windows/system32/config/system not found

Question

Hello,
I'm trying to help a friend whose PC won't start. He gets an error message early on saying that windows/system32/config/system is missing or corrupted.

I tried the recovery console, chkdsk /p, and at 50%, it's not progressing at all, for about 45 minutes now.
On the current screen, it says:
the system registry does not seem to have an active controlset key
the system registry may be damaged

Should I let it go for longer, at what point should we acknowledge that it won't proceed...

Thanks!

Configuration: Dell Dimension 4600 Windows XP pro Firefox 2.0.0.16

Constantin92 · Answer

Good evening,

the Windows Registry is broken.

The following Article No. 307545, extracted from the Microsoft Knowledge Base, provides the procedure to follow:

<A href="https://support.microsoft.com/en-us/help/307545">here</A>

You need to type commands in recovery console mode to try to copy the components of the registry from a backup.

I hope it works, otherwise you need to reinstall XP over it in repair mode...

To have a preventive action against these inconveniences, there is a great and free little tool called ERUNT (with an AUTOBACKUP for 30 rolling days of the registry; set it to BACKUP EVERYTHING) which keeps an image of the Windows registry in c:\windows\erdnt along with a small EXE that automatically executes the 16 command lines we would have to type manually in recovery console to do it manually..

And it also works from a boot on a CD with UBCD 4 WINDOWS!

Good luck, best regards
--

Constantin92.

oncledoc · Answer

Thank you for your response

I thought I had successfully repaired it by typing this in the console:

o cd \
o cd windows
o cd system32
o cd config
o copy c:\windows\repair\system system

I received a confirmation request and a success message. I then exited and rebooted, and for about 5 seconds, I was on the desktop with the icons and everything (the first time in at least 5 days).

Then a blue screen appeared saying that a crucial process or thread had terminated unexpectedly
*** stop: 0x000000F4
beginning of physical memory dump
physical memory dump complete
etc

:O(

oncledoc · Answer

I just rebooted, practically the same error after 5 seconds on the desktop this time, I have 0x00000024  ;o(

oncledoc · Answer

After another reboot, a page almost entirely blue with: STOP: c0000221 Unknown Hard Error Unknown Hard Error  Indeed, it is in the terminal phase, this computer.

oncledoc · Answer

and finally a black screen with:  A disk read error occurred Press Ctrl+Alt+Del to restart

Constantin92 · Answer

Hello,

ouch ouch ouch!

You only did part of the operation without following it to the letter, so the system is completely messed up.

Please re-read this page:
<A href="https://support.microsoft.com/fr-fr/help/307545"><here</A>

You only copied ONE of the hives from the Registry: in addition to SYSTEM, you should have also copied: SAM, SECURITY, SOFTWARE, and DEFAULT.

Redo everything meticulously as indicated in the Microsoft knowledge base article I mentioned above. Operations in the Registry do not allow for approximations! It’s all very critical.

If, after completing the entire operation, the machine continues to talk about hardware errors, only then should you consider a hard drive problem. In the unstable state that the machine is currently in, with only 1/5th of its Registry restored and the rest missing, it’s possible that the diagnostic system is reporting anything, because this state is completely unexpected.

If you can't regain control, the only option left is to reinstall Windows... in repair mode.

good luck, best regards

--

Constantin.

oncledoc · Answer

Hello Constantin,
you are right, I read the MS instructions a bit hastily...

I can't even access the console anymore, right after I type ''R'', I get another blue screen, and here are the key points:
a problem has been detected and Windows has been shut down...
the problem seems to be caused by the following file: ntfs.sys
(bla-bla-bla for 15 lines)
Technical info:
***STOP: 0x00000050 (bla-bla-bla)
*** ntfs.sys - address F70D94B4 base at F709F000, Datestamp 3d6de5c1

And the final blow, I get almost the same blue screen when attempting a repair install

Just to confirm something. You mentioned you might suspect the HDD, as for me, I have seen at least 10 messages mentioning memory addresses....
This computer has 4 sticks, 2 original ones of 256MB each, and then 2 added a year ago of 512MB each.
Do you suggest I try restarting with the 2x256MB original ones, then with the 2x512MB new ones?

Thank you for your support and patience.

Constantin92 · Answer

Hello,

Yes, good idea indeed: give that a try.

You can also test your RAM sticks with the MemTest86 utility by booting from a diskette it creates (and perform the extended tests for at least 1 hour with each stick ALONE).

Otherwise, you will need to try booting from the Windows CD and selecting "Repair" the first time it asks you this question, which will open the recovery console.

