System hive is missing

Viruses and worms
1

Hi,
After running the Farbar i’m getting the FRST.txt with below content.
Can you please help out of this issue…

FRST.txt:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-08-2013 02
Ran by SYSTEM on 15-08-2013 17:46:37
Running from G:
WIN_7 (X64) OS Language: English(US)
Boot Mode: Recovery
Attention: Could not load system hive.
Attention: System hive is missing.

==================== Registry (Whitelisted) ==================

Attention: Software hive is missing.

ATTENTION: Software hive is not loaded.

==================== Services (Whitelisted) =================

==================== Drivers (Whitelisted) ====================

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

==================== One Month Modified Files and Folders =======

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\wininit.exe IS MISSING <==== ATTENTION!.
C:\Windows\SysWOW64\wininit.exe IS MISSING <==== ATTENTION!.
C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\SysWOW64\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION!.
C:\Windows\SysWOW64\svchost.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\services.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\User32.dll IS MISSING <==== ATTENTION!.
C:\Windows\SysWOW64\User32.dll IS MISSING <==== ATTENTION!.
C:\Windows\System32\userinit.exe IS MISSING <==== ATTENTION!.
C:\Windows\SysWOW64\userinit.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION!.
C:\Windows\system32\codeintegrity\Bootcat.cache IS MISSING <==== ATTENTION!.
C:\Windows\System32\winsrv.dll IS MISSING <==== ATTENTION!.

==================== EXE ASSOCIATION =====================

HKLM.….exe: <===== ATTENTION!
HKLM.…\exefile\DefaultIcon: <===== ATTENTION!
HKLM.…\exefile\open\command: <===== ATTENTION!

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4010.17 MB
Available physical RAM: 3501.69 MB
Total Pagefile: 4008.32 MB
Available Pagefile: 3493.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive d: () (Fixed) (Total:586.04 GB) (Free:152.11 GB) NTFS (Disk=0 Partition=4)
Drive g: (ReatogoPE) (Removable) (Total:14.91 GB) (Free:14.63 GB) NTFS (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: () (Fixed) (Total:0.2 GB) (Free:0.17 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: F9CBB8B2)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=586 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 000C23F4)
Partition 1: (Active) - (Size=15 GB) - (Type=07 NTFS)

==================== End Of Log ============================

2

run and attach OTL diagnostic log (not copy and paste) http://forum.avast.com/index.php?topic=53253.0

Log experts will be notified…

3

What happened prior to this ? As the system hive is in effect the brains of your computer startup

4

@essexboy:
Hi, We connected the external Hard disk with my laptop.
But while removing it didnt shown the “Eject” option. So we unplugged it directly.

After that shutdown also not working so we did hard reboot.

Then during startup we are facing this crash issue. :frowning:

5

OK removing the external may mean that either your system or the slave was accessing the registry at the time and totally corrupted it
Are you able to run a system restore from the repair my computer option on the recovery console

6

Actually I tried System restore, but it shows there is no restore point created till now.

Is it possible to fix the registry by booting it from pen drive (or) any other ubuntu live CD?

7

Using the command prompt could you see if there are registry backups in this location C: \windows\system32\config\regback folder.