Lost Regedit

I am trying to add keys for saved file lists to a registry cleanning utility.

When I start Regedit, through the program or Satrt/Run, I get the message'
"The application failed to initialize properly (0x0000005). Click on OK to
terminate the application."

This also occurs in SAFE MODE.

It worked about 6 months ago.

TIA
MNM

Have you tried these?

Start | Run | Type or paste: regedit.exe | Click OK

Start | Run | Type or paste: %systemroot%\regedit.exe | Click OK

Start | Run | Type or paste: %systemroot% | Click OK |
Then scroll down to and double click on regedit.exe

See if there is a regedit.exe in
%windir%\system32\dllcache
or
C:\WINDOWS\system32\dllcache

If there is what happens if you double click on it?

Do a Search to see if there are any other copies of regedit.exe on your
machine.

Do a Search to see if there are any copies of regedit.com on your
machine.

regedit.com is probably created by malware.

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/foru...orial=61#winxo

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ,
MNM hunted and pecked:
I am trying to add keys for saved file lists to a registry cleanning
utility.

When I start Regedit, through the program or Satrt/Run, I get the message'
"The application failed to initialize properly (0x0000005). Click on OK to
terminate the application."

This also occurs in SAFE MODE.

It worked about 6 months ago.

TIA
MNM

"Wesley Vogel" wrote:

Have you tried these?

Start | Run | Type or paste: regedit.exe | Click OK

Start | Run | Type or paste: %systemroot%\regedit.exe | Click OK

Start | Run | Type or paste: %systemroot% | Click OK |
Then scroll down to and double click on regedit.exe

Only the first one.



See if there is a regedit.exe in
%windir%\system32\dllcache
or
C:\WINDOWS\system32\dllcache

Here's the weird part, I don't seem to have a \dllcache folder on my
machine!!!



If there is what happens if you double click on it?

Do a Search to see if there are any other copies of regedit.exe on your
machine.
In %systemroot%\WINDOWS\
In %systemroot%\WINDOWS\ServicePackFiles\
In my BartPE I386 folder and the slipstreamed directory to build BartPE





Do a Search to see if there are any copies of regedit.com on your
machine.

No.



regedit.com is probably created by malware.

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/foru...orial=61#winxo

"" This also occurs in SAFE MODE.""



--
Hope this helps. Let us know.

I was thinking of rebuilding the system soon. The missing \dllcache folder
is an indication this may be a good time.
What do you think? Or, is it possible to restore this directory via a
repair operation?




Wes
MS-MVP Windows Shell/User

In ,
MNM hunted and pecked:
I am trying to add keys for saved file lists to a registry cleanning
utility.

When I start Regedit, through the program or Satrt/Run, I get the message'
"The application failed to initialize properly (0x0000005). Click on OK to
terminate the application."

This also occurs in SAFE MODE.

It worked about 6 months ago.

TIA
MNM

MNM wrote:
See if there is a regedit.exe in
%windir%\system32\dllcache
or
C:\WINDOWS\system32\dllcache

Here's the weird part, I don't seem to have a \dllcache folder on my
machine!!!

Wait, at all? As in the Command Prompt line:
dir %systemdrive%\dllcache /a /b /s
returns nothing?

What's the value of HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\SFCDllCacheDir (and while we're at it,
SFCDisable)? What happens if you run the command: sfc /purgecache?


If there is what happens if you double click on it?

Do a Search to see if there are any other copies of regedit.exe on your
machine.
In %systemroot%\WINDOWS\
In %systemroot%\WINDOWS\ServicePackFiles\
In my BartPE I386 folder and the slipstreamed directory to build BartPE


What happens if you try to run those copies? The same thing? If you boot
off of your BPE build?


You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

"" This also occurs in SAFE MODE.""


Yeah, it's not hard to add something to Safe Mode's boot. Specifically,
it's as hard as adding a key to
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal.


--
Hope this helps. Let us know.

I was thinking of rebuilding the system soon. The missing \dllcache folder
is an indication this may be a good time.
What do you think? Or, is it possible to restore this directory via a
repair operation?


Dllcache is maintained by SFC. If SFC went south for the winter, a clean
install might not be such a bad idea.

