On Fri, 17 Feb 2017 14:22:45 -0800, T wrote:

On 02/17/2017 03:47 AM, Shadow wrote:
On Wed, 15 Feb 2017 15:51:53 -0800, T wrote:

Hi All,

I have a customer with ransomware. I'd like to
look at his registry off line with Linux.

Other than the miserably SSSSLLLLOOOOWWW one that comes
on the Kaspersky Rescue CD, does anyone know of a
graphical Windows registry editor that run on Linux?


The Kaspersky editor (binary) can be moved to another
partition, and you can boot the PC with a Linux OS on another disk and
use the editor from there. Works (or used to) with Debian.

It's called "RegistryEditor".. If you use 7-zip or something
to extract it from the image, don't forget to make it executable.

I tried that and couldn't get it to work. How did you do that?

Easiest way, boot the Kaspersky rescue disk, copy the binary
to your home folder, in which case making it executable is not
necessary.
You can probably find it under \usr\sbin\
Or, you can extract it from your Kaspersky Rescue Disk USB
using 7-Zip (L:\ being my pendrive)

L:\rescue\rescue.iso\rescue\LiveOS\squashfs.img\Li veOS\ext3fs.img\usr\sbin\RegistryEditor

$ chmod +x RegistryEditor
$ ./RegistryEditor

Don't forget the ./ before the executable, if it's not on your
path

Just did it, it's very fast, as fast as Window's regedit.
HTH
[]'s


The "SSSSLLLLOOOOWWW" is because you are running it from the CD.
--
Don't be evil - Google 2004
We have a new policy - Google 2012