I have a major problem. Spybot Search and Destroy had finished scanning my computer (Dell Dimension e520 running Windows XP service pack 2). I then clicked on it to fix the problems it found, and started doing something else on Tradestation. A short time later, a message popped up on my screen that I had never seen before. It basically said there was a system fault, that my computer was going to reboot in 60 seconds, and that I should save all my work. The only thing I remember about the message was that it said something about "NT" system fault or error fault or something like that and a timer counted down from 60 seconds. There was no way for me to cancel it. A separate message from Spybot also popped up. I don't recall what it said other than it asking me if I wanted it to start automatically before everything loaded up the next time I started my computer because of something it had found or that had occurred. But I wasn't able to click OK before the time ran out because I was too busy trying to figure out why I was getting these messages and save my work at the same time.

My computer then rebooted. However, while Windows was loading, it stopped and gave an error message stating that a particular file (hal.dll) was missing or corrupt. On my computer I have the hard drive partitioned into two drives, C: and E:. Both have Windows XP on them, but the E: drive is the drive where I do all my work. My original intent was to place XP on the C: in a much smaller partition and do all my work on E:, but I mistakenly installed XP on E: at the time, so I went back and installed XP on C, but didn't do anything about the install on E. When I reboot my computer, it asks me from which drive I want to start XP. If I don't choose one, it automatically selects the C: drive, which is the one I always choose anyway. When I got the error message above, I inserted my reinstallation XP CD that came with the computer and did a repair (NOT the Recovery Console repair, and after I hit F8 to agree with the licensing page, I made sure I pressed R for Repair instead of ESC for a clean install.

However, when my system rebooted automatically after the "repair" was done, and I chose to boot Windows from the C: drive, Windows loaded up as if it was a brand new install. Everything from my normal start up configuration was gone: all of my icons were gone, none of the programs that normally run on start up were executed, only one monitor of my multimonitor setup was being displayed, etc. In addition, almost all of my devices were labeled as unknown devices in Device Manager. My cable modem wasn't recognized so I had no Internet connection (I'm writing this from my laptop, which has a wireless connection to the modem). My video card wasn't recognized, so now my max resolution is only 1024 X 786. In addtion, I tried to install one of the devices by trying to reinstall the drivers, but it doesn't give me the option of choosing E:, which is where they are located, stating that E: is unavailable. When I tried to start a couple of my programs, it started me off with trial versions and asked for my registration key in order to access the full version, which I did successfully. When I looked at my directories, they all appeared to be intact along with the files they contained. However, when I clicked on My Documents, none of my documents showed up as they did before. But when I went to the Documents and Settings directory on my E: drive, they were all there. When I compared the Windows directories of the C: drive where the "repaired" install occurred and the E: drive, with which I had done nothing, I realized that I wasn't missing just one file, but several hundred files across multiple directories in the Windows directory on the E: drive. I suspect the virus or whatever it was that caused the system crash deleted those files on both C and E. Also, all of the files that should be present in my system32/systemprofile directory on E: are gone. When I rebooted again and tried to start Windows from the E: drive, I got the same error message while Windows was loading that I got before I repaired Windows on the C: drive.

Is there any way I can restore my system to the way it was before all this happened? I tried to do an XP repair on the E: drive like I did with the C: drive, but the reinstallation CD only gives me the option of repairing the already repaired Windows XP that resides on C. I doesn't recognize the one on E, although booting the computer without the CD gives me the option of booting to XP on the E: drive. Should I copy the files located in the system32/config directory on E, which were last updated when I got the system fault reboot, into the same directory on C: to try to restore my configuration or the ones located in my System Mechanic directory when I did a back up several months ago into that same C: directory, or would this lead to further prorbems? It will take me forever to figure out how to reestablish my Internet connection, reinstall all of my hardware (I didn't even get any "found new hardware" messages when Windows booted after my "repair") and software and then reinstall any upgrades to those. I am in dire straits here. Any help would be greatly appreciated.

Dani AI

Generated

A concise recovery plan that complements ’s suggestion and reduces risk of making the situation worse.

First steps (do not make changes yet)

  • Create a full image of both physical disks to an external drive or another PC. If imaging tools are not available, copy the entire user folders off the E: partition first. Imaging preserves a rollback point if a later step damages the installation.
  • Work from offline media (XP Recovery Console, a WinPE/BartPE disc or a Linux live CD). That keeps both drives intact while inspecting and copying files.

Safe, ordered recovery attempts

  • From Recovery Console / WinPE, inspect the E: installation and the copy of the registry/setup data that the XP "Repair" process keeps. Back up every file in the target system32\config folder (rename or move them) before doing any replacement. Restoring those registry hives from the repair snapshot can bring services, drivers and user profiles back — but only do it after an image is taken.
  • If the E: install does not appear in the boot menu, use the Recovery Console commands to detect and repair boot entries and the master boot record, then check the file system:
bootcfg /rebuild
fixmbr
fixboot
chkdsk e: /r

After booting (if successful)

  • Run System File Checker from the working Windows with the original XP disc present: sfc /scannow to restore any missing system DLLs (make sure the CD matches the installed service pack). Reinstall device drivers from vendor installers rather than relying on Plug-and-Play guesses.

If the above fails

  • Recover user data and perform a clean reinstall of XP, then restore user files and reinstall drivers/applications. Mixing registry hives from differently patched installs (different service packs or different installs) can cause further instability, so avoid that unless images/backups exist.

Notes and cautions

  • The registry-hive restore is a standard technique (as noted) but is risky without a disk image. Keep original media (XP + slipstreamed SP if present) and driver installers ready. If professional recovery is required, stop and use the image when consulting a repair specialist.

When you do a Windows Repair some of your registry is saved into Windows\repair directory. Now I do not know exactly which bits of registry are saved, but it will [should] not hurt for you to try this:
Go to Windows\repair, copy over to Windows\system32\config these files:
sam
security
software
system
default
ntuser.dat
And then restart.
You might consider saving the newer versions already in \config to a scratch pad file.
Say what happens. Worst case is another Repair job.
It all depends, I suppose, upon where the original fault occurred.
And once back on the road, get something like ERUNT... it gives you COMPLETE system backups, unlike the incomplete efforts of Windows Sys Restore.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.