[SOLVED] Windows 7 boot BSoD - Corrupt Registry?

C

Cormy1

Active member
Joined
Sep 10, 2024
Posts
38
Some context leading up to BSoD:
C

Thread 'Missing Manifest Files'

First off, the Forum Posting Instructions have dead links so sorry if I'm posting wrong.
#2 the "main" issue I'm having right now is with my router apparently not providing DHCP to my PC all of sudden (just my Windows 7 installation) and Windows diagnostics isn't helping me.
#3 the installation I am currently working with was recovered from a dying hard drive that was over 10 years old and so has LOTS of little issues here built up here and there. I am avoiding a repair install at this time because I know it counts as an upgrade and therefore disables sysprep, not to mention you aren't...

BSoD:
https://www.sysnative.com/forums/attachments/img_20241121_163159435-webp.111968/

Startup repair result:
https://www.sysnative.com/forums/attachments/img_20241121_163848273-webp.111967/
 
I don't normally help out with Windows 7, it's an unsupported OS now, but that 0x7B bugcheck in the blue screen you posted is an INACCESSIBLE_BOOT_DEVICE. That would seem to be related to this...
#3 the installation I am currently working with was recovered from a dying hard drive that was over 10 years old and so has LOTS of little issues here built up here and there.
Click to expand...
If you're working with a known suspect HDD then, well, why?
 
ubuysa said:
I don't normally help out with Windows 7, it's an unsupported OS now, but that 0x7B bugcheck in the blue screen you posted is an INACCESSIBLE_BOOT_DEVICE. That would seem to be related to this...

If you're working with a known suspect HDD then, well, why?
Click to expand...
I'm not working with a suspect HDD, I said the installation was RECOVERED from the dying hard drive.
As in contents of the drive were imaged/backed up and cloned/burned to another drive.
xrobwx71 said:
Start here: Blue Screen of Death (BSOD) Posting Instructions - Windows 11, 10, 8(.1), 7 and Vista

Skip any steps you've already completed.
Click to expand...
The system cannot be booted into, therefore no changes can be made to the dump settings, nor can the program be run from the system that is impacted.
Unless you're telling me the program will work on offline systems, that's not an option.
 
Load the system hive.
Then launch the following command from an elevated command prompt, zip the file you'll find on your desktop and upload it here.
Code: 
reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services /s /t reg_dword /v start > "%userprofile%\desktop\services-start-values.txt"

NB: In the reg query command, you have to change "SYSTEM" with the name you gave to your loaded system hive.

Are you able to reach safe mode?
Were you able to boot that machine with that disk at least once?
 
Last edited:
Cormy1 said:
I'm not working with a suspect HDD, I said the installation was RECOVERED from the dying hard drive.
As in contents of the drive were imaged/backed up and cloned/burned to another drive.
Click to expand...
Same question really. If the source drive was known to be failing then why clone it? It would have been far wiser to clean install to the new drive and then try and recover any user data from the failing drive.
 
ubuysa said:
Same question really. If the source drive was known to be failing then why clone it? It would have been far wiser to clean install to the new drive and then try and recover any user data from the failing drive.
Click to expand...
I recently ran into this very thing at work. Cloned all the damage as well as the good.
 
xilolee said:
Load the system hive.
Then launch the following command from an elevated command prompt, zip the file you'll find on your desktop and upload it here.
Code: 
reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services /s /t reg_dword /v start > "%userprofile%\desktop\services-start-values.txt"

NB: In the reg query command, you have to change "SYSTEM" with the name you gave to your loaded system hive.

Are you able to reach safe mode?
Were you able to boot that machine with that disk at least once?
Click to expand...
How can I load the system hive of the unbootable system?
Safe mode produces the same BSoD.
The linked thread in the OP is me booting into that system with that disk in order to troubleshoot it. Somewhere along the way (October 6th as seen in the logs), it became unbootable. Therefore my current assumption is that one of the troubleshooting steps caused the registry corruption. It was booting "just fine" before then.

