linux:notes:windows_registry_recovery

Table of Contents

Information
Unmark Dirty
Mount R/W
Delete Key
Unmount

Information

Deletes bad values under Image File Execution Options\dwm.exe
Source
2025/05/14: Tested with openSUSE Leap LiveUSB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe

Unmark Dirty

sudo ntfsfix '/dev/sda2'

Mount R/W

sudo mkdir -p '/run/media/linux/Windows'

sudo ntfs-3g '/dev/sda2' '/run/media/linux/Windows'

Delete Key

chntpw -e '/run/media/linux/Windows/Windows/System32/config/SOFTWARE'

ls Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe

rdel Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe

Unmount

sync && sudo umount '/dev/sda2'

/usr/local/www/wiki/data/pages/linux/notes/windows_registry_recovery.txt · Last modified: 2025/05/16 21:39 by 127.0.0.1