HowTo: Fix Corrupted Windows Registry from Ubuntu partition

[ZenStephanie]

Thank you, thank you, thank you to the OP of this thread.

My Windows machine crashed and I could not get Windows back up and running after numerous attempts. I was able to use testdisk to do some repair of the Windows boot sector, but this fix is what ultimately got me back in.

Once again: THANKS!!

[wonderl]

@melnichuk: Thanks a lot for your little tutorial! With "delallv" (delete all values) and "dk" (delete key) i was able to delete the malicious key "\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe". For making this key-removal persistent, I had to use chntpw with the "-e" option, i.e.:

$ chntpw -e /media/windows/Windows/system32/config/software

$ cd \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe

$ delallv

$ cd ..

$ dk userinit.exe

$ q

After quitting ("q"-command) I chose "y" to write back the registry change.

Here is some info on how to use chntpw: http://pogostick.net/~pnh/ntpasswd/regedit.txt

Thanks and Regards,
wonderl

[sstvinc2]

Great how-to. Just wanted to give a bump to keep this around. Just used it to perfection. I did run into trouble unmounting the windows disk and running ntfsfix, but it didn't even matter. Everything booted just fine.

[tcdoe]

wow.
thanks SO MUCH.

i had this problem and tried practically every solution. almost gave up and reformatted. but then saw your post and it worked.

the only difference was that the ntfsfix step wouldn't work because im running a WUBI ubuntu and the disk is not 'unmountable' and couldn't set the fix.

still, your solution worked and i was able to boot into windows and now i'm running a chkdsk /r and it's finding lots of problems but looks ok.

again,
thx,
t.

[anantha89]

I run a dual boot on my work laptop because there are some work related apps that do not run so well
on my ubuntu partition. Anyhow I ran into the dreaded

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

error message. I tried to follow the solution that Microsoft has available on their tech support site, but
was not able to get to the recovery console, not even through the boot cd!!

The steps below are how I fixed the problem!

• Install NTFS-3G
  
  This package allows you to perform I/O on an NTFS filesystem.
• Install NTFSProgs
  
  This package contains some useful admin tools to use on NTFS filesystems
• Mount NTFS filesystem
  
  You will need to mount your Windows partition to backup your corrupted registry files. To do this run the following commands
  

  sudo mkdir /media/windows
  sudo ntfs-3g -o rw /dev/<device-name> /media/windows
  

  if you get a message regarding Windows not being shutdown properly, then run the following command to force the mount

  sudo ntfs-3g -o force,rw /dev/<device-name> /media/windows
  
  Both of the above commands will mount the device as read-write.
  
• Replace these files
  
  You might want to back up the files in /media/windows/WINDOWS/system32/config/ before replacing them just in case this is not a registry problem
  Now copy the following files from the file /media/windows/System Volume Information/_restore{xxx}/RPxxx/snapeshot/ dir:
  

  
  _REGISTRY_USER_.DEFAULT
  _REGISTRY_MACHINE_SECURITY
  _REGISTRY_MACHINE_SOFTWARE
  _REGISTRY_MACHINE_SYSTEM
  _REGISTRY_MACHINE_SAM

  to the /media/windows/WINDOWS/system32/config/ dir and name them as follows:
  

  
  _REGISTRY_USER_.DEFAULT => default
  _REGISTRY_MACHINE_SECURITY => security
  _REGISTRY_MACHINE_SOFTWARE => software
  _REGISTRY_MACHINE_SYSTEM => system
  _REGISTRY_MACHINE_SAM => sam
• Schedule a consistency check
  
  Run this command to schedule a NTFS consistency check for the first boot into Windows
  

  sudo ntfsfix /dev/<device-name>
• Reboot into Windows twice
  
  The first reboot you should get a blue screen telling you that you should run a filesystem consistency check. Let the check run and then the second reboot should bring you back into a bootable Windows

Hope this helps!!

Thanks a lot....

[Stop Being Such a TOONA]

I love you

[PcPro12]

Great tutorial. However, I got one question. If your computer has been used for months in a row with lots of software on it and you replace the "SOFTWARE" file in the register, you just erased your entire history of installed and working programs and I think the drivers as well, or they may be in the "SYSTEM" file or any other, I'm not sure about that one.

But anyway, my dad has a friend who has this exact problem and I used this method to fix it and the system started and ran like normal, except that firefox, malwarebytes, and any other program wouldn't work anymore, not even internet explorer and all drivers were gone. No display driver, no ethernet or wireless driver, no nothing.

The problem with this laptop is in the "SOFTWARE" file, so I might as well leave everything else alone, but is there a way to repair the problem without having to replace the file? Can I edit the file and remove something? the error code is STOP: C0000218.

P.S. Sorry for reviving an old topic, but this is right on with my problem, so I decided to post here, if no one minds?

Thanks,
PcPro12

[bsmith1051]

You should be glad you got his copy of Windows up-and-running again, at all. Can't you just re-run the installers for those apps?

As for alternate forms of repair, you didn't really give us much to go on -- and you should ask for Windows repair advice on a Windows forum, not here.

[chief_wrench]

just registered to let you know: works like a charm. made a friend of mine VERY happy.

[Pott]

Thanks so much for this! If that's ok I have a few questions (and sorry for zombie threading). This is the current situation
1) Can't even boot into windows, due to a corrupt registry
2) I can boot from Ubuntu on a USB-drive
3) I could not boot from a Windows recovery CD

I tried using this guide, however Ubuntu did not find NTFSProgs to install, and I also was not able to use the ntfs-3g command (''Failed to access volume '/dev/sdb/media/windows': Not a directory'')
I may have identified my drive device incorrectly though... Command run:

sudo ntfs-3g -o rw /dev/sdb/media/windows

Furthermore, when I use Nautilus to navigate into system volume information, there are no files in it.

Am I such a noob that I missed something obvious here? Is this method what could revive my beloved PC?

Ironically I don't download anything and never had a virus in my life... I've no idea how this happened.