ubuysa said:
Same question really. If the source drive was known to be failing then why clone it? It would have been far wiser to clean install to the new drive and then try and recover any user data from the failing drive.
Click to expand...
Because it contains more than just user data and it's a pain to re-create the config of a 10+ year old system? Until every program I use becomes portable and there's 1 Windows config file for me to recover so I don't need to reinstall them all and reconfigure them all, it's not a good option.
I had been routinely using it up until the drive got bad enough that it was impacting my ability to boot from it. Even so, the contents I recovered produce an image that can be booted into just fine. I had like a >99.99% recovery rate with a total bad cluster size of only about 1MB across a 1TB drive, and based on the bad cluster location and the file table I can see exactly what data was impacted. VERY little was impacted.
It's not the source data that is the problem here. The problem was CREATED while following sysnative troubleshooting steps in the linked thread.
Now I'm looking to undo that damage, rather than restoring the backup AGAIN (already did it twice due to someone else in the house interrupting one of the troubleshooting steps and corrupting the system) and going through "most" of the troubleshooting steps AGAIN, hoping I stop before I make the system unbootable AGAIN.

I recently ran into this very thing at work. Cloned all the damage as well as the good.
Click to expand...
Damage can be repaired. I had a bootable system, I was repairing it. One repair step made it unbootable and now I'm going to repair it some more.
 
Last edited:
Cormy1 said:
How can I load the system hive of the unbootable system?
Click to expand...
From the recovery environment or from another machine with "reg load".
Cormy1 said:
Safe mode produces the same BSoD.
Click to expand...
Even safe mode with command prompt?

By the way, there could be an easier way.
From safe mode with command prompt or from the recovery environment, you can navigate to C:\Windows\System32\config and check the sizes of their backups in the regback folder:
Read More:

If the backups dates are older (than the current corrupted ones) and their sizes are greater than 0 (zero,nought), you can replace the corrupted ones with these backups.
You can also create a backup of the current corrupted files (before the replacement, obviously).
There's a tutorial, if you prefer: Manually Restore the Registry From its Backup in Windows (Windows 7 / Vista)
 
Last edited:
Cormy1 said:
Damage can be repaired. I had a bootable system, I was repairing it. One repair step made it unbootable and now I'm going to repair it some more.
Click to expand...
Dependent on the repair, for instance a bad sector, when a sector is bad and you run a repair, it keeps that sector flagged as bad and will write the data in that sector to the next good sector it finds regardless of what's there. It will overwrite good data and doesn't know the difference between a boot file or a picture.
If you have multiple bad sectors and I'm willing to bet you do with a 10 year old drive, a lot of good data gets overwritten and take a ton of time and effort to repair if it can be at all.

You would spend less time clean installing and re-installing programs than it's going to take to repair the repairs.
 
Whilst I appreciate that you say that "VERY little was impacted" it's fruitless IMO to try and debug a system cloned from a known flaky drive. I do understand the desire not to have to reinstall and reconfigure everything again but if your goal is a stable system then a clean install onto the new drive is the only reliable way - especially when the original drive is known to be flaky. It's fine to try and recover user data from there, but not to clone Windows.

When debugging dumps for example, we start with the (reasonable) premise that all Windows modules and drivers are good - mostly because they are, but also because we have no way to debug them - Microsoft don't make the internal symbol files of Windows available. We are thus usually looking at bad third party drivers, misconfiguration, and bad hardware as potential causes. The problem I have in trying to debug your problems is that because it was cloned from a known flaky source drive I cannot be certain that all your windows modules and drivers are good. Neither you nor I know whether the glitches on the source drive corrupted Windows modules and drivers and so the premise with which we typically begin doesn't hold in your case.

In all honesty I don't think I can help you. Others, who understand Windows internals far better than I might be able to assist.
 
xrobwx71 said:
Dependent on the repair, for instance a bad sector, when a sector is bad and you run a repair, it keeps that sector flagged as bad and will write the data in that sector to the next good sector it finds regardless of what's there. It will overwrite good data and doesn't know the difference between a boot file or a picture.
If you have multiple bad sectors and I'm willing to bet you do with a 10 year old drive, a lot of good data gets overwritten and take a ton of time and effort to repair if it can be at all.

