Advanced Registry - Getting a cd-rom drive to work

I was working on a computer when I encountered an interesting problem: One of the computer was having problem communicating with new devices. Hardware popup wizard would popup on every occasion, even when a single usb key was plugged in. It couldn't find any drivers for some of the many common or simple devices and finally, to top it off, the CD-ROM driver could not load. Lastly, the machine was incredibly slow. This was running Windows XP.

In my rush to get this fixed, I tried to run repair. Big mistake. Few things one should know about the difference between Windows XP Install and Windows XP Repair:

When running a fresh install, XP will create a basic profile for all your hardware, using the included basic drivers for everything it can run. However, when you do a repair, it uses the currently installed hardware profile and drivers.

What does it mean? Well, remember how the CD-ROM wasn't working before? After booting the Windows XP Installation CD, initiating repair, copying files to the drive, it would then proceed to next step: Boot up from the hard disk and continue repair from there. This is where the problems start.

When booting up, the repair installation will popup a very simple error dialog: The file 'Asms' on Windows XP Professional Service Pack 3 CD is needed.

The problem is not the fact that it couldn't open one simple file, it's which file it's having problem with. asms is the first file Windows Installation/Repair will load from the CD. Because the CD-ROM drive wasn't working in the installed Windows, the repair will also fail to locate the file from the CD. This is because, as I explained, it's using the same hardware profile.

So, great. What now?

First, lets try to diagnose the actual problem. Attempting to access the CD-ROM in command line will prompt the following error message:

Opening devmgmt.msc (Device manager) reveals the following:

Interesting. Running uninstall on the broken instance of the CD-ROM and trying to re-install it from scratch will finally resolve the CD-ROM issue:

Attempts at accessing the cd-rom drive will show the drive fully operating:

Great, so the drive is accessible. This still doesn't fix the problem though. Should you click ok on the previous error dialog it will still fail. Attempting to provide the full path to the file D:\I386 will fix the issue only for that instance. Every other file the Setup/Repair requires to access from the CD will also pop-up an error meesage.

Ok then, so this didn't work. Should you attempt to restart after making the cd-rom drive accessible will also not work.

Now things are finally starting to get interesting. Let's dig deeper into the problem.

One of the most common things that will cause a cd-rom drive to not work is due to an UPPERFILTERS and LOWERFILTERS drivers that are being loaded for the cdrom drive. This is a well documented problem. This is how the CD-ROM class {4D36E965-E325-11CE-BFC1-08002BE10318} looks before we uninstall the driver for it:

And this is how the registry will look after uninstalling the device and deleting the UPPERFILTERS and LOWERFILTERS:

I should note that I had to also rename it from 0001 to 0000. Still the problem persisted. The setup still couldn't find the CD-ROM drive after restart.

Comparing the registry before and after uninstall we find some unusual changes having occured:

The following has been removed (non trivial):

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{1186654d-47b8-48b9-beb9-7df113ae3c67}\##?#IDE#CdRomPHILIPS_CDRW#DVD_CDD5263________________UD91____#5&18c802ac&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}]
"DeviceInstance"="IDE\\CdRomPHILIPS_CDRW/DVD_CDD5263________________UD91____\\5&18c802ac&0&0.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{1186654d-47b8-48b9-beb9-7df113ae3c67}\##?#IDE#CdRomPHILIPS_CDRW#DVD_CDD5263________________UD91____#5&18c802ac&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}\#]
"SymbolicLink"="\\\\?\\IDE#CdRomPHILIPS_CDRW#DVD_CDD5263________________UD91____#5&18c802ac&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}"

The following was created (still nothing interesting):

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\##?#IDE#CdRomPHILIPS_CDRW#DVD_CDD5263________________UD91____#5&18c802ac&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\#\Control]
"Linked"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\##?#IDE#CdRomPHILIPS_CDRW#DVD_CDD5263________________UD91____#5&18c802ac&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\Control]
"ReferenceCount"=dword:00000001

And finally, the most interesting part:

The left is before we uninstall the CD-ROM driver and the right is after re-installing it. As you can see, we still have that troubling UPPERFILTERS and LOWERFILTERS appearing after reboot. Here is an explanation on how this part of the registry works:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class

Contains a driver list of associated drivers. This is the list we see when we view the Device Manager.

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum

Contains a category view of all hardware the computer sees.

Each category contains list of devices and each device has an id to the corresponding driver that is partly contained in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class. This is not the complete story yet. There are more places where the driver and hardware association are done inside the registry but for now, this should do.

Now, back to the original problem.

The reason why the "fix" for the cd-rom drive (by uninstalling the device), doesn't persist after restart inside the setup is once again because of the way the registry works. Or more specificly, through Windows Repair installation. Inside the C:\Windows\System32\config there are 2 files for each part of the registry:

  • Normal version: SYSTEM, SOFTWARE, etc.

This is what the currently installed windows uses.

  • Repair version: SYSTEM.SAV, SOFTWARE.SAV, etc.

These are like a backup version of the registry used during Windows Repair and such.

Every time we start the repair process, the repair installation copies the SYSTEM.SAV and overwrites the default SYSTEM file with it. All the changes we did by fixing the CD-ROM drive only persists in the SYSTEM. So everytime we booted the hard drive to start the repair process, our changes to SYSTEM were overwritten.

Copying our fixed SYSTEM to SYSTEM.SAV on another computer will also not work. The SYSTEM is different from SYSTEM.SAV in such a way that should we copy it over, it will make the repair setup think it has finished the repair process when it obviously hasn't. The repair will finally complain about that fact and prematurely quit.

So how can we fix our current problem? Follow the instruction on the Microsoft article and apply it only to SYSTEM.SAV on the 2 following locations:

  • Remove UpperFilters and LowerFilters from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ENUM\IDE\Your-cd-rom-drive-id-here\another-id
  • Remove UpperFilters and LowerFilters from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\xxxx (remove it for every instance under that key)

That should finally do it. After applying the above steps, I finally managed to finish the repair process and the Windows worked better than ever.

Show Comments