then loads that information into the HKLM\system\currentcontrolset key. This key is then copied into the controlset001 key when you reboot and saved as the system key for the next reboot in the directory %winroot%\sysytem32\config. This file is used to set the next configuration when you boot. There are several ways to get around this, and as you stated the system is not getting the windows screen, so the keys in the registry would not have been overwrote yet...
The problem is not the OS. Have you tried replacing or removing memory sticks or anything like that? I bet you that the problem is hardware related more than Software. From the sounds of it, the system is dying at the same point no matter what you choose to do, and that sounds like a hardware issue more than software...

Just my 2 cents...

Oh, and Microbell, you can edit the regitry from several different tools that allow you to read the windows environment. Among then (tools) are reg.exe found in all recovery consoles. You just need to know how to find the keys to read...

Oh, here is a link to a site that has a lot more tools then Bootdisc.com.. Very helpful if you understand that he is getting at...
http://www.nu2.nu/
 
While it's true that the machine is dying at the same point every time, I can't help but think these keys have something to do with it, related as they are to the Hard Drive/Disc Controller. There were never any hardware conflicts before, despite numerous restarts during the virus-cleaning period. It was only after this last restart, in which those keys were deleted, that the problem occurred.

Also, the keys I posted were similar keys in the same folder obtained from a different machine, so the in-depth info may not be accurate. The name, type, and data are the same, however.

Having obtained a Windows 2000 Setup CD, I am no further ahead than before. When the machine boots from disc, I am given a blue screen with "Windows 2000 Setup" at the top, and a list of drivers and other files the program is initializing going across the bottom. This continues until everything is loaded, at which point it reads "Starting Windows 2000" and then the computer shuts off. I am never given a prompt, as Microsoft tells me I should, to install, repair, or run the Emergency Recovery Console. I'm not sure if this would happen after the "Starting Windows 2000" part. This is exactly the same process that occured with the Windows XP CD, and the computer failed at the same point.

All this leads me to believe that there IS a hardware issue somehow, though the deletion of the keys is the only thing I could imagine is leading up to it. If anyone has any more ideas, I would certainly be glad to hear them, otherwise tomorrow I am taking the notebook to a friend to remove the hard drive, hopefully clear any important files off of it onto HIS laptop, and then to a wipe and reinstall, hopefully of a better or more stable OS. Thanks again.
 
The only thing I can tell you is that this issue will not be created by the removal of those keys. Coincidence is an odd thing, but does happen... The self healing ability of windows is pretty amazing now, and if you did remove those keys they would be repaired almost without thinking. Since hardware is initialies outside of the registry anyway, they would become active as soon as the kernal started. any hardware specific component will automatically try to self recognize and repair if needed...

I would suggest the following if you can... Get a copy of Norton Ghost. Ghost off her machine to another harddrive, and then wipe the system completely. This will give you a fresh slate to start from.

But as I suspected, since you are dying even while booting from the CD you have a Hardware failure...
good Luck
 
This is going to sound fantastically stupid, but do you think Windows would not be initializing due to heat? I haven't dealt with laptops much, and from the onset of the virii and malware, up until today, the thing has been plugged in, being intermittently turned on and off. I finally moved it off the desk to take a look at the bottom (since I had considered removing the HD and cleaning it off with a friend's computer), and the bottom was almost scalding to the touch. I've put it where it can get some air and cool down, and now that I think of it, for a while Windows was starting up only to be immediately closed by a system error, and after a few tried at this it ceased to boot up at all, simply emitting one long beep followed by two short beeps and then shutting off. Could this be the heart of my initialization failure?

Even if so, it doesn't explain the persistent system errors that occured when it DID start, which, again, was immediately after deleting the registry keys. It's possible that one of the other attempts to remove a virus also did it, but why did it seem to wait a few restarts for the error to occur?

I suppose it's possible that something altogether unconsidered is wrong. If letting it cool off helps, I'll offer my sincere thanks and heartfelt apologies for wasting time.


Edit-I apologize for wasting time, although everyone's advice was fantastic. The computer had overheated, and after a sufficient cool down period, I was able to upgrade to windows XP and fix the problem. The windows 2000 disk with it's recovery feature proved worthless, but I got up to XP with all my files and data intact. Thanks again for the help.
 
Status
Not open for further replies.
Back
Top Bottom