Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My Windows computer is infected by a virus similar to this one that blocks user screen completely (even Ctrl+Alt+Del is not working). It starts when user enters into his account. Safe mode doesn't help since the virus writes itself to system registry.

So ideally I would like to have a program like Autoruns to edit startup applications directly when Windows is not working (some LiveCD for example) or at least a tool that allows to edit Windows registry in such situation.

Could your recommend me such tools?

share|improve this question

6 Answers 6

up vote 3 down vote accepted

If you're looking for a live cd with a registry editor on it, you could look at this one, it saved my life more than once. Of course, read the disclaimers first :-)

share|improve this answer
    
Interesting. I'm going to give that one a look. +1 for you. –  user3463 Oct 21 '09 at 10:25

Take the drive out, put it in an external chassis, and scan the everloving joy out of it (or use the methods described in other answers on this question).

While the registry settings are an annoyance, they're calling executable files, and your initial scan will fix that problem.

Then when you boot back into Windows again, you can run another scan, this time through the registry to get rid of the last vestiges of the problem.

However: if t'were me, I'd reinstall the box and restore my data from backup.

share|improve this answer

Try BartPE

share|improve this answer

Most anti-virus products supply a rescue live-CD virus scanner.
Here are some such CDs:

Kaspersky Rescue Disk
Avira AntiVir Rescue System (best - updated several times a day)
F-Secure Rescue CD (definition updated automatically if internet connection)
BitDefender 2008 RescueCD (definition updated automatically if internet connection)
Dr.Web LiveCD

share|improve this answer

I've always been a massive fan of ERD Commander for things like this, as it's saved my bacon more than once!

Winternals the original authors have since been bought by Microsoft, and having a quick google it turns out that it has been absorbed into a Desktop Optimisation Pack, but there is a 30-day trial available for download which may help for a one off problem.

I've not been able to find a link on the MS website, but SoftPedia have it. The full version is also available is you have a technet subscription.

share|improve this answer

I don't know if you can use the command "msconfig" in command mode, but If you can there is a tab Startup where every software that starts with the pc is listed. There you can unboxed the virus. I used the same technique to remove a virus, but I could use the screen for some seconds before the virus hop in.

msconfig

Else you can try to delete the whole StartUP folder from cmd

http://support.microsoft.com/kb/258578

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.