Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

C:\windows\system32\config\system file is missing or corrupt


  • Please log in to reply
17 replies to this topic

#1 Garval

Garval

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 26 January 2012 - 11:05 AM

Hi there guys,

I'd really appreciate your help with the following. I've been struggling with this C:\windows\system32\config\system file is missing or corrupt issue for a couple of days, and still haven't been able to resolve it. I've followed the steps recommended in this tutorial http://www.help2go.com/content/tutorials/28-c-windows-system32-config-system-missing-corrupt.html

This is what I've done so far:
I've got a copy of KNOPPIX and managed to recover the files I needed the most.
I used the iso.image file to boot my desktop and get into the console recovery utility.
I ran chkdsk (/p and /r) on both C:\ and C:\Windows and both managed 100% completion. I rebooted it, but got the same message:Windows could not start because C:\windows\system32\config\system file is missing or corrupt.
I run Option 3, but there were no Restore Points, none whatsoever!

I do not know if there is something else you could recommend I should do.

Another question: is it possible that the internal hard disk is damaged? My hard disk is a Seagate Barracuda. I'm wondering if I could download Seagate diagnostics tool, here:

http://www.seagate.com/ww/v/index.jsp?locale=en-US&name=seatools-win&vgnextoid=552bd20cacdec010VgnVCM100000dd04090aRCRD


via Iceweasel (the internet facility of KNOPPIX Linus Live CD) and then run it to check my desktop internal hard disk. If so, how?

Thank you in advance for any advice you can give me to resolve this issue.

PS Please, keep in mind that my knowledge is very basic.

Garvaluk - London

Edited by Garval, 26 January 2012 - 03:29 PM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:56 AM

Posted 26 January 2012 - 11:29 AM

System manufacturer and model?

Did you check the support pages which might exist at the website of the system manufacturer?

<<I've been struggling with this C:\windows\system32\config\system file is missing or corrupt issue...>>

Corrupted Registry, Config.sys Missing or Corrupt - http://support.microsoft.com/kb/307545 . I believe that the first source of guidance conerning such problems with Windows...should always be Microsoft, not some blog by an entity who may or may not know what he/she is quoting.

<<...is it possible that the internal hard disk is damaged?>>

Of course it's possible...artifacts are not without human error and even if they were...they can become damaged.

It's also possible that your file system is damaged. Since it is the foundation for the install of Windows...if I wanted to consider all possibilities, I would include it.

Rather than look for extraordinary explanation for what is wrong...I'd investigate the documented problem as described by MS. If I could determine that it the explained behavior has a cause that is not reflected in said documentation...then I would consider things like hardware and malware.

Louis

#3 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 26 January 2012 - 02:30 PM

My hard disk is a Seagate Barracuda. I'm wondering if I could download Seagate diagnostics tool ...

Yes, that is a good first step. However, the link you posted is to SeaTools for Windows: What you actually need to use is SeaTools for DOS. You can download this and burn to CD using Knoppix.
==========

Test a Seagate manufactured hard disk drive using SeaTools for DOS run from a bootable CD.

:step1: Please download SeaTools for DOS (CD) from Seagate's SeaTools for DOS web page

or use the following direct download link to download the latest version of SeaTools for DOS:
Download SeaTools for DOS ISO Image

The downloaded file name is SeaToolsDOS223ALL.ISO
[/list]
:step2: Burn the downloaded .ISO image to a CD using the appropriate burning software included with Knoppix.


:step3: Boot from the CD.
  • (You may need to access the BIOS Setup Menu or the Boot Menu and change the boot order to enable booting from CD before hard drive.)
  • From Basic tests on the Main Menu, run the Short test and then the Long test.

    (The long test will take some considerable time to complete.)
    The results will be shown as either a PASS or FAIL.
    There is a chance that during the Long test, you may be offered the opportunity to attempt repairs on the hard drive:
  • If so, go ahead and attempt to do so, but ONLY after backing up all important personal files.
[/list]Note: You may wish to view the following ...
Please let us know the results of the tests.

