MalwareCrypt
November 21, 2014, 05:44:36 PM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News:
 
   Home   Help Search Login Register  
Pages: 1 2 3 [4]
  Print  
Author Topic: Trouble Deleting File  (Read 13928 times)
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #45 on: September 03, 2010, 04:55:29 PM »

I don't seem to find "R1000" in the EasyNote selections here. Perhaps there is some other model info on it?

The check disk results show the scan did locate and correct some issues, though no info on exactly what the errors were. The immediate goal running it was to see if it corrected errors that were related to the missing system file, so that would again be picked up by Windows. You would know that by being able to boot to Windows afterwards, so I assume you still cannot.

Different repair shops use different methods, and have different skill levels. I would assume they have different XP CD's, and perhaps see if a Repair Install of XP corrects the problem. But a somewhat quicker method would be to pull the hard drive, then access it's files and copy over some recent system hive file stored in the System Restore folder. Which would essentially correct this missing system file. This cannot be done using the Recovery Console because it does not allow access to the System Restore folder.
Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #46 on: September 03, 2010, 04:57:43 PM »

Smiley Just to be clear on one step, the need would be to copy over all the needed hive files from the System Restore folder (not just the system file). They need to all match each other in relation to when they were created.
Logged
Sunny
Full Member
***
Posts: 154


« Reply #47 on: September 04, 2010, 07:33:28 AM »

I just googled by laptop and I guess the following info can be added to Packard Bell EasyNote R1000:
INTEL CELERON M 360 PROCESSOR 1.40GHz LAPTOP

Does any of that help?

When going to repair shop, would a Repair Install of XP still maintain all of my work on my laptop or take it back to the factory settings?

Also, for the easier method, when you say "access and copy over to another laptop," does this just mean taking out the hard drive and putting it in/loading it up on another laptop and then saving and being able to use my work from there or is it just a temporary place to store my work? Can the hard drive be put in any other laptop or computer or only specific laptops?
« Last Edit: September 04, 2010, 12:46:09 PM by Sunny » Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #48 on: September 04, 2010, 02:46:32 PM »

The method I have used quite a few times does require the hard drive be connected to some other computer, so the files on it can be accessed and changed/moved. One way is to slave it to another computer, but I use a device like this to make the connection. Note - that link is just to show a type of connector, and truly is not any encouragement that it is preferred or recommended.

The steps you did at the Recovery Console prompt were to move backup hive files, so that Windows would use them to successfully boot up. The next step after that is to then use the more recent hive files, located in the System Restore folder, and move them, so that on the next boot up Windows would use those more recent hive files.

The reason you just do that that using the Recovery Console Prompt right at first is because the System Restore folder is not accessible from there.

So you take out the hard drive, connect it to a different computer to access it's files, and then just move the System Restore hive files to replace the problem ones. Pretty much bypass the step to move any older, backup copies. And provide Windows with the essential system file to return to booting up without issues.
Logged
Sunny
Full Member
***
Posts: 154


« Reply #49 on: September 06, 2010, 11:11:18 AM »

Jintan, I took my laptop to the repair shop and he took out the hard drive and put it in one of those connector devices you showed me. I had to buy it and take it home to access my hard drive. I plugged the connector into my PC but cannot find any of my work anywhere! The guy at the repair shop said some stuff might be encrypted or something.

When I open up the drive I get the following folders:

18e355ee3bfb532327
Apps
Program Files
Windows
Documents and Settings – when I open this there is an 'All Users' folder and a folder with my name. When I scroll over my name folder it says "folder is empty". When I try to open it it says "E:\Documents and settings\sharnpreet is not accessible. Access is denied."

There are also the following notepad documents when I open the drive:
Autlook
Bootex
Drwtsn32
DWNLOG
Find
Mbam-error
SAUDIT

When on my PC's 'My Computer' page, I scrolled over the drive's icon and it says:
Free space: 24.3GB
Total Size: 42.5GB

This suggests that all my work should still be there as that's what it was the day before this problem happened.

Where is all of my work (E.g. word documents, web links, music, pics, etc)? How can I access them?
« Last Edit: September 06, 2010, 11:15:45 AM by Sunny » Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #50 on: September 06, 2010, 02:56:22 PM »

May be that the permissions settings are also keeping you from getting an accurate check on the folders.