Good luck!
Best regards,

--

Constantin.

oncledoc · Answer

Hello again
the first two commands from the MS article
md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
give me "access denied"
NB, I don't get any admin password prompt

I'm not going any further for now, as I assume these commands need to be run in the prescribed order, without skipping those that don't work.

Really strange behavior, this computer

oncledoc · Answer

And at the risk of repeating myself, I can no longer access the console
so, no access to the console,
no access to the repair install
paired memory tests inconclusive

Your opinion is welcome, but I think I will remove the HDD, insert it into an external USB enclosure, and try to recover as much as possible...

This computer is like a person with a serious physical illness combined with a deplorable mental state.

Constantin92 · Answer

ok,

well then, if you don't even have access to the Recovery Console when booting from the CD, it is indeed more serious.

Yes, take a look at that, but once the hard drive is removed, you can use the special boot floppy to test your RAM sticks on the machine in question (one by one, of course).

It's not impossible that a RAM problem and a hard drive issue have compounded...

Good luck!

--

Constantin92.

oncledoc · Answer

I have a slim hope...
As indicated in my first post, it is a DELL PC
I have access to a special menu with F12, and I am currently in a DELL diagnostic utility, with various test options based on the problems encountered
I started with "Test for Cannot Boot the OS," and so far all tests have passed successfully
L1 cache, L2 caches, RTC, CMOS, and it is currently running a massive battery of memory tests

I'll keep you updated, my dear...

oncledoc · Answer

Hello again,
the first applicable test took a whole day to complete, and it curiously indicates that everything is going well in the best of worlds. I just started the next applicable test, "Test For Windows Blue Screen," about 30 minutes ago.

I'll keep you posted...

oncledoc · Answer

The Dell diagnostic tool sees nothing wrong, the extensive memory and hard drive tests have come back clean, all tests passed successfully (!?!?!?)

I realize I expressed myself poorly, I can enter the console, but as soon as I start the kb307545 procedure, I run into "access denied" messages.

oncledoc · Answer

chkdsk /p, just like chkdsk /r, gives the same result:  The volume appears to contain one or more unrecoverable problems.

Constantin92 · Answer

Good evening,

(I read your posts when I come back from the office)

Oh no!
This thing is really unclear. I understand that you are pulling your hair out...

Well, let's see...
Wasn't the disk in question intentionally encrypted with EFS, by any chance??

And are you sure it hasn't caught any nasty stuff (from P2P software, or by surfing the Net with admin rights, for example...) ?

It could also well be a combination of malware and a hardware issue... but it is quite strange.
I hope it's not one of those nasties that was gradually encrypting the hard drive clusters without saying anything... until it made itself known once it reached 40 or 50% of pirate encryption, to say that if you remove the virus, you say "goodbye" to the data too!!!

Personally, I would try booting from a live CD of Windows (like UBCD4Win, for example) and do online scans by visiting reputable sites to analyze the disk...

Be careful, I remember that on some Dell machines in the fleet I manage, we had to completely disable the boot from the hard drive in order to boot from the CD, because even following the boot sequence, the BIOS wouldn't allow it!

oncledoc · Answer

Good evening (but here, near Montreal, it's almost 4 PM...)
Wow, that's an understatement...

I went to get a SATA enclosure, I just connected the HDD to my computer and all I get is:
"H:\ is not accessible
The file or directory is corrupted and inaccessible"

(to the best of my translation skills, as the computer I'm trying to get back on its feet is in French, while mine is in English)

I can hardly believe that I managed to start the sick computer two days ago, and now I can't recover anything today (???).

The user I spoke to again yesterday told me that he was on a cooking recipe site (...) and that when he tried to add bookmarks in Firefox, all the ones that were saved seemed to "disappear" before his eyes.

Constantin, can you tell me if I can have even the slightest hope of recovering at least the list of programs (program files), if not the documents & settings???

oncledoc · Answer

I realize I have "ignored" your questions...
(I am in shock, I really didn't think this seemingly small repair would turn into a reinstall of XP with the loss of all user files)

1) "voluntarily encrypted EFS?"
I don't believe so, I had returned the machine completely to them myself in January

2) "And are you sure he didn't catch some junk (from P2P software, or by surfing the Net with admin rights, for example...)?"
I am sure they caught some junk, he uses Frostwire (but just for mp3s and videos, and yes, he surfs as admin. Next time I return this computer to them, they will have a reduced privilege account and will have to call me if they want to do otherwise!

oncledoc · Answer

I apologize for bombarding you like this... On the KB307545 page, there is a warning not to use the procedure with an OEM  Do you think that could partially explain the "access denied"?