Edited by AustrAlien, 26 January 2012 - 02:34 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#4 Garval

Garval
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 29 January 2012 - 08:27 AM

Many thanks AustAlien for your advice. I've followed your instructions and performed the tests. The results were as follows:

1. Short Test: Passed
2. Long Test: Passed after repairs

I rebooted my PC and got the same message: Windows can't start...etc.
I then rebooted and accessed the console recovery, used chkdsk /r, rebooted and got the same message again: Windows can't start...etc.

Any suggestions?

Thanks again and look forward to your reply.

Garvaluk - London

Edited by Garval, 29 January 2012 - 08:27 AM.


#5 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 29 January 2012 - 03:07 PM

Long Test: Passed after repairs

Please repeat:
  • Short test
  • Long test
Let me know the result.

The repair should be checked: Many times, repeating the test after a "successful" repair will result in a FAIL which cannot be repaired.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 Garval

Garval
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 30 January 2012 - 10:06 AM

Thanks, AustrAlien. As per your advice, I run both tests one more time and both came out: PASSED. I then rebooted but the same message came up: Windows could not start... Any suggestions?

#7 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 30 January 2012 - 10:23 AM

That's good news on the hard drive at least!

You are in a bit of a pickle without any Windows system restore points.

You will need to have a look and see if you can find a suitable replacement for the corrupt SYSTEM file.

Please double-check with Knoppix:
  • What if anything, do you see in the location where the restore points should be if there were any?
    (Can you access and what do you see in the System Volume Information folder?)
  • Please list the contents of the config folder:
  • C:\windows\system32\config\
    Anything with SYSTEM in the name, such as SYSTEM.bak, provide details of date etc.
Did you ever create backups of the registry, for example by using ERUNT?
  • Look in the WINDOWS folder: Is there a folder there by the name ERDNT?

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#8 caperjac

caperjac

  • Members
  • 1,649 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NS. CAN
  • Local time:12:56 PM

Posted 30 January 2012 - 04:40 PM

the link in hanulis post about fixing missing or correct system file should work to get windows running again if that's all thats corrupt

Edited by caperjac, 30 January 2012 - 04:45 PM.

My answers are my opinion only,usually


#9 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 30 January 2012 - 05:20 PM

the link in hanulis post ...

Ah ... that's not the best suggestion Louis has ever made, but it's certainly not the worst! A couple of issues: The system may be a major brand (OEM) system, and attempting the suggestion may not be applicable or possible or worse yet, create even more problems and secondly, the OP has reported "there were no Restore Points, none whatsoever!" and if this is actually the case, then the suggestion falls short again.

Let's do a little more investigation so that when we do proceed with a course of action, we actually know what we are doing and what to expect for a result.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#10 Garval

Garval
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 03 February 2012 - 11:41 AM

Many thanks, again, AustAlien (and also to hamluis and caperjac). These are the folder lists.

SYSTEM VOLUME INFORMATION FOLDER

/media/sda3/System Volume Information/EfaData
/media/sda3/System Volume Information/_restore{A7264527-6F2D-40F0-913A-2A4D04DC3133}
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}
/media/sda3/System Volume Information/MountPointManagerRemoteDatabase
/media/sda3/System Volume Information/tracking.log

RESTORE{A7264527-6F2D-40F0-913A-2A4D04DC3133}

/media/sda3/System Volume Information/_restore{A7264527-6F2D-40F0-913A-2A4D04DC3133}/RP71
/media/sda3/System Volume Information/_restore{A7264527-6F2D-40F0-913A-2A4D04DC3133}/RP71/change.log

RESTORE {B1C538C0-CBA3-4434-A006-53A338B37653}

/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/encrypt.tmp
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP974
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP975
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP976
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP977
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP978
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP979
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP980
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP981
/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982