Click here and download sUBs' Inherit.exe to your desktop.

Then open Explorer (right click Computer/My Computer, left click Explore), and navigate to that E:\Documents and Settings Folder. You will need to resize the Explorer display so you can see both the E dive, and the desktop.

Then left click on the "sharnpreet" folder, and hold and drag it into the Inherit.exe file on the desktop, then release.

Once it completes the permissions changes it makes, a "Finish" popup showing "OK" should appear. Just click the OK button to close that. Then see if you now have access to the folder, and can see your files.

Take note that you will also want to put priority on making those hive file corrections, but for now see about saving the personal data to avoid losing it.

There are data recovery programs we can also use on that connected E drive hard drive, so if you do not locate your files, try to minimize doing changes on the E drive. Need to minimize activity so the system won't write to, and change the data, on that hard drive (the more it writes to the drive, the more likely some of that will overwrite the file data that you hope to recover).
Logged
chrisadam2
Newbie
*
Posts: 0


« Reply #51 on: September 07, 2010, 05:05:27 AM »

These are frequently simple files like videos (AVI), MP3s or other seemingly harmless files. You try to delete the file, Windows waits a few seconds before announcing that access is denied, the file is currently in use and cannot be deleted. However, you know it's not in use and you just want it deleted.

_________________________________________

Want to get-on Google's first page and loads of traffic to your website? Hire a SEO Specialist from Ocean Groups seo pecialist
Logged
Sunny
Full Member
***
Posts: 154


« Reply #52 on: September 07, 2010, 08:31:14 AM »

Thanks Jintan, that inherit.exe program worked and I managed to access and save my work. Shall I delete that inherit program or is it still needed?

What now, how do I make those hive file corrections? Can you please tell me step-by-step exactly how/what needs to be done?

Also, will doing this restore my laptop as it was or will it take it back to the initial factory settings? I don't mind either way now that I have my work saved, which way is the easiest?
Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #53 on: September 07, 2010, 05:26:40 PM »

Good, you accessed your files. The file moving you need to do now is really just doing Part Two and Three of this MS page. Locate some appropriate backup hive files in System Restore, then move copies of those to the c:\windows\system32\config. So just correcting the no bootup problem this all started with.

To avoid confusion, before I post the next steps post back what drive letter the laptop drive is assigned while connected to the other computer please.
Logged
Sunny
Full Member
***
Posts: 154


« Reply #54 on: September 08, 2010, 08:11:03 AM »

The laptop  drive is E.

Shall I do both Parts 2 and 3 or just Part 2 and then post back here?

After renaming the the files in Part 2, shall I shutdown/restart the computer while keeping the laptop drive plugged in?

How would I do part 3, how do I access the Recovery Console on my PC (has Windows Home Edition installed)? Do I remove the laptop drive after typing "exit" in the console?
« Last Edit: September 08, 2010, 10:41:01 AM by Sunny » Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #55 on: September 08, 2010, 04:51:29 PM »

All these next steps will be done on the laptop drive (the E drive) while it is attached to a different computer. The only reason the Recovery Console is involved is when you do not have the opportunity to access the drive from a different computer. Due to limitations, the Recovery Console cannot access all the files/folders to do what we are about to do.

Having said that, our next steps won't quite match the MS link info, again, because you have this direct access to the laptop hard drive.


On the attached E hard drive, do the same drag into Inherit.exe for the following folder:

E:\System Volume Information


Again, wait for the finish message. That will give you access to the saved Restore points.

--------------------

Create a new folder in the laptop drive Windows folder. Just navigate to the E:\Windows folder, right click in it, and select  New -> Folder. Name it Hivetemp.

You should now have a E:\Windows\Hivetemp folder.

--------------------

Then navigate to that "E:\System Volume Information" folder, and in that locate the folder similar to this (the numbers will not be the same as this example):

C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}

In that folder, locate and open a recently created System Restore backup folder. These will appear as RP1, RP23, RP47. The higher that number the more recent the backup is. You can check the date by right clicking the folder, and selecting Properties.