I was thinking of rebuilding the system soon.

Not yet.

Not everyone has a dllcache folder. See below.

In %systemroot%\WINDOWS\

One or the other. %systemroot% = %systemdrive%\WINDOWS

In %systemroot%\WINDOWS\ServicePackFiles\

See below.

By default the cache folder is %systemroot%\system32\dllcache for System
File Checker (sfc.exe) and Windows File Protection.

However, with SP2...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
ServicePackSourcePath can point to %windir%\ServicePackFiles.

The ServicePackFiles folder only exists if you have upgraded to XP SP1 or XP
SP2 and they were not included in the original install and the SP1 or SP2
upgrade was done by downloading it from Microsoft. If the Service Pack is
installed by means of a CD-ROM or a distribution share, the ServicePackFiles
folder is not created. Same for slipstreaming a Service Pack.

So you either have a dllcache folder or a ServicePackFiles folder.


Does this work?
Start | Run | Type or paste: %windir%\regedit.exe | Click OK

Or this?
Start | Run | Type or paste: C:\WINDOWS\regedit.exe | Click OK


%systemroot% is an environment variable that is the location of the Windows
root folder.

Typing or pasting %systemroot% into the Start | Run box opens to the Windows
folder on whatever drive it is located. I.e. C:\WINDOWS or C:\WINNT.

systemroot definition from C:\WINDOWS\Help\glossary.chm
[[The path and folder name where the Windows system files are located.
Typically, this is C:\Windows, although you can designate a different drive
or folder when you install Windows. You can use the value %SYSTEMDRIVE% to
replace the actual location of the folder that contains the Window system
files. To identify your systemroot folder, click Start, click Run, type
%systemroot% and then click OK.]]

%windir% is an environment variable that is the location of the system
folder.

Typing or pasting %windir% into the Start | Run box opens to the Windows
folder on whatever drive it is located. I.e. C:\WINDOWS or C:\WINNT.

Windows XP can be installed in either WINDOWS or WINNT.

If %systemroot% and %windir% are the same, then obviously %windir% is easier
to type.
--------------------

The environmental variable Pathext shows a list of file extensions that are
considered to be executable and regulates which extensions do not need to be
typed in a Command Prompt or the Run command.

The Path environmental variable and a registry entry, App Paths,
control what paths do not have to be typed.

Since typing regedit without the extension in the Run command does not work
for you something is messed up with your PATHEXT.

Open a command prompt...
Start | All Programs\Accessories\Command Prompt
or
Start | Run | Type: cmd.exe | Click OK |

I wonder if this...
Start | Run | Type: cmd | Click OK |
will work for you?

Anyway, when the command prompt is open, type: path and hit Enter.

You should see something similar to this...
PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\Sys tem32\Wbem

Then type: set and hit Enter. Look for PATHEXT.

You should see something similar to this...
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WS F;.WSH

At a minimum you should have...
PATHEXT=.COM;.EXE;.BAT;.CMD

Post back with what you find.

Or you could have typed: echo %PATHEXT% and hit Enter.

Or you could have typed: echo %PATH% %PATHEXT% and hit Enter.

XP doesn't care if it's UPPERCASE, lowercase or MiXeDcASe.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news MNM hunted and pecked:
"Wesley Vogel" wrote:

Have you tried these?

Start | Run | Type or paste: regedit.exe | Click OK

Start | Run | Type or paste: %systemroot%\regedit.exe | Click OK

Start | Run | Type or paste: %systemroot% | Click OK |
Then scroll down to and double click on regedit.exe

Only the first one.



See if there is a regedit.exe in
%windir%\system32\dllcache
or
C:\WINDOWS\system32\dllcache

Here's the weird part, I don't seem to have a \dllcache folder on my
machine!!!



If there is what happens if you double click on it?

Do a Search to see if there are any other copies of regedit.exe on your
machine.
In %systemroot%\WINDOWS\
In %systemroot%\WINDOWS\ServicePackFiles\
In my BartPE I386 folder and the slipstreamed directory to build BartPE





Do a Search to see if there are any copies of regedit.com on your
machine.

No.



regedit.com is probably created by malware.

