Corrupted regsutry recovery problems for Windows XP on system restore

Question

Hi. Had a spyware (Trojan) killed by the virus cleaner but upon restart it gave me a famous lsass.exe error about an application, which could not be terminated. Went on and read http://support.microsoft.com/kb/307545 but when tried to start recovery from Windows XP CD-ROM,  the command "copy c:\windows\repair\system c:\windows\system32\config\system" did not work. Eventually was able to load the system from the CD-ROM but then could not pass part 2 (safe mode after rebooting) as the administrator password has been changed. I have run  NT Password and Registry Bootdisk from USB to remove the administrator password but when tried go back to recovery console from Windows XP CD-ROM, the computer powers off right before I select "R"-option to start the recovery console. When I do not use the CD-ROM and try to power on in a safe mode, it gives BSOD. How do I get to corrupted registry if I cant get to recovery console and system restore?
Any help is appreciated. I have run a system diagnostics and start-up test has passed but on hard disk test I get to 10% of comprehensive only and then it seems to take indefinite.
This question was solved.
View Solution.

Answer 1

How to do a Manual SYSTEM RESTORE in XP, this should fix the missing or corrupt config file.
A. Connect your non-bootable hard drive to another computer, as a secondary drive or use a usb adapter or enclosure, If you can see your data on the drive, back it up Now, then follow the rest of these instructions.
B. Open Windows Explorer. Click on Tools|Folder Options|View. Check the box beside "Show hidden files and folders". Apply your change.
NOTE
D: may not represent the hard drive you connected to your PC, it may be E: or F: or G:, it all depends on how many other drives (including cd/dvd) you have in your host PC, So substitute the appropriate drive letter in the instructions below.
C. Navigate to the D:\System Volume Information folder. You will see a folder named something like _restore{.........} the dots represent an alpha-numeric sequence.
In this folder you will see folders named RP0....RPnn. Find the one with the highest number.
These are your System Restore points. In the highest numbered folder you will see a folder named snapshot. In this folder are registry hive files which you need to recover your system:
_registry_user_.default 
_registry_machine_security
 _registry_machine_software 
_registry_machine_system 
_registry_machine_sam
D. Create a subdirectory; i.e, D:\Windows\TMP. Copy these files to the TMP subdirectory. Rename them to:
default
security
software 
system 
sam
Note Be sure to lose the period (.) in the file named _registry_user_.default
E. Delete the files in the D:\windows\system32\config subdirectory with the same short names.
F. Copy the D:\windows\tmp files to the D:\windows\system32\config. subdirectory.
G.Put your drive back in its original system. Your system should start normally. If you get the same error repeat the procedure and choose another folder ( RPnn) (next highest number).
You can repeat this procedure choosing lower RPnn numbers until you get it booting again.
If you are denied access to any folders you will have to take "Ownership" of the folders first. http://support.microsoft.com/kb/308421
If this procedure fails to work you need to repair or reinstall Windows.