Don't choose the most recent/highest number RP folder. We just want to steer clear of any issues that backup might have. Instead, choose the one with the second highest RP number.

---------------

Open that RP(numbers)  folder, and locate and open the Snapshot folder. In that folder, locate these files:

_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM


Copy each of those to your new Hivetemp folder on the desktop (right click the file, select Copy, click in that Hivetemp folder and select Paste).

------------------

Then still in the Hivetemp folder, rename each of those copied files like this:

_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM


Renamed to:

DEFAULT
SECURITY
SOFTWARE
SYSTEM
SAM


You should now have:

E:\Windows\Hivetemp\DEFAULT
E:\Windows\Hivetemp\SECURITY
E:\Windows\Hivetemp\SOFTWARE
E:\Windows\Hivetemp\SYSTEM
E:\Windows\Hivetemp\SAM


--------------

Navigate to this folder:

c:\windows\system32\config

Rename these files:

DEFAULT
SECURITY
SOFTWARE
SYSTEM
SAM


To this:

DEFAULT.old
SECURITY.old
SOFTWARE.old
SYSTEM.old
SAM.old


Remember, not all those hive files were there, when you checked earlier. So you just need to rename those that are there.

-------------------

Then copy the files in your Hive Temps folder to the c:\windows\system32\config folder. So you should then have this, made up of files moved from System Restore:

E:\windows\system32\config\DEFAULT
E:\windows\system32\config\SECURITY
E:\windows\system32\config\SOFTWARE
E:\windows\system32\config\SYSTEM
E:\windows\system32\config\SAM


Then return the drive to the laptop, and boot it up.

If you can now boot to Windows on the laptop with no problems, you still have one last step to do.

Go to Start - Run, type the following and press OK:

%systemroot%\system32\restore\rstrui.exe

Once the System Restore display opens follow the prompts to do a System Restore. This will be more complete than just moving the backup hive files. Choose a date just before all these problems began.
Logged
Sunny
Full Member
***
Posts: 154


« Reply #56 on: September 09, 2010, 12:01:42 PM »

Thanks Jintan, I did all the steps and everything seems back to normal. Is there anything else that needs to be done to ensure that this problem doesn't occur again in future?
Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #57 on: September 09, 2010, 05:24:18 PM »

Good for you in getting that completed. That drive's file system has been put through a lot, so a good idea would be to check it.

Just go to Start - Run, type cmd and click OK. At the prompt type the following:

chkdsk /r

It will tell you the volume is in use, so go ahead and agree to running check disk during the next reboot startup. Type exit then press OK to close the command window, then go ahead and reboot.

Once that is completed just post an update here that all's well there.
Logged
Sunny
Full Member
***
Posts: 154


« Reply #58 on: September 11, 2010, 07:26:01 AM »

I did the disk check and everything seems ok.

I would like to ask whether removing PowerCinema from starting-up had anything to do with the Windows error problem? I only ask as a few days after it was removed, the problem occured. If not shall I remove "PCMService" from the strat-up tab again to help with the laptop start-up time?

Also, do you still suggest that I delete the system restore points as originally intended before the Windows error occured?
Logged
Jintan
Administrator
Hero Member
*****
Posts: 4012



WWW
« Reply #59 on: September 11, 2010, 04:29:21 PM »

I would suggest waiting a bit on System Restore cleaning, at least until you have feel these current issues are resolved, and no problems exist.

As for problems stemming from disabling PCMService, no, I can't think of anything that would link that to the missing hive files you just corrected. See here for one opinion. I am pretty sure many have already done that disabling and did not experience problems. Sometimes the culprit is never found, but once the problem is gone, continuing that pursuit may not be worth the effort.

A couple of scenarios for that hive file missing are:

1 - Bad shutdown corrupted the file system.
2 - Incorrect action done by and antivirus program, or others that have the means of making that change.
3 - Hardware glitch, maybe brought on by a fluctuation in power being supplied.
4 - The drive is failing. Earlier I think I posted a link to a site listing the different hard drive vendor utilities, so if you haven't tried that you may want to do it now. If you still need that link just let me know.
Logged
Pages: 1 2 3 [4]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
SMFAds for Free Forums
Valid XHTML 1.0! Valid CSS!