Constantin92 · Answer

Re-good evening, Canadian cousin :-)

Ayayaye... regarding the OEM issue (indeed) and for (2), and 'phew' for (1) but well, given the rest...

Well, online I came across a page that says this about a STOP 0x00000050 error like yours:

-------------------------------------
Source = Excerpt from http://www.hotline-pc.org/stop.htm

- STOP Error 0x00000050 or 0x00000024 "PAGE_FAULT_IN_NONPAGED_AREA" (The offending file is Ntfs.sys):

1) Start your computer from a Knoppix disk.
2) Click on the Terminal Program Konsole button.
3) Type: su
4) Enter this command: cfdisk

All partitions present on your disk will be listed as follows: hda1 (C:\), hda3 (E:\), etc.

5) Select the Quit command.
6) Run this command: ntfsfix /dev/hda1

Note that the full documentation on this tool can be found on this web page:
https://www.tuxera.com/
7) Repeat the same operation for other NTFS partitions you have listed.
8) Restart your machine.

Your screen will stay black for a while… Wait the necessary time until the boot is normal this time.
-------------------------------------

Now, the Knoppix Live CD can be downloaded ...
<A href="http://www.knoppix.fr/">HERE</A>

Good luck! (it's 10:44 PM here, next to Paris...)

Best regards,

--

Constantin92.

Constantin92 · Answer

(It is 11:30 PM, I'm going to bed, tomorrow wake-up at 5:45 AM...)  Good luck, and please keep me updated  Regards,  --  Constantin92.

oncledoc · Answer

Hello Constantin,  The STOP 050 error was just one of the many BSOD errors I've seen over the past 4 or 5 days. What I'm realizing now is that the content of the main hard drive seems irretrievable.  I'm not comfortable (not skilled enough) with Knoppix or anything like that. I'm going to remove the main hard drive from the external case and put in the secondary hard drive, where there were quite a few personal files and folders, at least before this mess there were quite a few things.  I'll probably give you another update tomorrow morning... Talk soon

oncledoc · Answer

I can access the 2nd hard drive (storage) without any problems, I am currently doing a deep scan with my a/v, I have all the multimedia files, Word/Excel/PPT/pdf.  But is there no way to view the content of the 1st hard drive in MsDOS? Somewhere there are the emails/address book from OE, the favorites from IE7, the bookmarks from Firefox, the list of programs, and more...

Constantin92 · Answer

Hello,  yes, this is just one among all the BSODs encountered, but since it clearly reflects a real hardware issue, I give it some credit...  Well, there's a utility that does wonders, but I'm not sure if it's worth buying because for SATA, I'm afraid it might not be suitable... it's SPINRITE by Steve Gibson (http://grc.com). I could only use it on IDE (perfect), but I had the chance to try it once on a SATA disk and there, nothing... (coincidence or not? I don't know...) so forget it because it's 85 US$ if I remember correctly.  If it's a hard drive with a removable controller card (underneath, with a few screws), if you're lucky enough for that to be the culprit, and you find another hard drive with a working card, you can replace them (if it's EXACTLY the same type!); we've sometimes managed to save HDDs with that, it all depends on whether it's the disk that's dead or the embedded controller...  Otherwise, just before reaching the data burial ceremony, and very empirically, on a wrecked HDD, when nothing works anymore, we have tried the so-called "trick" of putting the hard drive in the fridge for a few hours and then trying to access the data again... sometimes it works, sometimes it doesn't.  You know, I think we won't be able to perform miracles this time... but the user is not very aware of the issues with their behavior, so: make them learn the www.malekal.com site by heart as a penance! ;-)  Best regards,  --   Constantin92.

oncledoc · Answer

Hello again, you are undoubtedly at work, I started my vacation yesterday. I called the owner of the computer to let him know the news and to suggest going to the "pros" if they are in a hurry, which is not the case. I have one to two months...  I went back to check the Knoppix links and maybe I will take my chances, I am contemplating. If necessary, do I absolutely have to put the faulty HDD back in its machine, or can it remain in an external case?  I knew about SpinRite from visiting ShieldsUp often (excellent site), but I never tried it, and as you mentioned, too uncertain for the price. There are several free data recovery software, like Recuva (from the people who make CCleaner), do you think that could be a good path?

