Here is a new one (for me): on one machine a virus/trojan has changed file
associations to point at itself to re-infect the machine each time a known
filetype is invoked. The problem is that the virus also locked out the
ability for local administrator to even view what those associations are,
probably by changing the DACL. How do I take back control and view the
associations?

--
Will

Re: How to Take Back Control of Filetype Associations by Malke

Malke
Fri Feb 23 18:41:06 CST 2007

Will wrote:
> Here is a new one (for me): on one machine a virus/trojan has changed file
> associations to point at itself to re-infect the machine each time a known
> filetype is invoked. The problem is that the virus also locked out the
> ability for local administrator to even view what those associations are,
> probably by changing the DACL. How do I take back control and view the
> associations?
>

Try running an antivirus scanner from a Bart's PE. Otherwise just back
up your files and clean-install Windows.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Re: How to Take Back Control of Filetype Associations by Will

Will
Fri Feb 23 21:35:02 CST 2007

"Malke" <notreally@invalid.invalid> wrote in message
news:eiyW5x6VHHA.1432@TK2MSFTNGP02.phx.gbl...
> Try running an antivirus scanner from a Bart's PE. Otherwise just back
> up your files and clean-install Windows.

It's really a separate thread, but how do you like Bart's PE? I haven't
tried building one, but I have always wondered how can store enough device
drivers to anticipate all of the many possible boot environments? Do they
only work with BIOS enabled storage controllers, or do they have a provision
to load additional drivers?

I'd really like to buy one premade from a commercial entity but I guess
Microsoft's licensing prevents anyone from selling it.

--
Will



Re: How to Take Back Control of Filetype Associations by Malke

Malke
Sat Feb 24 07:05:42 CST 2007

Will wrote:
> "Malke" <notreally@invalid.invalid> wrote in message
> news:eiyW5x6VHHA.1432@TK2MSFTNGP02.phx.gbl...
>> Try running an antivirus scanner from a Bart's PE. Otherwise just back
>> up your files and clean-install Windows.
>
> It's really a separate thread, but how do you like Bart's PE? I haven't
> tried building one, but I have always wondered how can store enough device
> drivers to anticipate all of the many possible boot environments? Do they
> only work with BIOS enabled storage controllers, or do they have a provision
> to load additional drivers?
>
> I'd really like to buy one premade from a commercial entity but I guess
> Microsoft's licensing prevents anyone from selling it.
>

I usually use Knoppix and other tech tools instead of a Bart's but I
know techs who prefer Bart's. For questions about Bart's PE, go to their
user forum which is very active and helpful.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Re: How to Take Back Control of Filetype Associations by Will

Will
Sat Feb 24 15:35:22 CST 2007

"Malke" <notreally@invalid.invalid> wrote in message
news:%23wnD%23RBWHHA.4260@TK2MSFTNGP06.phx.gbl...
> I usually use Knoppix and other tech tools instead of a Bart's but I
> know techs who prefer Bart's. For questions about Bart's PE, go to their
> user forum which is very active and helpful.

Does anyone sell a commercial Knoppix boot disk that has tools for
administering Windows 2003/XP? Any pointers to the vendor's web site are
appreciated.

--
Will



Re: How to Take Back Control of Filetype Associations by Ian

Ian
Sun Feb 25 03:28:05 CST 2007

BartPE is relatively easy to build, and only a small download as you get most
of the files from a Windows CD. I find it's best to use a Server 2003 CD as
this is more up-to-date than XP, the PE built from this definitely works
better.

Driver-wise it works on the vast majority of kit without problems. Which is
more than can be said for Microsoft's Vista-based WinPE II, which for me
wouldn't work even on some commonplace mobos like Acer laptops.

The advantage of PE over Knoppix is of course the ability to run Windows
(and DOS) apps natively; not all apps will work but a large proportion do. A
PE disc with Servant Salamander* added is now my preferred approach for
copying profiles disk-to-disk when replacing a computer; this method avoids
all the hassles of admin logon, FSTW, etc.

Both PE and Knoppix have their strengths though; for example Knoppix will
often recover data from a damaged NTFS partition, when Windows won't even
mount it.

* http://www.altap.cz

"Will" wrote:

> It's really a separate thread, but how do you like Bart's PE? I haven't
> tried building one, but I have always wondered how can store enough device
> drivers to anticipate all of the many possible boot environments? Do they
> only work with BIOS enabled storage controllers, or do they have a provision
> to load additional drivers?
>


Re: How to Take Back Control of Filetype Associations by Malke

Malke
Sun Feb 25 10:29:34 CST 2007

Will wrote:
> "Malke" <notreally@invalid.invalid> wrote in message
> news:%23wnD%23RBWHHA.4260@TK2MSFTNGP06.phx.gbl...
>> I usually use Knoppix and other tech tools instead of a Bart's but I
>> know techs who prefer Bart's. For questions about Bart's PE, go to their
>> user forum which is very active and helpful.
>
> Does anyone sell a commercial Knoppix boot disk that has tools for
> administering Windows 2003/XP? Any pointers to the vendor's web site are
> appreciated.
>

No. Knoppix is Linux and cannot natively and safely write to NTFS. I
believe TrendMicro (or one of the other antivirus companies) sells a
Bart's with their antivirus on it. Google for it or look on the Bart's
forums.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User