Windows
From DWIKI
Links
HOWTO
Enter rescue mode
hold shift
Gain admin access
Repair mode:
Once the machine is rebooted, we can press Shift five times on the Windows login screen to invoke Sticky Keys. Since the executable has been overwritten, what we get instead is another Command Prompt - this time with NT AUTHORITY\SYSTEM permissions
Tools and commands
mmc
wmi
Windows Management Instrumentation
mmi
setacl
netsh
Third party tools
Viruses and spyware
- http://www.malwarebytes.org/
- http://www.combofix.org/
- crapcleaner
First let the scanners fetch their updates, disconnect system from network and then run malwarebytes before combofix
virus scanners
- AVG
- avira
- avast
avoid Norton :)
FAQs
change NT password
Boot a linux rescue CD containing chntpw and use that, or boot sysrescuecd and select 'ntpasss'
collect passwords
http://www.maxfreeware.com/cain-and-abel-4920-microsoft-password-recovery.html
Recovery console
Boot from CD, press R for recovery console
recovery console commands
Error logs
Problem access rights profile
(exact message???)
seems related to "prf*tmp" files on stored profile
