Windows 10: Registry hive is corrupt, I need help repairing my system drivers through one drive.

Please help I have a HP Pavilion TG01-00223W

:)

 

Windows10 corrupts SYSTEM registry hive minutes after installation

Hi,

I'm having an issue with my HP EliteBook 840 G4

After installing windows10, everything seems fine, then I connect to the internet through wifi.

Windows starts installing updates, driver updates and optional features...

Then, after a few minutes connected, windows decides to restart on it's own and then crashes on startup with Stop Error 0xc000021a

This only happens if i'm connected to the internet

I have three other computers with windows 10 home and pro editions and they are all good

Things I have tried:

EDIT

-> memory test and memory swap

-> harddrive test and harddrive swap

/EDIT

EDIT2

-> ran a RootKit scan with Kaspersky TDSSKiller with all options checked, only thing found was an unsigned file (c:\windows\system32\wbengine.exe)

-> tried refreshing and resetting windows after crashing, windows boots up, but minutes later... crash

/EDIT2

-> installing two versions of windows 10 pro: 1709 and 1809

-> installing windows 10 enterprise

-> BiOS update

EDIT3

-> installed all manufacturer drivers

-> loaded BIOS defaults (after bios update)

/EDIT3

-> Startup Repair (sometimes works, but windows crashes again with the same problem)

-> System Restore - Same as startup repair

-> disabling windows updates and cancelling download of optional features

-> disabling driver updates through windows update

-> hiding updates with http://download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab

-> running update diagnostics with
https://aka.ms/wudiag

-> running dism /Online /Cleanup-Image /checkHealth and
dism /Online /Cleanup-Image /restoreHealth

-> disabling TPM within BIOS configuration

-> writing a batch to run shutdown -a on an infinite loop to prevent windows from restarting, but windows ignores it

-> reading windows log files from windows update, CBS log, event logs

-> comparing sizes, dates and checksums from Healthy windows files vs Crashed windows files ---
this is how I found out that windows is corrupting the SYSTEM registry hive, by restoring altered files through trial and error until I zeroed in on this one file

I imported both good and bad SYSTEM hives and exported them into .reg files for text comparison and it seems that windows deletes a lot of registry keys, related to installed hardware devices, even though the corrupt file is larger

As soon as I replace the SYSTEM file with the previous version, windows boots up again, unfortunately minutes after connecting to the internet, windows corrupts the registry again

EDIT5

A few more details:

These are the event I found before the system crashed:

• System store corruption detection and repair has completed. Status: 0x0, Total instances of corruption found: 1998, total instances of corruption repaired: 0.
• 0 of 1998 instances of system store corruption have been repaired. Unrepaired corruptions may lead to failures in future system servicing.

Minutes later:

• The process C:\Windows\SysWOW64\shutdown.exe (DESKTOP-1DEOVNR) has initiated the restart of computer DESKTOP-1DEOVNR on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
  
  Reason Code: 0x800000ff
  
  Shutdown Type: restart
  
  Comment:

HALF of the SYSTEM registry hive was deleted!

/EDIT5

I managed to find a way to keep laptop from crashing whilst connected to the internet, and that is by using an old firewall program I wrote years ago during the BLASTER malware days to protect my port 135.

I am currently blocking all connections except those from Remote Desktop which I am using to write this post

Any idea as to what is happening ?

I am running out of ideas...

 

windows 11 how to repair corrupted hives?

windows 11 how to repair corrupted hives?

 

Which files should I open to "Load Hive" into Registry Editor?

Hi David,

Load the ntuser.dat (hidden) hive located in the old user profile folder.

For example, if E:\ is the drive letter of your old system drive and your username is David, the ntuser.dat file will be located in the following path:

• E:\users\David\NTUSER.DAT
  

(An old article for your reference: How to recover Windows Mail data and settings from a corrupted user profile)

Additional Info:

Registry Hives - Win32 apps | Microsoft Learn: Registry Hives - Win32 apps

The following table lists the standard hives and their supporting files.

[table][tr]Registry hiveSupporting files[/tr][tr][td]HKEY_CURRENT_CONFIG[/td][td]System, System.alt, System.log, System.sav[/td][/tr][tr][td]HKEY_CURRENT_USER[/td][td]Ntuser.dat, Ntuser.dat.log[/td][/tr][tr][td]HKEY_LOCAL_MACHINE\SAM[/td][td]Sam, Sam.log, Sam.sav[/td][/tr][tr][td]HKEY_LOCAL_MACHINE\Security[/td][td]Security, Security.log, Security.sav[/td][/tr][tr][td]HKEY_LOCAL_MACHINE\Software[/td][td]Software, Software.log, Software.sav[/td][/tr][tr][td]HKEY_LOCAL_MACHINE\System[/td][td]System, System.alt, System.log, System.sav[/td][/tr][tr][td]HKEY_USERS\.DEFAULT[/td][td]Default, Default.log, Default.sav[/td][/tr][/table]