В связи с вирусами в винде и невозможностью запусить regedit, понадобилась возможность редактировать реестр извне. Нашел, пока, единственную утилиту в линуксе chntpw, которая изначально разрабатывалась для сброса паролей, а потом приобрела функцию редактирования реестра.
Редактирование реестра:
1. Загружаемся с LiveCD или устанавливаем второй системой Ubuntu
2. Устанавливаем утилиту chntpw
sudo aptitude install chntpw
3. Подключаем раздел windows
Смотрим где он:
sudo fdisk -l
ищем ntfs раздел и монтируем:
$ sudo mkdir /media/windows
$ sudo mount /dev/sda2 /media/windows
4. Редактируем реестр
chntpw -l /media/windows/Windows/system32/config/software
Редактирование осуществляется перемещением по веткам, например:
cd Microsoft\Windows NT\CurrentVersion\Winlogon
и самим редактированием ключей, например:
ed Shell
Сброс пароля:
1. Пункты 1-3 предыдущего параграфа
4. Смотрим у какого пользователя будем менять пароль
chntpw -l /media/windows/Windows/system32/config/SAM
5. Сбрасываем пароль
chntpw /media/windows/Windows/system32/config/SAM -u Administrator
Сразу привожу места в реестре где могут скрываться записи о запуске вирусов:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Значения по умолчанию в Regedit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"
"Userinit"="C:\WINDOWS\system32\userinit.exe"
Проверьте файл Explorer.exe на наличие двойника… правильно лежать ему в папке Windows\ но не в Windows\System32\...
Эта статья была написана в дополнение темы борьбы с вирусами и sms-вымогателями
Очистка windows от вирусов с помощью Ubuntu
Если эта публикация вас вдохновила и вы хотите поддержать автора — не стесняйтесь нажать на кнопку
If you have forgotten your administrator password for Windows, you can use a Ubuntu Linux live CD or live USB to reset the password. This tutorial will show you how to do that, step by step.
There are many ways to get Ubuntu Linux. You can find more details about that here.
If you run into any problems or have any questions, the folks at the Ubuntu Forums are very helpful and friendly.
I will not be answering any support questions posted as comments here.
Step 1: Boot up Ubuntu
With the Ubuntu CD in your optical drive or with the Ubuntu USB plugged into your computer, make sure your BIOS is set to boot from CD or USB before your hard drive. You can usually enter your BIOS settings by pressing F1, F2, F9, F10, F12, Esc, or Del during bootup, depending on the kind of computer you have.
After Ubuntu boots up, you’ll be asked if you want to try Ubuntu or install it. You definitely want to just try it at this point.
Step 2: Install the password reset software
Installing software on Ubuntu is a bit different from installing software on Windows. Instead of going to a website to download setup files, you just tell the software package manager what you want installed, and it fetches it for you off some servers. It’s a lot like the iTunes App Store or Android Market.
This does assume that you have a working internet connection (wired preferred, but wireless can work, too). If, for some reason, your internet connection isn’t working on the computer you want to reset the password for, you can also download the chntpw .deb using another computer, transfer it over via USB, and then double-click it to install it.
First we want to make sure we have the proper software sources enabled to install chntpw.
Go to System > Administration > Software Sources
Make sure both the Universe and Multiverse repositories are checked (or “ticked,” if you’re not American). Click Close and then, when prompted, click Reload.
Wait for the information about available software to reload.
Go to System > Administration > Synaptic Package Manager
(Note: to those of you who have installed software in Ubuntu before, you actually do—at least as of Ubuntu 10.04—have to go to Synaptic to install chntpw. You can’t install it through Ubuntu Software Center).
Press Control-F or click on the Search button to get the search dialogue up. Then search for chntpw.
(Note: you may be tempted to type chntpw into the search filter but it won’t show up there, since Synaptic hasn’t had time to rebuild the search index for quick filtering.)
Once chntpw pops up in the search results, right-click it and select Mark for Installation.
Click Apply, and then, when prompted, click Apply again.
Wait for the Synaptic to download and install chntpw.
Step 3: Mount your Windows drive
In order for you to reset your Windows password, you have to make the Ubuntu live session know that your Windows drive is available for use. This process is called “mounting.”
To mount Windows, just click on Places and then select your drive. It will be listed by the size of the drive (in this example, 80 GB).
Step 4: Reset your password
chntpw is a terminal-based (not point-and-click) application, so to use it, we’ll have to open up a command-line terminal. Don’t be intimidated. I’ll walk you through the process.
