System registry had to be recovered

January 16, 2009 at 11:39:40
Specs: XP Pro srv pk 2, Dual PIII500
Hi.

Im slowly going bonkers over this. I get the dreaded:

"One of the files containing the system's registry data had to be recovered by one of a log or alternate copy. The recovery was successful."

This comes up twice as soon as the login icons appear on startup. A beep is heard on each one. Sometimes itll appear once when doing something while logged in (but no beep). It appeared when I was doing a system restore point if thats a clue. :-/

I have ruled out the following:

* Ram is fine (tested with other sticks)
* HD is fine (ran chkdsk, defrag, maxtor disk utility and spinrite)
* Checked for the KB840987 hotfix which I dont have. Its been known to cause it.
* Disabled system restore and rebuilt virtual page file.
* Done virus and spybot scans.

Tried various "fixes" to no avail such as replacing the ntuser.dat with a new one, restarting then put the old one back.

What I have found though, is the error DOESNT come up if I disable one of the login account. Unfortunately its one I need.

Nothing seems affected by the error but its not good to have anyway.

So Im asking, can I somehow rebuild the registry settings for that disabled account or use some kind of logging to see what keys are affected?

Help much appreciated, Ive been at this for 2 days now!

Bill


See More: System registry had to be recovered

Report •


#1
January 16, 2009 at 12:04:44
Why not rename the local profile for that account to (Insert userid here). bad or .old.

Then, reboot and login as that user. The problem should be gone. If data is actually stored in the profile (not a good idea anyway), you'll want to copy that over to the new profile (or better yet another partition if possible) using an Admin account.

"So won’t you give this man his wings
What a shame
To have to beg you to see
We’re not all the same
What a shame" - Shinedown


Report •

#2
January 17, 2009 at 08:22:30
I would but I like to know what causes the problems in the first place.

Ive noted a couple of things.

I narrowed it down to the ntuser.dat file in the problem profile, that seems to be causing the problem. Im going to use a utility to view inside it and compare it to a copy of an older ntuser.dat from a clone drive to see what differences there are.

Also, it is lmost 20mb in size. But then so is the original one on the clone drive which works. Its about 700K smaller than the corrupt one. :-/

Bill


Report •

#3
January 17, 2009 at 11:22:34
Ok. Using the shareware Regdatxp, then using Repair Corrupt File, its found 6 keys with the following:

Number of Items : 6

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
Type : Bad child (316 - 0x8B9328)

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
Type : Bad child (316 - 0x8B9328)

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adatoms.com
Type : Bad child (316 - 0x5F0238)

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adatoms.com
Type : Bad child (316 - 0x5F0238)

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\defence-live-scan.com
Type : Bad child (316 - 0x7DB8E0)

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\defence-live-scan.com
Type : Bad child (316 - 0x7DB8E0)

Now, if I load the ntuser.dat into the regedt32 with the Load Hive, it doesnt apply anything to the current setup does it? Dont want it messing up my accounts!

I want to edit it and delete the offending keys and resave the ntuser.dat as another file.

Bill


Report •

Related Solutions

#4
January 17, 2009 at 15:53:23
Okay. Think Ive fixed it.

Using the useful utility called Regdatxp, I deleted the subkeys of HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

Apparently this is a list of blocked sites for IE. Using Spybot should replace the list with its own... hopefully.

So if u get the dreaded "One of the files containing the system's registry data had to be recovered by one of a log or alternate copy. The recovery was successful.", log into a different unaffected admin account, and load the ntuser.dat into Regdatxp (make a copy of the ntuser.dat as a backup just in case) and do a Repair Corrupt File on it. Hopefully itll tell u which keys are the problem ones. Delete the keys (or subkeys if it says "Bad Child (xxx-0xxxxxx)") and reboot. All should be cool once again. May have to rebuild the keys depending on which ones it was.

Or you could just make a new profile and all files except ntuser.dat, ntuser.ini and ntuser.dat.log. Youll have to do all your customising again which is why Id rather have done it my way! ;-)

Hope this helps someone.

Thanks

Bill


Report •


Ask Question