CONFIG FOLDER

/media/sda2/WINDOWS/system32/config/systemprofile
/media/sda2/WINDOWS/system32/config/AppEvent.Evt
/media/sda2/WINDOWS/system32/config/DEFAULT
/media/sda2/WINDOWS/system32/config/default.LOG
/media/sda2/WINDOWS/system32/config/default.sav
/media/sda2/WINDOWS/system32/config/Internet.evt
/media/sda2/WINDOWS/system32/config/SAM
/media/sda2/WINDOWS/system32/config/SAM.LOG
/media/sda2/WINDOWS/system32/config/SecEvent.Evt
/media/sda2/WINDOWS/system32/config/SECURITY
/media/sda2/WINDOWS/system32/config/SECURITY.LOG
/media/sda2/WINDOWS/system32/config/SOFTWARE
/media/sda2/WINDOWS/system32/config/software.LOG
/media/sda2/WINDOWS/system32/config/software.sav
/media/sda2/WINDOWS/system32/config/SysEvent.Evt
/media/sda2/WINDOWS/system32/config/SYSTEM
/media/sda2/WINDOWS/system32/config/system.LOG
/media/sda2/WINDOWS/system32/config/system.sav
/media/sda2/WINDOWS/system32/config/TempKey.LOG
/media/sda2/WINDOWS/system32/config/userdiff
/media/sda2/WINDOWS/system32/config/userdiff.LOG

Couldn't find an ERDNT folder. I can't remember backing up the registry, ever.

Edited by hamluis, 03 February 2012 - 06:11 PM.
Removed unnecessary quote.


#11 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 03 February 2012 - 03:39 PM

That is looking very promising. RPxxx represents a restore point, with the highest number being the latest restore point created. In that case, your most recent restore point appears to be:

/media/sda3/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982


What do you see when you open up the RP982 directory?
  • Do you see a snapshot directory?
  • Inside the snapshot directory, do see the following?
    • _REGISTRY_MACHINE_SYSTEM
    • _REGISTRY_MACHINE_SOFTWARE
    • _REGISTRY_MACHINE_SECURITY
    • _REGISTRY_MACHINE_SAM
    • _REGISTRY_USER_.DEFAULT
  • Please check the date shown for this restore point: You may need to look at the file/folder properties to ascertain the date they were created.
If that is all as I expect it to be, then you do have a Windows restore point, and the backup registry hives we can use to replace the corrupt one that is causing the problem.

Please let me know what you see.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 Garval

Garval
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 03 February 2012 - 06:08 PM

Below is the RP982 Folder list. The date of the files you ask about is 01/17/12

/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/Repository
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_NTUSER_S-1-5-21-351773030-2702520576-2308330453-500
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/ComDb.Dat
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/domain.txt
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SAM
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SECURITY
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SOFTWARE
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SYSTEM
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_.DEFAULT
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_NTUSER_S-1-5-18
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_NTUSER_S-1-5-19
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_NTUSER_S-1-5-19.bak
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_NTUSER_S-1-5-20
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_NTUSER_S-1-5-21-351773030-2702520576-2308330453-1006
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_USRCLASS_S-1-5-18
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_USRCLASS_S-1-5-19
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_USRCLASS_S-1-5-20
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_USRCLASS_S-1-5-21-351773030-2702520576-2308330453-1006
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_USRCLASS_S-1-5-21-351773030-2702520576-2308330453-500

Edited by hamluis, 03 February 2012 - 06:12 PM.
Removed unnecessary quote.


#13 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 04 February 2012 - 05:19 AM

/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SAM
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SECURITY
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SOFTWARE
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_MACHINE_SYSTEM
/media/sda2/System Volume Information/_restore{B1C538C0-CBA3-4434-A006-53A338B37653}/RP982/snapshot/_REGISTRY_USER_.DEFAULT

Excellent! These are the 5 files that you need to use to perform a complete registry hive replacement to 17th January, 2012 ("The date of the files you ask about is 01/17/12").

Boot from your Knoppix CD and perform the copy/paste and re-name operations in the following instructions. I expect that your computer will successfully boot to Windows when complete, and all will be well again.
========================

Off-line system restore using a LIVE CD

:step1: Navigate to C:\System Volume Information\
Inside that folder you will see a folder with a name beginning with "restore" followed by a long alpa-numeric code in brackets. Inside the "restore<bracketed long alpa-numeric code>" folder you will see a number of folders named "RP<3 digit number>". Choose the highest number: That is your most recent System Restore point.
Open the "RP<highest number>" folder and inside that you will see another folder called "snapshot". Finally, open the "snapshot" folder and you will be at this address ...
C:\System Volume Information\restore<bracketed long alpha-numeric code>\RP<highest number>\snapshot

