"The registry cannot load the hive" - Corrupted XP registry

Posted by: Brad Waite

Tagged in: Untagged 

I nearly toasted my XP machine today.  Somehow, between installing some software, running a keygen that may have infected my machine with a virus, running a system restore and installing the latest updates, the software hive of my registry became corrupted.

On boot, I'd get a BSOD with the following error:

Stop: c0000218 {Registry File Failure}  The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate.

Microsoft has a KB article on how to fix this.  Here's there 3-step process in a nutshell:

  1. Boot into the Recovery Console from the XP CD; backup your registry files that are in \windows\system32\config; copy new registry files from \windows\repair in their place.
  2. Boot into XP, copy registry files from a previous System Restore point from \System Volume Information to a temp dir in \windows.
  3. Boot into the Recovery Console again and copy the files from the temp dir into \windows\system32\config.

For all intents and purposes, that does a manual System Restore.

In my case, there were no previous System Restore points (Step 2)  in my C:\System Volume Information, even though I *know* had nightly backups that I'd seen when I did the System Restore at the start of this mess.  So I was stuck.

I tried to skip Step 3 and just boot into XP with the hives from \windows\repair, but I could only log in as administrator on the local machine; my domain user wasn't recognized.

At this point I felt I had nothing to lose, so I copied all of my original hive files back to \windows\system32\config except for the software hive, which was still the "repaired" one.

I can now boot into XP normally and most of my system works.  I got a SQL Server error on boot, a few programs I had previously uninstalled are showing up in my Add or Remove Programs list, but other than that, things seem okay.   My Windows Installer seems broken and reports "The Windows Installer service could not be accessed", but I'm working on that now.

I'll post the results of that fix in another article.

Comments (0)Add Comment

Write comment
You must be logged in to post a comment. Please register if you do not have an account yet.

busy