Constantin92 · Answer

Good evening,  indeed, yes (busy day!)  I'm coming home now, and I'm reading my emails before going to prepare a gingerbread.  Um... if I were you, I would put it back in its original machine, just to avoid inadvertently treating another HDD... moreover, not all utilities are able to handle disks via USB.  Recuva? Well yes, why not, but it will only work once the HDD is visible!  Good luck with Knoppix...  Best regards,  --  Constantin.

oncledoc · Answer

Hello, it must smell good in the cottage... Recuva sees nothing I am at the point of making a choice between Knoppix and UBCD4Win, which you recommended earlier. Or rather, in what order?

Constantin92 · Answer

(re-good evening)  Uh... yes! (lol) ... especially since it's cooking slowly in the bread machine.  So there, I would definitely lean towards Knoppix and its NTFS system repair, because I fear that UBCD4Win won't be able to see much either (let's not forget that it's a Windows PE base...)  I've never tried that one, but I keep the "tip" handy...  Good luck! :-)  Best regards,  --   Constantin.

oncledoc · Answer

Hello again Here it is, my Knoppix boot CD is ready, and for a change, I have a hesitation.  The sick hard drive is in the external case, shouldn't I leave it there, because if I need to copy and paste what I can/want to recover, I need a healthy destination...  I may be confusing myself with 3 different pages of instructions, and rereading your post #20, I believe we can even "dream" of repairing the file structure, right?

Constantin92 · Answer

Yes, it's indeed a matter of structural repair  Oh no, I would only put the faulty disk back in the CPU. = no possible errors.  And then, nothing prevents you from connecting your external USB backup drive AFTER the operation, either under Linux or after rebooting under Windows, by the way...  Best regards, --   Constantin

oncledoc · Answer

Hello, I followed the instructions from your post #20, here's where I am after typing ntfsfix /dev/hda1:  Failed to determine whether /dev/hda1 is mounted: No such file or directory Mounting volume... Error opening partition device: No such file or directory Failed to startup volume: No such file or directory Attempting to correct errors... Error opening partition device: No such file or directory FAILED Failed to startup volume: No such file or directory Volume is corrupt. You should run chkdsk  The result seems quite "average", but while I was transcribing everything, I believe I understand hda1 is a small 40MB partition, in FAT32, with some DELL stuff  Should I rather type ntfsfix /dev/hda2: hda2 is the MAIN partition of 155GB with Windows and all the rest  UPDATE: I retyped ntfsfix /dev/hda2 (without going through the other steps again), and it returned all the same results, but very quickly this time.

Constantin92 · Answer

Well, if /dev/hda2 is the 155 GB partition, yes, of course!  It's normal that NTFSfix doesn't work well on... FAT32, that's almost reassuring (!)  I didn't understand everything. When you say "without going through all the steps again," what do you mean by that?

oncledoc · Answer

What I have done so far:  ''1) Start your computer from a Knoppix disk. 2) Click on the Terminal Program Konsole button. 3) Type: su 4) Enter this command: cfdisk  All the partitions present on your disk will be listed in this form: hda1 (C:\), hda3 (E:\), etc.  5) Select the Quit command. 6) Run this command: ntfsfix /dev/hda1 ''   Then I just typed:  ntfsfix /dev/hda2  Without repeating steps 1 to 5.

Constantin92 · Answer

Thank you,   (sorry, I'm distracted)   so there are two possibilities:   - 1: the disk is really dead,  - 2: the SATA is not supported by the utility....   I'm doing some research.

oncledoc · Answer

When I ran the command ntfsfix /dev/sda2, I got a result that was ''a little'' different  Mounting volume...$MFT has invalid magic ntfs_mft__load(): Failed Failed to load $MFT: Input/output error Failed to start volume: Input/output error FAILED Failed to startup volume: Input/output error Volume is corrupt. You should run chkdsk.

Constantin92 · Answer

Ah, well, I don't know which one of us is more clueless about Linux... but it's probably me!!! So, let's "share" this mistake that is OURS ;-) Seriously: while I'm comfortable with XP, I have NO background with Linux and I'm still a TOTAL NEWBIE. Here's what I found: here Excerpt: The master disk on the primary IDE controller is named /dev/hda. The slave disk on the primary IDE controller is named /dev/hdb. So /dev/sda1 means that the SATA is seen as SCSI, and then YES you have to take /dev/sda2 Let's go!

oncledoc · Answer

But this disk is a SATA, with the small connector, not the large 80-pin flat ribbon. I was just about to ask you why I had to type 'dev' before sda2.

