Windows Registry Reader

[Will]

Has anyone created a utility that will open up registry files from another
workstation and (ideally) modify entries within those registries?

This would be a perfect utility for recovering from some kinds of viruses,
as you could inspect all of the lines where a virus takes control at boot
time and remove those in a sterile environment. Having removed the
offensive lines you could reinsert the boot device to the original system
and restart it.

We make multiple backups of server registry files, but the value of these is
lessened by our inability to inspect those and make decisions about which
ones to use in a recovery based on their content.

 

[Karl Strausser]

Will,

Isn't this a server protection issue. In the 10 years I've worked
with Windows servers the only time I found an infected one was because
of inadequate protection and vigilance. I learnt a lot from that one
and never again.

Concentrate on the protection side of things, of your server and its
clients, and education of your end-users if you do not want to
implement group policies, and, in my opinion, that will be more
effective than looking for the type of utility you're looking for,
particularly since for serious viruses people like Symantec produce
removal tools.


Karl


Has anyone created a utility that will open up registry files from
another
workstation and (ideally) modify entries within those registries?

This would be a perfect utility for recovering from some kinds of
viruses,
as you could inspect all of the lines where a virus takes control at
boot
time and remove those in a sterile environment. Having removed the
offensive lines you could reinsert the boot device to the original
system
and restart it.

We make multiple backups of server registry files, but the value of
these is
lessened by our inability to inspect those and make decisions about
which
ones to use in a recovery based on their content.

 

[Carl Nettelblad]

regedit (or regedt32 in Windows 2000, in Windows 2003 Server normal regedit
can do it directly) is capable of mounting arbitrary registry "hives" from
SYSTEMROOT\system32\config for editing. I've found this useful in some
scenarios where a drive image was manually transferred to a different
controller to redirect the drive letter association, for example.

Carl

 

[Will]

Carl, I have had this problem as well with redirecting the drive letter
association. How do you correct that.

Thanks for the tip on regedit. Boy, I guess I didn't think about that one.