To open the terminal, go to Applications > Accessories > Terminal
I’m going to be offering a lot of explanation for those who aren’t experienced with the terminal and commands, but if you want to just skip over all that stuff, feel free to just pay attention to the terminal commands and ignore the explanations.
cd /media/493D9CB55373C3DD/Windows/System32/config/
First, you’re going to cd (change directories) to the right Windows directory.
Start typing cd /media/ and then hit the Tab key, and it’ll autocomplete with the address of your mounted Windows drive.
Then type W and hit Tab again to get to either Windows (Windows 7) or WINDOWS (Windows XP). Yes, the terminal is case-sensitive, so upper- and lower-case matters!
Type S or s and hit Tab again to get System32 or system32 (again depending on whether it’s Windows 7 or Windows XP—I forget which it is for Windows Vista).
And do the same for config.
Tab completion makes things a lot simpler, so you don’t have to type every single word out. It also avoids the whole typo issue, in case you aren’t a good typist.
Once you’ve gotten to cd /media/name-of-your-windows-drive/Windows/System32/config or cd /media/name-of-your-windows-drive/WINDOWS/system32/config, hit Enter.
sudo chntpw -u username SAM
You should then type in sudo chntpw -u username SAM, where username is your actual username. For example, if your username is susan, it should be sudo chntpw -u susan SAM
After you type that in, hit Enter, and you’ll see a whole bunch of terminal output, most of which you can ignore:
chntpw version 0.99.5 070923 (decade), (c) Petter N Hagen
Hive
name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c
Page at 0x7000 is not ‘hbin’, assuming file contains garbage at end
File size 262144 [40000] bytes, containing 6 pages (+ 1 headerpage)
Used for data: 260/20240 blocks/bytes, unused: 9/4144 blocks/bytes.
* SAM policy limits:
Failed logins before lockout is: 10
Minimum password length : 4
Password history count : 4
| RID -|———- Username ————| Admin? |- Lock? –|
| 01f4 | Administrator | ADMIN | dis/lock |
| 01f5 | Guest | | dis/lock |
| 03e8 | susan | ADMIN | |
———————> SYSKEY CHECK <————————
SYSTEM SecureBoot : -1 -> Not Set (not installed, good!)
SAM Account\F : 0 -> off
SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4)
Syskey not installed!
RID : 1000 [03e8]
Username: susan
fullname:
comment :
homedir :
User is member of 1 groups:
00000220 = Administrators (which has 4 members)
Account bits: 0x0214 =
[ ] Disabled | [ ] Homedir req. | [X] Passwd not req. |
[ ] Temp. duplicate | [X] Normal account | [ ] NMS account |
[ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act |
[X] Pwd don’t expir | [ ] Auto lockout | [ ] (unknown 0x08) |
[ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) |
Failed login count: 0, while max tries is: 10
Total login count: 100
This part is important, though:
– – – – User Edit Menu:
1 – Clear (blank) user password
2 – Edit (set new) user password (careful with this on XP or Vista)
3 – Promote user (make user an administrator)
(4 – Unlock and enable user account) [seems unlocked already]
q – Quit editing user, back to user select
Select: [q] >
I would highly recommend typing 1 to blank the password instead of editing the password. After you type that, hit Enter, and you should see
Password cleared!
Hives that have changed:
# Name
0
Write hive files? (y/n) [n] :
Type y and hit Enter to confirm the change. Once you see
then you’re done.
Now you can reboot, and you can log into your admin account with a blank password. Once you’re logged in, you can go to the Control Panel to change your password to something else—something you can remember.
If you’re curious, you can see an older version of this page.
If you can’t log in even after trying your twelve passwords, or you’ve inherited a computer complete with password-protected profiles, worry not — you don’t have to do a fresh install of Windows. We’ll show you how to change or reset your Windows password from a Ubuntu Live CD.
This method works for all of the NT-based version of Windows — anything from Windows 2000 and later, basically. And yes, that includes Windows 7.
Note: If you have files on your hard disk encrypted using built-in Windows encryption, they may not be available after changing the Windows password using this method. Exercise caution if you have important encrypted files.
You’ll need a Ubuntu 9.10 Live CD, or a bootable Ubuntu 9.10 Flash Drive. If you don’t have one, or have forgotten how to boot from the flash drive, check out our article on creating a bootable Ubuntu 9.10 flash drive.
The program that lets us manipulate Windows passwords is called chntpw. The steps to install it are different in 32-bit and 64-bit versions of Ubuntu.
Installation: 32-bit
Open up Synaptic Package Manager by clicking on System at the top of the screen, expanding the Administration section, and clicking on Synaptic Package Manager.
chntpw is found in the universe repository. Repositories are a way for Ubuntu to group software together so that users are able to choose if they want to use only completely open source software maintained by Ubuntu developers, or branch out and use software with different licenses and maintainers.
