0

I have a Windows XP machine with 2 accounts:

  1. "User" - limited acc
  2. "Admin" - has strong password

User got a virus, that blocked access. I logined as Admin and launched regedit. I tried to load HKEY_CURRENT_USER for "User", using these instructions:

  1. Highlight HKEY_USERS and then select Load Hive from the Registry menu.

  2. Browse to their profile directory and select ntuser.dat or if you are editing a mandatory profile the file will be called ntuser.man

  3. When prompted for Key Name, input their Username. The editor will insert the user's Registry data into HKEY_USERS under the user's name.

  4. Make your changes to the registry located under this new key.

  5. After you are finished making all of the registry changes, highlight key corresponding to the username and select the Unload Hive option from the Registry menu.

http://scilnet.fortlewis.edu/tech/Users/load_HKEY_USERS.htm

But it failed:

enter image description here

It says: "Can't load ntuser.dat.LOG: error while loading the hive". This file really exists and has 0 size. There is no User subtree under HKEY_USERS, so I presume, that Users hive is not loaded for Admin:

enter image description here

Then I started from Live CD, and launched regedit there. I was able to load ntuser.dat correctly and delete the virus from autoload for User.

  1. How could I do it from Admin account?
  2. Why did the error emerge?
5
  • 3
    This file really exists and has 0 size. There’s your answer; the registry hive is corrupt. If it is 0 bytes, then it is completely empty and cannot be mounted. Are you sure you are using the correct hive file? If you try to mount a non-existent hive, then one will be created, so you may have done that by accident. Try searching the drive for ntuser.dat, then look at the Folder and Size columns to see if you can find the right one. If you find nothing at all, then it may have been completely deleted. In that case, see if there is a copy (e.g., ntuser.bak).
    – Synetech
    May 22, 2013 at 16:26
  • "If you try to mount a non-existent hive, then one will be created[.]" Oh, Windows, don't you ever change. May 22, 2013 at 16:32
  • @Synetech Look carefully: ntuser.dat.log is empty. While ntuser.dat is not empty and was correctly loaded, using Live CD. Also when I cured the virus, I was able to successfully login as this user, and all the previous settings were intact. So, I think that HKEY_CURRENT_USER hive for this user is not corrupted. And that's the point.
    – user4035
    May 22, 2013 at 16:50
  • @user4035 - You will need to delete the profile and create a new one if the profile is corrupt.
    – Ramhound
    May 22, 2013 at 18:34
  • Ah, I just noticed the .log extension. See my answer below.
    – Synetech
    May 24, 2013 at 19:13

1 Answer 1

3

The problem is that you are attempting to mount the LOG file. You need to mount ntuser.dat, not ntuser.dat.log.

Like you said above, you were able to mount the hive successfully, so there’s no problem; there is no problem with the log file being empty, it just means that pending registry changes were flushed to the hive when you last shut down. [1][2][3][4]

Also, I prefer the command-line tool for mounting registry hives:

C:\>reg load hku\z "C:\Documents and Settings\Userhku\z\ntuser.dat"

The operation completed successfully.


C:\>regedit

::You can navigate to HKEY_USERS\z in REGEDIT to view the mounted hive


C:\>reg unload hku\z

The operation completed successfully.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.