Edit startup applications of “dead” Windows

Question

My Windows computer is infected by a virus similar to this one that blocks user screen completely (even Ctrl+Alt+Del is not working). It starts when user enters into his account. Safe mode doesn't help since the virus writes itself to system registry.

So ideally I would like to have a program like Autoruns to edit startup applications directly when Windows is not working (some LiveCD for example) or at least a tool that allows to edit Windows registry in such situation.

Could your recommend me such tools?

Answer 1

If you're looking for a live cd with a registry editor on it, you could look at this one, it saved my life more than once. Of course, read the disclaimers first :-)

Answer 2

Take the drive out, put it in an external chassis, and scan the everloving joy out of it (or use the methods described in other answers on this question).

While the registry settings are an annoyance, they're calling executable files, and your initial scan will fix that problem.

Then when you boot back into Windows again, you can run another scan, this time through the registry to get rid of the last vestiges of the problem.

However: if t'were me, I'd reinstall the box and restore my data from backup.

Answer 3

Try BartPE

Answer 4

Most anti-virus products supply a rescue live-CD virus scanner.
Here are some such CDs:

Kaspersky Rescue Disk
Avira AntiVir Rescue System (best - updated several times a day)
F-Secure Rescue CD (definition updated automatically if internet connection)
BitDefender 2008 RescueCD (definition updated automatically if internet connection)
Dr.Web LiveCD

Answer 5

I've always been a massive fan of ERD Commander for things like this, as it's saved my bacon more than once!

Winternals the original authors have since been bought by Microsoft, and having a quick google it turns out that it has been absorbed into a Desktop Optimisation Pack, but there is a 30-day trial available for download which may help for a one off problem.

I've not been able to find a link on the MS website, but SoftPedia have it. The full version is also available is you have a technet subscription.