1．故障现象
通过 SQL Server 服务管理器 启动出错提示如下:
通过服务管理器启动出错提示如下:
2．原因分析
安照《》这篇文章的方案思路进行排除解决。
3．解决办法
对于本次出现的错误，在查看正常系统服务注册表文件时发现少几个项值。并检查一些数值数据是否被篡改如下：
BEGIN 下为非正常系统的注册表项
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH]
“Type”=dword:00000020
“Start”=dword:00000002
“ErrorControl”=dword:00000001
“DisplayName”=”Microsoft Search”
“ImagePath”=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\
00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,73,00,74,00,\
65,00,6d,00,5c,00,4d,00,53,00,53,00,65,00,61,00,72,00,63,00,68,00,5c,00,42,\
00,69,00,6e,00,5c,00,6d,00,73,00,73,00,65,00,61,00,72,00,63,00,68,00,2e,00,\
65,00,78,00,65,00,22,00,00,00
“Description”=”基于结构化和半结构化数据的内容以及属性生成全文索引，以便可以对数据进行快速的单词搜索”
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Performance]
“PerfIniFile”=”DssCntrs.ini”
“Last Counter”=dword:00001290
“Last Help”=dword:00001291
“First Counter”=dword:00001260
“First Help”=dword:00001261
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Enum]
“0”=”Root\\LEGACY_MSSEARCH\\0000″
“Count”=dword:00000001
“NextInstance”=dword:00000001
下为正常系统的注册表项
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH]
“Type”=dword:00000020
“Start”=dword:00000002
“ErrorControl”=dword:00000001
“ImagePath”=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\
00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,73,00,74,00,\
65,00,6d,00,5c,00,4d,00,53,00,53,00,65,00,61,00,72,00,63,00,68,00,5c,00,42,\
00,69,00,6e,00,5c,00,6d,00,73,00,73,00,65,00,61,00,72,00,63,00,68,00,2e,00,\
65,00,78,00,65,00,22,00,00,00
“DisplayName”=”Microsoft Search”
“DependOnService”=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,4e,00,54,00,4c,00,\
4d,00,53,00,53,00,50,00,00,00,00,00
“DependOnGroup”=hex(7):00,00
“ObjectName”=”LocalSystem”
“Description”=”基于结构化和半结构化数据的内容以及属性生成全文索引，以便可以对数据进行快速的单词搜索”
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Performance]
“PerfIniFile”=”DssCntrs.ini”
“Last Counter”=dword:00000ffe
“Last Help”=dword:00000fff
“First Counter”=dword:00000fce
“First Help”=dword:00000fcf
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Security]
“Security”=hex:01,00,14,80,b8,00,00,00,c4,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,88,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,\
00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,18,00,fd,01,02,00,01,02,00,\
00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,\
01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Enum]
“0”=”Root\\LEGACY_MSSEARCH\\0000″
“Count”=dword:00000001
“NextInstance”=dword:00000001
END
尝试用正常系统的注册表项添加到非正常系统中去。（因为对比的两个系统版本、结构相同，所此次就直接通过导入导出注册表项进行批量修改）。