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and
anti-spyware software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode
can be a good idea. Some viruses and other malware like to conceal
themselves in areas Windows protects while using them. Safe mode will
prevent those applications access and therefore unprotect the viruses or
other malware allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/foru...orial=61#winxo

"" This also occurs in SAFE MODE.""



--
Hope this helps. Let us know.

I was thinking of rebuilding the system soon. The missing \dllcache
folder is an indication this may be a good time.
What do you think? Or, is it possible to restore this directory via a
repair operation?




Wes
MS-MVP Windows Shell/User

In ,
MNM hunted and pecked:
I am trying to add keys for saved file lists to a registry cleanning
utility.

When I start Regedit, through the program or Satrt/Run, I get the
message' "The application failed to initialize properly (0x0000005).
Click on OK to terminate the application."

This also occurs in SAFE MODE.

It worked about 6 months ago.

TIA
MNM

"MNM" wrote:

I am trying to add keys for saved file lists to a registry cleanning utility.

When I start Regedit, through the program or Satrt/Run, I get the message'
"The application failed to initialize properly (0x0000005). Click on OK to
terminate the application."

This also occurs in SAFE MODE.

It worked about 6 months ago.




This is a compilation of answers to Blades and Mr. Vogel.
I have a $NtServicePackUninstall$ folder. I copied and pasted over the main
regvac from this before requesting help. It didn’t work.
I use RegVac v4.02.12 by Ray Geide. This program is able to access the
registry and clean it. I do so on a regular basis, once a week.
Regedit did work prior to June, I only noticed it not working when I
installed a new program and wanted its recent files cleared with RegVac. I
do update my system with patches from Microsoft regularly.

I did an Explorer search in %windir%, F:\WINDOWS, for dllcache and it
returned nothing, nada, zilch. I did a manual search for this directory in
Windows and Windows\system32 and came up empty.
The suggestion: dir %systemdrive%\dllcache /a /b /s, from the command
prompt, actually returned F:\windows\system32\dllcache. I changed to the
directory and was able to launch regedit from there. When I told Explorer to
display protected files and folders, it displayed.


What's the value of HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\SFCDllCacheDir

Key not there.


(and while we're at it, SFCDisable)?

0



What happens if you run the command: sfc /purgecache?

Don’t want to try it.


Does this work?
Start | Run | Type or paste: %windir%\regedit.exe | Click OK

No, I get the same error.



Or this?
Start | Run | Type or paste: [F]:\WINDOWS\regedit.exe | Click OK

No, I get the same error.


You should see something similar to this...
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.W SF;.WSH

This is exactly what I get.


What happens if you try to run those copies? The same thing? If you boot off of your BPE build?

In BartPE, I can start the Regedit located in all 3 places:
F:\WINDOWS\
F:\WINDOWS\SYSTEM32\DLLCACHE\
F:\WINDOWS\$NtServicePackUninstall$\

I can also launch it from within BartPE via the command prompt.

I think I figured out the mystery.
Around June I installed CCleaner. I ran the registry portion of the
program. Initially I saved the removed keys. Sometime later I deleted them
though.

I did the same on my wife's laptop. It became a little buggy afterwards, so
I merged the keys back.

Mine displayed no visible signs of funkyness, hence the deletion of the
*.reg file later.

This was the buggyness, the loss of direct access to regedit.
Since my last post I discovered my registry cleaning utility has been
upgraded. The upgrade can still access and clean the registry.

So, backdoor into the registry through \dllcache when required.

Thanks all,
MNM

Paste the following line into Start | Run and click OK...

%windir%\system32\dllcache\regedit.exe

regedit.exe normally exists in
\WINDOWS
and
\WINDOWS\system32\dllcache
or
\WINDOWS\ServicePackFiles

The regedit.exe in \WINDOWS is the one that gets used. The other
one is for backup. If Windows File Protection is working correctly, the
following should help.

WFP uses the files in dllcache or ServicePackFiles to replace messed up
system files.

Try this.

Open %windir%
Size the window so you can also see your Desktop.
Scroll down to regedit.exe.
Left click and drag regedit.exe to your Desktop.
Wait just a minute.
Now scroll down clear to the bottom of the WINDOWS folder.
Is there a new regedit.exe there?

