Registry Restore for all occasions

I attended a call out where a computer had been hacked, and SYSKEY encryption had been done as detailed here. Up until now, allowing the computer to get into recovery mode and restoring the registry works a treat, but in this case, the registry was also corrupt, and there was no administrator account. So I could not do a system restore or get into the CMD line mode.

I also recently had a case of “Bad System Config Info” error, which proved tricky to fix, but while researching it I came across this page.

The last method on this page is the one I really liked, as it works in almost any situation. It basically restores the registry from the regback directory. The nice thing is it works from recovery mode, but where that isn’t possible due to lack of administrator account, it also works from a Windows repair disk.

For my easy reference the steps are repeated here.

1. Reboot your computer until you see ‘Preparing Automatic Repair’. It usually takes three attempts to get this message. Or, if this does not allow you to proceed, boot from an operating system disk, and go into the Repair PC function rather than install.
2. Select Advanced options, then Troubleshoot, Advanced options and Command Prompt.
3. Type or paste ‘cd c:\windows\system32\config’ and press Enter. If c: is not the system disk, try D:
4. Type or paste ‘MD backup’ and press Enter.
5. Type or paste ‘copy *_* backup’ and press Enter. The window will show the files as they are copied. Wait for them to finish before proceeding.
6. Type or paste ‘CD regback’ and press Enter. You should see copies of your registry files with a number next to them. If that number is no 0, continue.
7. Type or paste ‘copy *_* ..’ and press Enter.
8. You will be asked to confirm copy, type ‘a’ and press Enter.
9. Reboot your PC.

This has been a life saver twice now, hence it gets its own page!