Windows restore points contain registry hives, if you have restore points these can be used to restore the registry to a previous state.

I would make a full disk image before you try this manual restore.

Here is how to do a manual system restore in XP

.

A. Connect your non-bootable hard drive to another computer, as a secondary drive or use a usb adapter or enclosure and boot into windows. If you can see your data on the drive, back it up Now, then follow the rest of these instructions.

B. Open Windows Explorer. Click on Tools|Folder Options|View. Check the box beside "Show hidden files and folders". Apply your change.

NOTE D: may not represent the hard drive you connected to your PC, it may be E: or F: or G:, it all depends on how many other drives (including cd/dvd) you have in your PC, So subtitute the appropriate drive letter in the instructions below.

C. Navigate to the D:\System Volume Information folder. You will see a folder named something like _restore{.........} the dots represent an alpha-numeric sequence. In this folder you will see folders named RP0....RPnn. Find the one with the highest number. These are your System Restore points. In the highest numbered folder you will see a folder named snapshot. In this folder are registry hive files which you need to recover your system:

_registry_user_.default

_registry_machine_security

_registry_machine_software

_registry_machine_system

_registry_machine_sam

D. Create a subdirectory; i.e, D:\Windows\TMP. Copy these files to the TMP subdirectory. Rename them:

default

security

software

system

sam

Note Be sure to lose the period (.) in the file named _registry_user_.default

E. Delete the files in the D:\windows\system32\config subdirectory with the same names.

F. Copy the D:\windows\tmp files to the D:\windows\system32\config. subdirectory.

G.Put your drive back in its original system. Your system should start normally. If you get the same error repeat the procedure and choose another folder ( RPnn) (next highest number). You can repeat this procedure choosing lower RPnn numbers until you get operating again.

If you are denied access to any folders you will have to take "Ownership" of the folders first. http://support.microsoft.com/kb/308421

The registry hive log files are not logs in the sense that they keep track of past changes, but rather transaction logs (like database transaction logs). They temporarily store enough information to redo or undo pending transactions to the registry hive. Thus, you can not figure out what process changed a setting or when.