Edit Windows startup applications from Linux
I'm dealing with a Windows 7 that has got a virus that starts immediately on startup, locking the screen. It also runs in safemode (even with command prompt only). Only option is to switch the computer off by press and holding the power button.
The computer also has an Ubuntu installation, so Linux access is easy. I have been searching for a way to edit windows startup applications from Ubuntu, but with no success.
Is such a thing possible? I.e., how can I edit windows registry from Linux? If not possible, what other option do I have?
You can:
- mount the windows partition in Ubuntu
-
install chntpw:
sudo apt-get chntpw
This program will allow you to edit the registry key in Windows. You can then edit the following registry keys in order to edit which programs startup in windows.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
DISCLAIMER: Editing the registry on a windows machine is risky. You can easily make the system inoperable if you edit the wrong keys.
Boot from the CD windows 7.
Press Shift + F10. In cmd run regedit.
Mount the registry hives from your HDD.
Remove startup items.
See too \SOFTWARE\Wow6432Node\ analogy key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_CURRENT_USER\DEFAULT\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths
HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder
HKLM\Software\Microsoft\Windows\CurrentVersion\DeleteFiles
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
HKLM\Software\Microsoft\Windows\CurrentVersion\Extensions
HKLM\Software\Microsoft\Windows\CurrentVersion\ExtShellViews
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings
НКM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage
HKLM\Software\Microsoft\Windows\CurrentVersion\RenameFiles
HKLM\Software\Microsoft\Windows\CurrentVersion\Setup
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers
HKLM\Software\Microsoft\Windows NT\CurrentVersion\drivers.desc
HKLMXSoftware\Microsoft\Windows NT\CurrentVersion\Drivers32\0
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Embedding
HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI
HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI Extensions
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Ports
HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
cmd autorun:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
AutoRun
filesystem.
Powershell autorun:
%ALLUSERSPROFILE%\Documents\Msh\profile.msh
%ALLUSERSPROFILE%\Documents\Msh\Microsoft.Management.Automation.msh_profile.msh
%USERPROFILE%\My Documents\msh\profile.msh
%USERPROFILE%\My Documents\msh\Microsoft.Management.Automation.msh_profile.msh
Init MS-DOS environment 64-bit Windows:
%windir%\SysWOW64\AUTOEXEC.NT
%windir%\SysWOW64\CONFIG.NT
Init MS-DOS environment 32-bit Windows:
%windir%\system32\AUTOEXEC.NT
%windir%\system32\CONFIG.NT
later it will be possible to write a script to automatically remove trojans from the registry and file system ... + 7 days
//TODO: script ...
Measures to prevent virus activity
disable autorun drive command:
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0xff /f