Windows

Links

• Administrator and User Passwords in Windows XP

• Cloning Windows/XP
• A Troubleshooting Guide to Windows XP

HOWTO

Enter rescue mode

hold shift

Gain admin access

Repair mode:

Once the machine is rebooted, we can press Shift five times on the Windows login screen to invoke Sticky Keys. Since the executable has been overwritten, what we get instead is another Command Prompt - this time with NT AUTHORITY\SYSTEM permissions

Tools and commands

wmi

Windows Management Instrumentation

Third party tools

• ccleaner

Viruses and spyware

• The liveCD list
• Hitman Pro

• http://www.malwarebytes.org/
• http://www.combofix.org/
• crapcleaner

First let the scanners fetch their updates, disconnect system from network and then run malwarebytes before combofix

virus scanners

• AVG
• avira
• avast

avoid Norton :)

FAQ

Get hostname from image

C:\Windows\debug\NetSetup.LOG

Passwords

change NT password

Boot a linux rescue CD containing chntpw and use that, or boot sysrescuecd and select 'ntpasss'

collect passwords

http://www.maxfreeware.com/cain-and-abel-4920-microsoft-password-recovery.html

Recovery console

Boot from CD, press R for recovery console

recovery console commands

• Description of the Windows XP Recovery Console

Problem access rights profile

(exact message???)

seems related to "prf*tmp" files on stored profile

Get hardware info

cpu-z