You would spend less time clean installing and re-installing programs than it's going to take to repair the repairs.
Click to expand...
I'm not doing a file system/table repair. There are no bad sectors. I am not dealing with a 10 year old drive. Read the thread. Moreover the disk does not blindly overwrite data, they have spare sectors specifically for that problem and they certainly don't overwrite data already indexed in the file table.
ubuysa said:
When debugging dumps for example, we start with the (reasonable) premise that all Windows modules and drivers are good - mostly because they are, but also because we have no way to debug them - Microsoft don't make the internal symbol files of Windows available. We are thus usually looking at bad third party drivers, misconfiguration, and bad hardware as potential causes. The problem I have in trying to debug your problems is that because it was cloned from a known flaky source drive I cannot be certain that all your windows modules and drivers are good. Neither you nor I know whether the glitches on the source drive corrupted Windows modules and drivers and so the premise with which we typically begin doesn't hold in your case.

In all honesty I don't think I can help you. Others, who understand Windows internals far better than I might be able to assist.
Click to expand...
I don't know what you qualify as modules but again, I had a bootable system. SFC+CheckSURT were run without error (after feeding it necessary manifests) and as far as I'm aware that's how you tell your Windows integrity is good.
This BSoD didn't occur after cloning the bad disk. It occurred after running troubleshooting steps in the originally linked thread.

xilolee said:
From the recovery environment or from another machine with "reg load".

Even safe mode with command prompt?
Click to expand...
Yes, even Safe Mode with Command Prompt. I see it load the Windows Files and then the same BSoD shows up.
Still not certain what I would be pointing to with "reg load"
The Microsoft documentation seems to suggest that you can point to a "computer name", but I don't believe that applies when merely accessing a different drive within the same computer. The drive itself has no computer name, rather it's the Windows installation that would and I don't feel Windows would search for that in all the drives connected to it. This isn't remote access; it's offline access.
If you think manually restoring the registry backup is the easiest/best first option I can definitely do that much.
 
Cormy1 said:
Still not certain what I would be pointing to with "reg load"
The Microsoft documentation seems to suggest that you can point to a "computer name", but I don't believe that applies when merely accessing a different drive within the same computer. The drive itself has no computer name, rather it's the Windows installation that would and I don't feel Windows would search for that in all the drives connected to it. This isn't remote access; it's offline access.
If you think manually restoring the registry backup is the easiest/best first option I can definitely do that much.
Click to expand...

Yes, it's possibile to get a registry from a non-working drive, load it in the current registry, change the problematic entries (IF you know them), unload it.

But in your case, it's easier to use the registry backups.
 
xilolee said:
By the way, there could be an easier way.
From safe mode with command prompt or from the recovery environment, you can navigate to C:\Windows\System32\config and check the sizes of their backups in the regback folder:

If the backups dates are older (than the current corrupted ones) and their sizes are greater than 0 (zero,nought), you can replace the corrupted ones with these backups.
Click to expand...
All of the config and regback folders are identical in date and size EXCEPT 1: software
The software folder is older in regback and non-zero.
Restoring the backups resulted in no change to my symptoms.
 
Cormy1 said:
All of the config and regback folders are identical in date and size EXCEPT 1: software
The software folder is older in regback and non-zero.
Restoring the backups resulted in no change to my symptoms.
Click to expand...

I re-read your previous topic.
You used tweaking.com windows repair 4.14.0 free, 32nd and 33rd post, 5 October.
It created a regback folder in C:\RegBackup\Your-PC-Name\DATE_HOUR\C\WINDOWS\System32\Config.
Therefore, before the problem happened, you have got older reg files.
Try those ones, without drivers and components.
If it fails, re-try also with drivers and components.
 
When you say drivers and components, do you just mean the components files? I see no file labeled drivers.
The dates on the current files are older than those in the Tweaking.com backup, is that fine?
It seems none of the dates on those files changed when I had copied the regback files over them, except maybe the software one. Does that mean they were identical?

If you REALLY want to restore those files to before the problem happened, I can mount the image of the disk backup and pull the files from there if need be. That way I wouldn't need to go through the hassle of restoring the entire disk backup and re-running fixes if the Tweaking.com backup doesn't work.
 
Tweaking.com Windows repair created a backup with those hives, in my computer.
I.e., default, Sam, security, software, system, drivers, components.

It should bring your pc back to that date.
 
Okay it got past the point of throwing that BSoD, I should be able to get in now (I haven't because there is another different BSoD that is thrown but this one is familiar to me and I don't believe can be solved. It also produced a crash dump)
What exactly would you say was undone by restoring those backups? Everything the Tweaking.com application had done?
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top