Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've just received a laptop that has a nasty malware/ransomware (you can find more details here)

From what I've read it's enough for me to start in safe mode and remove some items from startup run a removal tool and I'm all done. The problem is that I can't boot in safe mode.

Because of all of that I've connected the hdd to my laptop and I was hoping I'd find a way to edit the registry files from my PC. Is there any way to do that ?

System Configuration:

  • Windows 7 Ultimate x86
  • HP Compaq 6720s
share|improve this question
    
This looks like an XY problem. meta.stackexchange.com/questions/66377/what-is-the-xy-problem –  Kruug Feb 27 '13 at 20:10
    
I have a blog entry that describes how to reset a Windows password by means of modifying the registry off-line. If you just do steps 1-11 and ignore the rest it might be helpful: harryjohnston.wordpress.com/2010/03/09/… –  Harry Johnston Feb 28 '13 at 2:01
add comment

2 Answers

up vote 1 down vote accepted

Maybe not msconfig, BUT you can remove any entries in the registry that are present, just open regedit on your machine, then open the ntuser.dat file under the user's folder on that hard drive. The location of startup items that are in msconfig can be found in the registry (googlable). I forget where the .dat file for the hklm key is but it's googlable. Also, usually these virii nowadays only corrupt the user's profile, so deleting the reg key for the user's profile usually resolves. (I didn't read your link, not sure of the severity of the virus).

share|improve this answer
    
Thank for you're help, i'll look into it. The virus is pretty nasty cant use the computer, cant do anything no task manager, no cmd, no nothing and without safe mode i think it's kind of hard to clean it without a proper format –  toby Feb 27 '13 at 19:05
1  
I've seen those, and that no task mgr no cmd happens whenever anyone logs in? Not just primary user but local admin as well? I've had great experience w/ Malwarebytes cleaning that, I don't work for them. –  BigHomie Feb 27 '13 at 19:07
    
Thanks that did the trick for me. –  toby Mar 4 '13 at 10:01
add comment

Take a look at Kaspersky Rescue Disk. It allows you to boot your computer into an anti-virus environment, allowing you to scan and clean your computer without booting up Windows.

Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is so severe that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities (such as Kaspersky Virus Removal Tool) running under the operating system.

In this case, disinfection is more efficient because malware programs do not gain control when the operating system is being loaded. In the emergency repair mode, you can only start objects scan tasks, update databases roll back updates and view statistics.

EDIT: It also appears that there is a similar tool from the link you provided under the Removal Option 2 Using Anvi Rescue Disk to Remove the Ransomware and Repair the Infected Computer heading.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.