I have a hard drive with a virus that I removed from a PC. I can scan the file system of it as an attached USB drive. But how do I scan the registry of that USB drive since it is not booted up like a regular hard drive?

To clarify, the USB drive was a regular hard drive in a PC that got infected. I cannot boot into the OS to run a scan. I removed it to attach it to a working PC so I can scan its file system. But, I cannot scan the registry of that hard drive, because that drive is not booted up. The hard drive was a regular Windows XP hard drive install that I removed to scan as an attached drive (with an adapter to make it a USB drive).

  • 3
    Huh? there is no "registry of an attached USB drive".
    – Molly7244
    Feb 8, 2010 at 15:15
  • I think he installed windows in his USB drive !
    – ukanth
    Feb 8, 2010 at 15:23
  • @both. I have clarified what I meant. sorry.
    – johnny
    Feb 8, 2010 at 15:24
  • 1
    So you're trying to scan the hard drive with your Windows (XP?) installation in another computer, but certain folder are inaccessible because you don't have the rights to them (as in not logged on)
    – Ivo Flipse
    Feb 8, 2010 at 15:26
  • 2
    @Martha: "USB drive" is just a generic way to refer to a device using the USB Mass Storage protocol. it's not a technical term. while "thumb drives" are perhaps the most common devices referred to with this term, telling someone it's wrong to use it in reference to a mechanical hard drive attached via USB adapter is, well, wrong. Feb 8, 2010 at 18:15

6 Answers 6


What you want to do is called 'offline registry editing'. You can load the registry hives from the old hard disk drive into your registry editor. Here's a tutorial:

Load registry hive for offline registry editing

However, I'd recommend to use BartPE instead of your current Windows installation to do this:

How to edit the registry offline using BartPE boot CD?

BartPE will recognize your external USB hard disk drive connected.

  • I absolutely second these recommendations, including doing this from a bootable environment like BartPE.
    – Alex
    Mar 12, 2010 at 8:53
  • @Molly7244: How do you hide your profile like that? I can't click through on it to see your reputation, profile, etc, and it's grayed out. (Or is that account closed?)
    – Alex
    Mar 12, 2010 at 8:54
  • if you don't want to use bartpe then just load the registry per the links then run Microsoft security essentials. It will check the loaded registry entries!
    – tonyr roth
    Apr 6, 2010 at 14:01

Personally I recommend backing up the old disk and then wiping it

This way you don't have to worry about the virus remaining behind and it's more efficient too.

Note: the problem you're having right now is probably that the host OS (you're using right now) doesn't have access to the Windows folder of your infected guest OS. Using a Linux Live CD would allow you to "ignore" these permissions and restore whatever files you need.

Alternatively you could use a virus scanner within Linux to scan the drive as well, but I'm sure a clean install will give a better and more efficient result

  • probably. I have a new image. I would like to try and clean it however. reimaging is not always an alternative. I am mounting the hives now so maybe I can see it there. Other than that I am trying the scan of the file system. thank you.
    – johnny
    Feb 8, 2010 at 15:46


  • Autostart entries - RunAlyzer shows a bunch of places applications use to get themself started upon Windows start. This is good for tweaking your system as well as finding spyware, viruses or other malware.
  • Analysis - RunAlyzer comes with a database of known entries and can do an online lookup to get the newest classifications of entries from our servers. Simple colors - green for good, red for bad - will give you the quick overview needed. Our detectives will even classify any unknown entries you submit to us through an easy function integrated into the application.
  • Log functions - Should you want to get help from another place, RunAlyzer can export log files as would be created by Spybot-S&D or HijackThis - formats that many experts all over the world prefer.
  • Windows x64 compatibility - RunAlyzer works on the new 64 bit versions of Windows as well - and allows you to view and change both 32 bit backward compatbility and new 64 bit entries there.
  • WinPE compatibility - thanks to the multi platform code we use in many of our products, RunAlyzer also automatically detects Windows installations on other attached harddisks or partitions, and allows you to manage those. This can be extremly useful if for example you want to repair a system while booting from a BartPE (bootable Windows PE) CD.

Or ubcd4win has a tool called RunScanner that let you do offline registry scan with any scanners


You might not need to worry about scanning the registry file on the infected drive.

Removing the infected files by the scans you are able to run (antivirus and antimalware/spyware) will most likely kill the infections. The registry entries will now point to missing files and so on... most likely. Put the drive back in its original system. I bet you can now boot to safe mode and run all the scans again locally... this time clearing out the registry of offensive entries, too. :)

My favorite approach has already been mentioned, though. A bartPE disk with some nice, prebuilt plugins for loading offline registries and feeding those to the scanners. This way, you don't remove the HD... you just boot a CD (or USB stick). A hand-held method to making your own disk is at http://www.ubcd4win.com/ Good luck!

  • This doesn't solve the fact the drive cannot boot into Windows. This is caused by a entry in the registry trying to load a file that no longer exists.
    – Ramhound
    Aug 16, 2012 at 16:13

Disk drives do not have registries. Your antivirus software should be able to scan a disk, which the USB drive should be recognized as.

  • The OS has a registry on the disk drive.
    – johnny
    Feb 8, 2010 at 15:25

Antivirus scanning of registry hive alone does not make sense, as there's no executable code in registry. There are only links to filesystem, and as long as filesystem is clean, registry is fine too.

But if you need to edit/search/replace something in the registry hive outside of Windows, or in the registry hive on USB HDD, you may use Emergency Boot CD ( http://www.prime-expert.com/ ) which contains standalone offline registry editor.

  • There are lots of benefits of scanning a registry file with an anti-virus, you getting ad money, for suggesting the website in your post or something?
    – Ramhound
    Aug 16, 2012 at 16:11
  • What are the aforementioned benefits of scanning a registry hive with an anti-virus exactly? I'm the author of linked software. Aug 16, 2012 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .