Finding the COA serial# in the registry for XP-Pro

[casey.o]

Before I format the HDD on the computer that was infected with Sality, I
will need to extract the COA number, because it's not on the case.
Assuming regedit will function (since the virus crippled XP, after
removing the virus). The system does boot. I just need to know where
in the registry to find that number, so I can write it down.

I'm aware there are some programs to find the numbers, but even though
salitykiller says that drive was cleaned up, I'd rather not take the
chance of possibly infecting another flash drive, unless I can find a
real small utility that will fit on a floppy, because I can wipe a
floppy with a very strong magnet.

 

[Good Guy]

You can run product key from a floppy or usb and there is absolutely no
need to install anything:

<http://www.nirsoft.net/utils/product_cd_key_viewer.html>

However, please note that if the key on your machine belonged to the OEM
then it won't work with any retail or volume licensed CDs. If, however,
you injstalled the OS using your own serial number then you should be OK.

Before wiping the HD, please make sure all your personal documents,
images, videos, Emails etc etc are backed up. Once the HD is wiped
clean, there is no reversing it without incurring additional costs using
Data Recovery people. They don't come cheap.

 

[Good Guy]

Direct link is here:

<http://www.nirsoft.net/utils/produkey.zip>

 

[casey.o]

Direct link is here:

<http://www.nirsoft.net/utils/produkey.zip>

Thats what I like, a SMALL file!
Thanks

 

[micky]

Before I format the HDD on the computer that was infected with Sality, I
will need to extract the COA number, because it's not on the case.
Assuming regedit will function (since the virus crippled XP, after

I don't know how to find the number, but everyone should know that if
regedit won't work on the computer it is part of, there is at least one
program that will edit a registry that is not in use, for example, on a
drive that is connected as an external drive.

That is, get another computer C, install this program (whose name I've
forgotten) and install the harddrive whose registry you want to edit as
an external drive to C..

 

[Good Guy]

That is, get another computer C, install this program (whose name I've
forgotten) and install the harddrive whose registry you want to edit
as an external drive to C..

Very useful info. OP can easily find this wonderful program.

 

[casey.o]

I don't know how to find the number, but everyone should know that if
regedit won't work on the computer it is part of, there is at least one
program that will edit a registry that is not in use, for example, on a
drive that is connected as an external drive.

That is, get another computer C, install this program (whose name I've
forgotten) and install the harddrive whose registry you want to edit as
an external drive to C..

HUH????????????????????????????????????????????????????????

 

[casey.o]

If by "HUH?" you mean you don't understand: when the computer is not
running, the registry is just some files on the disc - but you can't
always look at them on the computer when it _is_ running (i. e. regedit
may not work).

Actually you CAN look at any file on your computer when it's NOT
running. But you have to remove your hard drive and take off it's
cover. You should be able to see any program on the platters inside.
Just look for the ones that consist of ONEs and ZEROs.

What micky is saying is, if you take the hard disc from the problem
computer and connect it as a drive other than C: (i. e. _don't_ boot
from it!) on another computer, there is a prog. that micky can't
remember the name of that will edit the registry files on that disc.

Though from your reaction ("I like a small program"), I presume you've
got the find-COA-number program someone suggested to work.

Yep, and it worked great!

 

[J. P. Gilliver (John)]

In message <[email protected]>,

HUH????????????????????????????????????????????????????????

If by "HUH?" you mean you don't understand: when the computer is not
running, the registry is just some files on the disc - but you can't
always look at them on the computer when it _is_ running (i. e. regedit
may not work).

What micky is saying is, if you take the hard disc from the problem
computer and connect it as a drive other than C: (i. e. _don't_ boot
from it!) on another computer, there is a prog. that micky can't
remember the name of that will edit the registry files on that disc.

Though from your reaction ("I like a small program"), I presume you've
got the find-COA-number program someone suggested to work.

 

[micky]

If by "HUH?" you mean you don't understand: when the computer is not
running, the registry is just some files on the disc - but you can't
always look at them on the computer when it _is_ running (i. e. regedit
may not work).

What micky is saying is, if you take the hard disc from the problem
computer and connect it as a drive other than C: (i. e. _don't_ boot
from it!) on another computer, there is a prog. that micky can't
remember the name of that will edit the registry files on that disc.

That's what I meant all right. Thanks.

As to the programs name, I got a lot of hits on
edit windows registry external drive (Maybe I should have included
"XP". I'm sure one will give the name of a good program but FF is
operating very slowly tonight.

The only one that's come up, Ehow, says, cryptically:
"This can be done by loading the registry hive files from the secondary
drive from within the Registry Editor program running on the primary
drive."

Are they talking about using the Import and then Export functions? Or
maybe they arent' talking about XP at all.

Here's another set of instructions. I havent' tried them, but it looks
like it's not for XP because XP doesnt' have "Edit> Load Hive." I
should have put XP in the search terms.

--Start quote--
A guide to edit the registry of a slaved Hard Drive on a XP System.

NOTE 1 : to edit the system hive the regedit will ask you for the key
name; search it from the
following site
URL :
http://msdn.microsoft.com/en-us/library/ms724877(VS.85).aspx

NOTE 2 : The table that shows the Registry Hive and the supporting Files
is described in the
following line.
Registry Hive : The Hive you want to edit
Supporting Files : Is the Key Name that regedit will ask for the hive
you wish to edit.

Let's Begin,

Go to
Start > run > type regedit > click on machine

File > Load Hive
Browse to the slaved Hard Drive; Windows > System 32 > Config > choose
the hive you want to edit and
search the key name from the above site.

You have full control of the registry of the Hard drive that is slaved
connected.
DO IT AT YOUR OWN RISKS!
Delta
---- End Quote

 

[micky]

That's what I meant all right. Thanks.

As to the programs name, I got a lot of hits on
edit windows registry external drive (Maybe I should have included
"XP". I'm sure one will give the name of a good program but FF is
operating very slowly tonight.

This looks like a valid way to edit an XP registry, by booting from a
CD.

http://windowsxp.mvps.org/peboot.htm

I've never understood the difference between a BartPE bootable CD and a
HIrems bootable CD. I think they're similar, so maybe one could also
boot from a Hirens CD

None of these were the program I had in mind.

 

[PaulM]

wrote in message
Before I format the HDD on the computer that was infected with Sality, I
will need to extract the COA number, because it's not on the case.
Assuming regedit will function (since the virus crippled XP, after
removing the virus). The system does boot. I just need to know where
in the registry to find that number, so I can write it down.

I'm aware there are some programs to find the numbers, but even though
salitykiller says that drive was cleaned up, I'd rather not take the
chance of possibly infecting another flash drive, unless I can find a
real small utility that will fit on a floppy, because I can wipe a
floppy with a very strong magnet.


This VBscript will retrieve your COA number: you can download the script
here:

http://www.paulsxp.com/forum/viewtopic.php?f=11&t=495