Help accessing files / registry keys on a Windows partition

[trant]

I am booting Knoppix to try and solve a situation I have with a Windows machine.

This machine was infected with various Trojans and the scanner programs I use can find an infected file under \Windows\System32 as well as several bad registry entries but it is unable to remove any of them.

So I tried doing it in Knoppix. First, I browsed the hard drive for the file under \Windows\System32. It's not there. Knoppix does not see it. But I know it's there because I tried deleting it in Windows but it wouldn't let me with "access denied" error.

Then I tried Knoppix's regedit program to clear the bad keys. I follow the path to the bad key and suddenly realize there are so many entries missing from the tree. I can't find any of the bad keys plus alot of normal keys are not there.

Is there an option to show these hidden files and hidden registry keys which I need to use?

[Harry Kuhman]

Since you didn't say, I'll assume that you have a NTFS partition. If so, do not write to NTFS with Knoppix. You would likely corrupt your data completely. Instead, get whatever data you want off the old system (I do this by putting a FTP server on another Windows box and transfering files by FTP but there are several ways to do it including USB flash drive formatted with a FAT partition).

Even if you have a FAT partition with Windows on it, the registry is a Windows database and it may not be reasonable to edit keys within it from Linux. Maybe there is some program that will do it, or maybe you can run the windows registry editor under wine. But I wouldn't advise it and would still suggest the above option to be safe.

[Dee.El]

there is also a windows boot disk, http://www.ubcd4win.com/ ultimate boot disk, this has a reg editor, as well as some other useful windows based utiiities, for scewered win installs.

[ckamin]

Why take the chance on corrupting your NTFS partition by writing to it with Linux? There are other options that use the original Micro$oft drivers. Google "Bart PE" and/or "Windows PE". Microsoft offers a PE version for Vista, that will allow you to work with your NTFS partitions. The Vista PE requires a little work to extract the PE tool. You would have to make a Bart PE disk, but they are worth the effort if you need to access NTFS partitions. They are both "live" disks using Window$. There are others available as well, but these are the most popular. You can add different tools to customize the disks if you need to.

I would use Knoppix or Linux as a "Read Only" tool for NTFS. I would not wish to chance data loss by writing to it, even with the latest linux drivers.