If there is a new regedit.exe delete the one on your Desktop.
Close the WINDOWS folder.

If there is NOT a new regedit.exe drag the one on your Desktop back into
the WINDOWS folder.
Close the WINDOWS folder.

If there is a new regedit.exe in the WINDOWS folder, you'll see something
similar to this in the Event Viewer under System, listed as Information;
Windows File Protection:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 08-Dec-06
Time: 2:25:52 PM
User: N/A
Computer: MYPENTIUM450
Description:
File replacement was attempted on the protected system file
c:\windows\regedit.exe. This file was restored to the original version to
maintain system stability. The file version of the system file is
5.1.2600.1106

Start | Run | Type: eventvwr | Click OK | Click on System in the left
hand pane and look for Windows File Protection

If the above does not work, run sfc.exe.

System File Checker (sfc.exe) replaces screwed up system files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

sfc /scannow scans all protected system files immediately and replaces
incorrect versions with correct Microsoft versions.

System File Checker takes a while to run.

If you have XP Home and it asks for your XP Pro CD, see this KB article...

You may be prompted to insert a Windows XP Professional CD when you run the
System File Checker tool in Windows XP Home Edition
http://support.microsoft.com/kb/897128

If SFC.EXE did anything it will be listed in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK | Click System |

Windows File Protection will be listed under the Source column. Look at any
Windows File Protection entries.

Explains a whole bunch about sfc.exe.
scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html
----------

dllcache is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files labeled
System and Hidden) in Windows Explorer.These files are required to start and
run Windows. Deleting or editing them can make your computer inoperable.Are
you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ,
MNM hunted and pecked:
I think I figured out the mystery.
Around June I installed CCleaner. I ran the registry portion of the
program. Initially I saved the removed keys. Sometime later I deleted
them though.

I did the same on my wife's laptop. It became a little buggy afterwards,
so I merged the keys back.

Mine displayed no visible signs of funkyness, hence the deletion of the
*.reg file later.

This was the buggyness, the loss of direct access to regedit.
Since my last post I discovered my registry cleaning utility has been
upgraded. The upgrade can still access and clean the registry.

So, backdoor into the registry through \dllcache when required.

Thanks all,
MNM

I'm getting the same error from regedit that MNM reported. I noticed it
today, but I don't know when the problem was first introduced.

I'm running XP Professional SP2.

I tried many of the suggestions above. Thank you for the great detail.

%windir%\system32\dllcache\regedit.exe
This works.

Open %windir%
Size the window so you can also see your Desktop.
Scroll down to regedit.exe.
Left click and drag regedit.exe to your Desktop.
Wait just a minute.
Now scroll down clear to the bottom of the WINDOWS folder.
Is there a new regedit.exe there?
Yes. But when I double-click on it I get the same error as before.

sfc /scannow
The scanner ran to completion but didn't seem to do anything. I still
get the same error when trying to run regedit or regedit.exe from the
Run edit box.

Searching for regedit.*, I see the exe in the following locations:
c:\i386 (this one runs OK)
c:\windows (this one doesn't run)
c:\windows\system32\dllcache (this one runs OK)

There were no matches on regedit.com.

I ran a full virus scan, and found nothing. I get virus definitions
automatically from my company's intranet. The definition file is
up-to-date.

Should I just be content with running regedit from i386 or dllcache? I
would prefer to get it working from its normal location if possible.

Thanks.


--
dupton
------------------------------------------------------------------------
dupton's Profile: http://forums.techarena.in/member.php?userid=20160
View this thread: http://forums.techarena.in/showthread.php?t=636810

http://forums.techarena.in

Sorry for the delay. I was building a retro system for the kids.



"Wesley Vogel" wrote:

Paste the following line into Start | Run and click OK...

%windir%\system32\dllcache\regedit.exe

This works. Regedit starts.


Open %windir%
Size the window so you can also see your Desktop.
Scroll down to regedit.exe.
Left click and drag regedit.exe to your Desktop.
Wait just a minute.
Now scroll down clear to the bottom of the WINDOWS folder.
Is there a new regedit.exe there?

Yes there is a new regedit!!! But, it doesn't work either.

MNM