I've just received a laptop that has a nasty malware/ransomware (you can find more details here)

From what I've read it's enough for me to start in safe mode and remove some items from startup run a removal tool and I'm all done. The problem is that I can't boot in safe mode.

Because of all of that I've connected the hdd to my laptop and I was hoping I'd find a way to edit the registry files from my PC. Is there any way to do that ?

System Configuration:

  • Windows 7 Ultimate x86
  • HP Compaq 6720s

Maybe not msconfig, BUT you can remove any entries in the registry that are present, just open regedit on your machine, then open the ntuser.dat file under the user's folder on that hard drive. The location of startup items that are in msconfig can be found in the registry (googlable). I forget where the .dat file for the hklm key is but it's googlable. Also, usually these virii nowadays only corrupt the user's profile, so deleting the reg key for the user's profile usually resolves. (I didn't read your link, not sure of the severity of the virus).

  • Thank for you're help, i'll look into it. The virus is pretty nasty cant use the computer, cant do anything no task manager, no cmd, no nothing and without safe mode i think it's kind of hard to clean it without a proper format – Bobby Tables Feb 27 '13 at 19:05
  • 1
    I've seen those, and that no task mgr no cmd happens whenever anyone logs in? Not just primary user but local admin as well? I've had great experience w/ Malwarebytes cleaning that, I don't work for them. – MDMoore313 Feb 27 '13 at 19:07

Take a look at Kaspersky Rescue Disk. It allows you to boot your computer into an anti-virus environment, allowing you to scan and clean your computer without booting up Windows.

Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is so severe that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities (such as Kaspersky Virus Removal Tool) running under the operating system.

In this case, disinfection is more efficient because malware programs do not gain control when the operating system is being loaded. In the emergency repair mode, you can only start objects scan tasks, update databases roll back updates and view statistics.

EDIT: It also appears that there is a similar tool from the link you provided under the Removal Option 2 Using Anvi Rescue Disk to Remove the Ransomware and Repair the Infected Computer heading.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.