Constantin92 · Answer

Why SCSI for SATA? Because both are SERIAL while IDE/PATA is Parallel: it doesn't seem illogical to me at all.  Why /dev/sda2? Ah, I don't know that, but it's following the example provided by the site where I found the manipulation.  (I told you I wasn't a Linux specialist... as you can see)  It doesn't do anything with:   ntfsfix /dev/sda2?

oncledoc · Answer

Here's what I get:  Mounting volume...$MFT has invalid magic ntfs_mft__load(): Failed Failed to load $MFT: Input/output error Failed to start volume: Input/output error FAILED Failed to startup volume: Input/output error Volume is corrupt. You should run chkdsk  This is the second time it's recommending chkdsk With Windows it wasn't working anymore, but maybe with Knoppix (???)

Constantin92 · Answer

Well, I must admit I don't know either,  I had understood that NTFS management under Linux was limited with Knoppix, but you might want to give it a try...  I haven't found anything on Google indicating issues following a CHKDSK of an NTFS volume under Linux... so I would also give it a shot.

oncledoc · Answer

I tried something else (which was recommended on http://www.hotline-pc.org/bootcd.htm#0401)  For example, to display the contents of your bootable partition, double-click on the icon of your hard drive: Hard Disk Partition [sda2].  I get a popup error that goes as follows:  Could not mount device The reported error was: $MFT has invalid magic Failed to load $MFT: Input/output error Failed to startup volume: Input/output error Failed to mount '/dev/sda2': Input/output error NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE! The usage of the /f parameter is very IMPORTANT No modification was made to NTFS by this software  (with an OK button)

oncledoc · Answer

I will follow the instructions from the last error message, not much choice... You are really a nice guy to help me like that, it's greatly appreciated!

Constantin92 · Answer

According to the displays you are reporting to me, no changes have been made to the NTFS partition, so it's status quo: nothing worse than before.  Yes, running CHKDSK C: /F under Windows PE (for example from UBCD4Win = Ultimate Boot CD) is something you can definitely execute!  After that, what it may yield or not... we'll see if we can access it or not, but we have to try, yes!

oncledoc · Answer

I just tried it in the recovery console and it says that the /f parameter is not valid  So, I will have to do a cd UBCD4Win, no problem, but I think I will give you some news tomorrow, it's getting late for you, we are just at the aperitif here, so cheers!  See you tomorrow And thanks a thousand times again

Constantin92 · Answer

Sorry, in recovery console mode, the syntax is rather:    CHKDSK C: /P /R  Good luck (I'm going to bed indeed)  Enjoy your drinks, cheers to you, cousins! ;-)  Best regards, --  Constantin.

Constantin92 · Answer

(just a reminder, the recovery console is NOT in MS-DOS!)

Constantin92 · Answer

One last thing before I shut down my PC:  In the file manager of UBCD4Win, sometimes write operations when copying or pasting files are denied; open a command console (DOS type) and redo them "manually", then it works.  This time I'm off!  See you!

oncledoc · Answer

Here I am again, the night before yesterday, on the advice of a friend, I ran GetDataBack in demo mode and the program seems to have recovered everything intact.  I brought him the hard drive yesterday morning and he copied (raw image) the hard drive onto another hard drive that he lent me. And above all, he copied the results of the backup onto this loaned hard drive.   I have reached the point where I will meticulously reformat the original hard drive, then start everything from scratch, which represents a lot of work (XP Dell sp1 disk, so over 300 updates, reinstalling all programs, optimizing XP settings, and more... It's hard to believe I did all that last January... ;o(   This time, I will make an image copy of the partition   I will set them up with a user account with reduced privileges; they will have to surf and use P2P from this account.   Well then Constantin, thank you a thousand times for your great availability and patience, and moreover, you have made me discover tools that I will keep close at hand (ubcd4win, Knoppix)   Looking forward to it!

Constantin92 · Answer

Good evening!  aaaaaaaah! Cool, I'm super happy for you.  GetDataBack? It doesn't ring a bell, but I'll keep it in mind to try it when I get the chance, that's for sure!!!  (Yeah, I’d also make an image in that case, you're right!)  Well, no problem, cousin ;-)  Alright, I'm packing my bags before going to sleep, and I'm leaving early tomorrow morning for 4 weeks.  Have a good evening and a great weekend!  Best regards,  Constantin.

Windows/system32/config/system not found

49 answers

Reinstallation of w11 impossible after pc crash...

Download impossible for visual petanque

Connect external dvd player to samsung tablet

Phone not receiving certain sms

Images from videos - retrieval

Chkdsk /f and sfc /scannow okay, but startup impossible.

Recover deleted messages

How to change your phone number on le bon coin

Lost tnt channels (via antenna)

Taskbar that hides