Antispyware 2011

tranmererovers

Grrrr, friend has just rang to say that the computer will no longer boot, it gets to the loading windows screen and then reboots again, it won't load in safe mode either.

I have a Bart PE disc with win xp home SP2 - created it about a year ago, do I need to create a new one or from that will I be able to firstly try and repair windows using the recovery console and secondly am I correct in thinking that if I connect a portable drive before I boot, I should be able to copy files off the hard disc and onto it thus trying to secure his personal data?

If anyone can point me in the direction of easy instructions for either of these too that would be great.

Browntoa

may kill the infection

http://www.avira.com/en/support-download-avira-antivir-rescue-system

closed

You should be able to copy files off with the bartpe, and possibly fix the problem, depending what it is.

tranmererovers

Thanks Browntoa and Closed.

I've left my mate with the Bartpe disc securing all his data to dvd's - he's happy that he can get to all his pictures and has learnt his lesson about backing up his data!!!!

I tried the avira scan which ran through but made no difference to boot up. I have tried safe mode, normal and last known good configuration to no avail it gets as far as the loading windows screen and then reboots. I have also done a restore using the ultimate boot cd and the registry restore wizard which didn't work either Anyone have any pointers on what may be causing it to fail to load and what I can try to fix it please. I thought there was a windows recovery console in there somewhere but it eluded me

Bogtrotter

If there is no dialogue from the computer stating specific files missing I would hazard a guess that possibly some of the registry hives have become corrupted.

You can attempt manual rebuild of the registry from backups automatically created by windows or from system restore points either by DOS through Windows Recovery Console or by GUI through BartPE or similar.

You should find a guide if you google "manual registry rebuild"

Browntoa

agree with bogtrotter , its only 5 registry files from the restore points that need copying over

tranmererovers

I've already tried the registry restore wizard on the ultimate boot cd and gone back a week, is what you are suggesting something different? Thanks

Bogtrotter

tranmererovers wrote: »

I've already tried the registry restore wizard on the ultimate boot cd and gone back a week, is what you are suggesting something different? Thanks

I'm unfamiliar with the software you are using on the CD. Does it require to load a system in order to do a restore like ERD? If so since the original registry is corrupt it may not be unable to load an installation properly to restore.

I tend to do things manually.

If you look on your own machine as a guide... open Windows Explorer click on the "Tools" menu and select "Folder Options"... on the view tab select "show hidden files and folders" and uncheck "hide protected operating system files"

Navigate to c:\\windows/system32/config/ there you will see 5 files default, SAM, SECURITY, software and system and backups of these files (same names but with a suffix .bak), these are registry files.

In the first instance on your friend's machine using Recovery Console (if tou're handy with DOS) or BartPE to rename the original files by adding .old suffix and remove the .bak suffix from the backup files. Try to boot machine.

If that doesn't work and you have system restore turned on you can get the registry hives from c:\\System Volume Information/_restore folder...

Here there are folders all beginning RP... pick one of the more recent ones and inside is another folder called Snapshot...

Inside the snapshot folders you will find copies of the 5 registry files only with longer names...

Use Recovery Console or BartPE to copy these files to c:\\windows/system32/config/ and rename them to default, SAM, SECURITY, software and system.

tranmererovers

Thanks bogtrotter, I should be able to navigate round those instructions, will try and pop back round there tomorrow so will return with an update