Repairing registry before reinstallint windows

Coriolanus

Looking for a bit of advice. A family members pc, riddled with malware, needs a reinstall. I was planning on pulling anything useful off onto an external, but when looking through some files there seems to be some registry damage. For ex, a file of photos, the properties have it being several gigs in size but the thing is empty, that kind of thing.

So, I'm wondering is there a way to repair the registry or should I just pull the drive and mount it as an external on my own pc, would that allow me access to the files or would the registry still be an issue?

Xp, service pack 3 BTW.

yoyo

Nevore wrote: »

Looking for a bit of advice. A family members pc, riddled with malware, needs a reinstall. I was planning on pulling anything useful off onto an external, but when looking through some files there seems to be some registry damage. For ex, a file of photos, the properties have it being several gigs in size but the thing is empty, that kind of thing.

So, I'm wondering is there a way to repair the registry or should I just pull the drive and mount it as an external on my own pc, would that allow me access to the files or would the registry still be an issue?

Xp, service pack 3 BTW.

I would use a bootable Ubuntu Live disc to pull all the files off the drive and re-format, sounds like something major wrong there, I've not come accross the likes of that before!

Nick

Odaise Gaelach

It sounds like a file system or hard disk drive issue rather than a registry issue.

A Ubuntu Live CD would be a good choice for recovering whatever files you can. You could also attach the drive to another computer but be very careful that whatever software nastiness that's on that drive doesn't get transmitted onto the other computer.

FSL

When you refer to a file of photos do you mean a folder which shows as several gigs but there do no seem to be any files in it?

If so are you sure the files are not hidden. Under folder options have you got show hidden files ticked under the view tab? Some malware sets all your files to hidden to make it seem they are no longer there.

A fresh install automatically recreates the registry, as opposed to a repair which retains the registry and existing files.

Coriolanus

yoyo wrote: »

Nevore wrote: »

Looking for a bit of advice. A family members pc, riddled with malware, needs a reinstall. I was planning on pulling anything useful off onto an external, but when looking through some files there seems to be some registry damage. For ex, a file of photos, the properties have it being several gigs in size but the thing is empty, that kind of thing.

So, I'm wondering is there a way to repair the registry or should I just pull the drive and mount it as an external on my own pc, would that allow me access to the files or would the registryy still be an issue?

Xp, service pack 3 BTW.

I would use a bootable Ubuntu Live disc to pull all the files off the drive and re-format, sounds like something major wrong there, I've not come accross the likes of that before!

Nick

yeah, nor I. Not an expert by any measure but I can usually put things back together again. Good thinking on the ubuntu, I have one around someplace...

AbsoluteIT

If you are going to connect the drive to your own PC make sure you disable any autorun settings. I would tend to think that malware has hidden files and changed settings within the registry. Fresh install all day long, it might be no harm in testing the harddrive before you go through the installation process.

Coriolanus

Odaise Gaelach wrote: »

It sounds like a file system or hard disk drive issue rather than a registry issue.

There were some odd error messages being thrown up, but when I try to get into task manager for example, it's denied by an "administrator". There's also some other missing functionality, the system restore and run commands aren't to be found too.

FSL wrote: »

When you refer to a file of photos do you mean a folder which shows as several gigs but there do no seem to be any files in it?

If so are you sure the files are not hidden. Under folder options have you got show hidden files ticked under the view tab? Some malware sets all your files to hidden to make it seem they are no longer there.

A fresh install automatically recreates the registry, as opposed to a repair which retains the registry and existing files.

Yeah, definitely not hidden. That was the first thing I thought too.

AbsoluteIT wrote: »

If you are going to connect the drive to your own PC make sure you disable any autorun settings. I would tend to think that malware has hidden files and changed settings within the registry. Fresh install all day long, it might be no harm in testing the harddrive before you go through the installation process.

Is there a way to quarantine the files when I pull them off onto an external? Obv she's going to want the photos, music and so on back on the pc when I get around to reinstalling...