To enable software from the universe repository, click on Settings > Repositories in the Synaptic window.
Add a checkmark beside the box labeled «Community-maintained Open Source software (universe)» and then click close.
When you change the repositories you are selecting software from, you have to reload the list of available software. In the main Synaptic window, click on the Reload button.
The software lists will be downloaded.
Once downloaded, Synaptic must rebuild its search index. The label over the text field by the Search button will read «Rebuilding search index.» When it reads «Quick search,» type chntpw in the text field. The package will show up in the list.
Click on the checkbox near the chntpw name. Click on Mark for Installation.
chntpw won’t actually be installed until you apply the changes you’ve made, so click on the Apply button in the Synaptic window now.
You will be prompted to accept the changes. Click Apply.
The changes should be applied quickly. When they’re done, click Close.
chntpw is now installed! You can close Synaptic Package Manager. Skip to the section titled Using chntpw to reset your password.
Installation: 64-bit
The version of chntpw available in Ubuntu’s universe repository will not work properly on a 64-bit machine. Fortunately, a patched version exists in Debian’s Unstable branch, so let’s download it from there and install it manually.
Open Firefox. Whether it’s your preferred browser or not, it’s very readily accessible in the Ubuntu Live CD environment, so it will be the easiest to use. There’s a shortcut to Firefox in the top panel.
Navigate to http://packages.debian.org/sid/amd64/chntpw/download and download the latest version of chntpw for 64-bit machines.
Note: In most cases it would be best to add the Debian Unstable branch to a package manager, but since the Live CD environment will revert to its original state once you reboot, it’ll be faster to just download the .deb file.
Save the .deb file to the default location.
You can close Firefox if desired. Open a terminal window by clicking on Applications at the top-left of the screen, expanding the Accessories folder, and clicking on Terminal.
In the terminal window, enter the following text, hitting enter after each line:
cd Downloads
sudo dpkg —i chntpw*
chntpw will now be installed.
Using chntpw to reset your password
Before running chntpw, you will have to mount the hard drive that contains your Windows installation. In most cases, Ubuntu 9.10 makes this simple.
Click on Places at the top-left of the screen. If your Windows drive is easily identifiable — usually by its size — then left click on it.
If it is not obvious, then click on Computer and check out each hard drive until you find the correct one.
The correct hard drive will have the WINDOWS folder in it. When you find it, make a note of the drive’s label that appears in the menu bar of the file browser.
If you don’t already have one open, start a terminal window by going to Applications > Accessories > Terminal.
In the terminal window, enter the commands
cd /media
ls
pressing enter after each line. You should see one or more strings of text appear; one of those strings should correspond with the string that appeared in the title bar of the file browser earlier.
Change to that directory by entering the command
cd <hard drive label>
Since the hard drive label will be very annoying to type in, you can use a shortcut by typing in the first few letters or numbers of the drive label (capitalization matters) and pressing the Tab key. It will automatically complete the rest of the string (if those first few letters or numbers are unique).
We want to switch to a certain Windows directory. Enter the command:
cd WINDOWS/system32/config/
Again, you can use tab-completion to speed up entering this command.
To change or reset the administrator password, enter:
sudo chntpw SAM
SAM is the file that contains your Windows registry. You will see some text appear, including a list of all of the users on your system.
At the bottom of the terminal window, you should see a prompt that begins with «User Edit Menu:» and offers four choices. We recommend that you clear the password to blank (you can always set a new password in Windows once you log in). To do this, enter «1» and then «y» to confirm.
If you would like to change the password instead, enter «2», then your desired password, and finally «y» to confirm.
If you would like to reset or change the password of a user other than the administrator, enter:
sudo chntpw —u <username> SAM
From here, you can follow the same steps as before: enter «1» to reset the password to blank, or «2» to change it to a value you provide.
And that’s it!
Conclusion
chntpw is a very useful utility provided for free by the open source community. It may make you think twice about how secure the Windows login system is, but knowing how to use chntpw can save your tail if your memory fails you two or eight times!
Столкнулись с проблемой, когда нужно восстановить забытый или потерянный пароль к Windows? Или просто нужно получить доступ к чужому компьютеру? =) Не суть важно, главное — нужен доступ к компьютеру под управлением Windows. Существует немало программ и способов обойти или сбросить пароль Windows, но самым действенным способом я считаю сброс пароля через Linux. В данной статье я расскажу о двух способах: первый — с помощью утилиты для Ubuntu, второй — с помощью CD-образа.
Итак, способ первый:
Необходимо установить утилиту chntpw:
sudo apt-get install chntpwДалее нужно примонтировать раздел с Windows, и перейти в него из консоли. Например, раздел с Windows мы примонтировали по адресу /media/win. Таким образом, в консоли переходим в данную директорию:
cd /media/win/Windows/system32/configОбратите внимание, регистр символов имеет значение, «WINDOWS», «Windows» и «windows» — не одно и то же.