Locate the 5 files that you need to copy from within the snapshot folder:

_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SAM
_REGISTRY_USER_.DEFAULT


Copy these 5 files from here, and paste into the "config" folder at following location ...
C:\Windows\System32\config <<< folder


:step2: In the "config" folder at C:\Windows\System32\config, locate the current registry hive files ...

system
software
security
sam
default

.... and re-name them by appending .old to the filename, so that they now look like this ....

system.old
software.old
security.old
sam.old
default.old


:step3: Still in the "config" folder at C:\Windows\System32\config
Re-name the files that you copied from the restore point:

_REGISTRY_MACHINE_SYSTEM ... rename to SYSTEM
_REGISTRY_MACHINE_SOFTWARE ... rename to SOFTWARE
_REGISTRY_MACHINE_SECURITY ... rename to SECURITY
_REGISTRY_MACHINE_SAM ...rename to SAM
_REGISTRY_USER_.DEFAULT .... rename to DEFAULT (You MUST remove the dot in front of DEFAULT)

You have now completed the system restore. Shut down the computer, removing the LIVE CD.


Does your Windows XP system start normally now?

Edited by AustrAlien, 04 February 2012 - 05:25 AM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#14 Garval

Garval
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 04 February 2012 - 11:36 AM

Does your Windows XP system start normally now?


Yes, it does! Thank you very much, not only for your help, which is a testament to your generosity, but for the way it was provided, with patience and clarity. If you ask me, it's a model of how help advice should be provided. Well done!

Just one thing, is there a way I can prevent this from happening again? I use PCMatic, shouldn't it take care of the registry?

Again, many thanks!

#15 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:01:56 AM

Posted 04 February 2012 - 03:18 PM

Thank you for your appreciative comments. I am pleased I was able to help.

I had to google "PCMatic" to find out what it was (and that is not a good sign in itself!). I am not inclined to waste any more time investigating PCMatic: Here are a couple of the search results that sum up it up adequately:

:step1: Let's run chkdsk and review the result.

Use the Windows Error Checking utility (Check Disk), with the options to fix file system errors and scan the disk surface for errors, attempt recovery of data and repair the disk.
  • Open "My Computer"
  • Right-click on the drive that you wish to check > Properties > Tools > and in the "Error checking" section, click on "Check now".
  • Place a tick in both boxes > Start.
  • If the disk you have chosen is the system disk:
  • A message will notify you that a restart is necessary: Click OK, and close all windows.
  • Re-start the computer. The disk will be checked when the system boots.
    This test will take some time to run and at times may appear stalled but just let it run.
  • When the disk check is complete, the system will re-start automatically and load Windows.

A log of the disk check is recorded only if the scheduled re-start is used, and only for drives on the same HDD as the Operating System.
To open Event Viewer and view the log:
  • Go to Start > Run > and type eventvwr and press the <ENTER> key.
    The Event Viewer window will open.
  • In the left pane, click on Application.
  • In the right pane, at the top, click on the column heading Source to sort the list alphabetically.
  • Look in the Source column for "Winlogon", with an entry corresponding to the date and time of the disk check.
  • Double-click on that entry to view the log.
  • Click on the Posted Image button to copy the log text to the clipboard.
  • Paste the log text into your next reply.

:step2: Use ERUNT to backup the Windows registry daily.
  • http://www.larshederer.homepage.t-online.de/erunt/
  • Download ERUNT and install it using the default settings.
  • That's all you need do: The backups will take place automatically.
  • This will backup the registry daily on the first occasion the system is started each day.
  • If necessary, the registry can easily be restored from a backup.

You asked: "is there a way I can prevent this from happening again?"
  • Avoid "un-timely" shutdowns which often result in disk file-system corruption of the sort that you have experienced.
    Examples of un-timely shutdowns:
    • Power failure.
    • Using the ON/OFF button to switch off the system, instead of the proper shut-down procedure.
    • System crashes.
  • Run chdkdsk after any un-timely shutdown to detect and repair file-system errors.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users