Если нам нужно сбросить пароль системной учетной записи Администратора, запускаем:
sudo chntpw SAMЕсли же нужно сбросить пароль пользователя (администратора) vasya, то пишем:
sudo chntpw –u vasya SAMПосле выполнения команды вам будет предложено несколько вариантов: сбросить пароль, установить новый, сделать пользователя администратором, разблокировать пользователя.
Способ второй:
Воспользовавшись любой программой, записывающей ISO-образы, создаем загрузочный диск с утилитой (скачать которую можно отсюда). После чего перезагружаем компьютер, грузимся с диска (в BIOS должна быть включена первоочередная загрузка с CD-ROM), и следуем подсказкам утилиты.
Вот, собственно, и все =)
Windows has an in-built option to create password reset disk to log into system in case a user forgets the Windows account password. However, in a worst case scenario, where you don’t have a password reset disk nor have access to any administrator account, Ubuntu Live disk may help. In this article, we will guide you through step-by-step procedure of resetting Windows user account password.
While Ubuntu Live CD is widely used to troubleshoot PC problems, you can use it to reset Windows user account passwords as well. The process requires creating a Ubuntu Live CD or Live USB, and then booting it to gain full system access for resetting forgotten Windows password.
Note: This method is free and easy for Linux users. For Windows users, we recommend you to try the Reset Windows Password bootable utility – Which is based on Windows PE and you can use it to easily reset forgotten Windows password on Windows 8/7/Vista/XP/2008/2003/2000.
Step 1: Create a Bootable Ubuntu Live USB
To get started, grab Universal USB Installer, and then download Ubuntu 10.10 (32-bit or 64-bit) from here.
Launch Universal USB Installer, select Ubuntu 10.10 from drop-down menu, and then click Browse to select the Ubuntu ISO file. Now, select the USB drive letter and set the persistent file size.
Once all settings are in place, click Create to begin creating a bootable Ubuntu Live USB.
Step 2: Boot from Ubuntu Live USB
After the Ubuntu Live USB is created, reboot your PC and access computer BIOS by pressing ESC, F2, F10, F9 or other system defined key. Head over to Boot menu and set USB/Removable Hard disk as first boot option. Once boot priority is changed, save the changes and reboot the system. From boot menu, choose Run Ubuntu from this USB option to load Ubuntu 10.10.
Step 3: Install Chntpw
Once your booted into Ubuntu, hit Ctrl + Alt + T to open a Terminal window. I know this may seem a little scary but it is actually quite easy. Once this window is open, simply type sudo apt-get install chntpw and hit Enter. It should download and install the program without needing further assistance. Once it’s finished and your back at the regular prompt, simply type exit and hit Enter. Now you should be back on the Desktop.
Step 4: Reset Windows Password
Now, you need to mount the hard disk partition where Windows is installed. You will be able to access all the removable drives and hard disk partitions from Places menu.
Open all partitions to find the drive with Windows folder. When you find it, make a note of the drive’s label that appears in the menu bar of the file browser.
Once the drive with Windows folder is mounted, open Applications menu from panel, and select Terminal from Accessories menu.
In Terminal window, enter cd /media command, and then list all mounted media drives with ls command.
Once listed, you have to navigate to drive that contains Windows folder. Enter the following command to do so.
cd <hard drive label>
Since we have to make changes to Security Accounts Manager (SAM), which is residing in Windows/System32/config folder. Enter:
cd Windows/System32/config
Once you’re in config folder, use chntpw tool to read Windows user account credentials and make changes to saved passwords. Enter following command to run chntpw tool.
sudo chntpw SAM
The chntpw shows all the configured Windows user accounts with their current status.
It presents 4 different Windows user account tweaking options at the bottom, including clear the admin account password, replace current password/edit password, promote standard user, and unlock locked user accounts. You can reset Windows admin user account password by pressing ‘1’ followed by ‘Y’, However, to edit the admin password, press ‘2’, enter a new password, hit enter and then press Y to change the password.
The sudo chntpw SAM command can only make changes to Windows admin account password. If you want to change standard user’s password, use the switch –u followed by correct user account name.
sudo chntpw –u <user account name> SAM
Once you’ve changed the user account password, reboot your system, and plug out Ubuntu Live USB. If you’ve just reset the admin password, Windows will not prompt you to enter the password. However, if you changed the password, use the new password to log in to Windows.
- Previous Post: Can’t Copy Text from a PDF File?
- Next Post: How to Switch User Account in Windows?