[pcuser]

If you're the one that your friends and family members turn to for PC repair and virus/spyware removal then you need to have EzPcFix in your toolkit and learn how to use it. No matter how good you are, this utility WILL save you time.

EzPcFix allows you clean up your windows installation without having to even boot into windows.

How does it work?

The Win2k, XP and 2003 API has functions to load "remote" hives into the registry for editing. Here's an example of what EzPcFix does behind the scenes:

1. Open Regedit
2. Highlight HKEY_LOCAL_MACHINE
3. Goto "File" then "Load Hive"
4. When the "Open" dialog box comes up, navigate to your "Windows" folder then the "Repair" folder and then double click on "SOFTWARE".
5. An input box will come up asking for a "Key Name". You can name it anything that you want. Give it a descriptive name like "OLD_SOFTWARE".

Now expand HKEY_LOCAL_MACHINE and you'll see a new branch called "OLD_SOFTWARE". This is a backup of your original SOFTWARE hive that was created when you first installed windows. This is called loading a "remote" registry hive.

You can use this same method to load other users hives which are located at "Documents and Settings\USERNAME\NtUser.dat". The only difference is that you'll want to load them into HKEY_USERS instead of HKEY_LOCAL_MACHINE.

You can even plug in another hard drive and load hives from a completely different windows install and edit them.

This is exactly what EzPcFix does behind the scenes. When you run EzPcFix from ubcd4win, it loads the registry from the hard drive into the ubcd4win registry.

Here's what the ubcd4win registry looks like before running EzPcFix:

-My Computer
 Â  Â  Â  Â  +HKEY_CLASSES_ROOT
 Â  Â  Â  Â  +HKEY_CURRENT+USER
 Â  Â  Â  Â  -HKEY_LOCAL_MACHINE
 Â  Â  Â  Â  Â  Â  Â +HARDWARE
 Â  Â  Â  Â  Â  Â  Â +SAM
 Â  Â  Â  Â  Â  Â  Â +SECURITY
 Â  Â  Â  Â  Â  Â  Â +SOFTWARE
 Â  Â  Â  Â  Â  Â  Â +SYSTEM
 Â  Â  Â  Â  -HKEY_USERS
 Â  Â  Â  Â  Â  Â  Â +.DEFAULT
 Â  Â  Â  Â  Â  Â  Â +S-1-5-18
 Â  Â  Â  Â  Â  Â  Â +HKEY_CURRENT_CONFIG

And Here's what it looks like after EzPcFix loads the registry hives from the hard drive:

-My Computer
 Â  Â  Â  Â  +HKEY_CLASSES_ROOT
 Â  Â  Â  Â  +HKEY_CURRENT+USER
 Â  Â  Â  Â  -HKEY_LOCAL_MACHINE
 Â  Â  Â  Â  Â  Â  Â +DEFAULT_ON_C (loaded from c:\windows\system32\config\DEFAULT)
 Â  Â  Â  Â  Â  Â  Â +HARDWARE
 Â  Â  Â  Â  Â  Â  Â +SAM
 Â  Â  Â  Â  Â  Â  Â +SECURITY
 Â  Â  Â  Â  Â  Â  Â +SOFTWARE
 Â  Â  Â  Â  Â  Â  Â +SOFTWARE_ON_C (c:\windows\system32\config\SOFTWARE)
 Â  Â  Â  Â  Â  Â  Â +SYSTEM
 Â  Â  Â  Â  Â  Â  Â +SYSTEM_ON_C (c:\windows\system32\config\SYSTEM)
 Â  Â  Â  Â  -HKEY_USERS
 Â  Â  Â  Â  Â  Â  Â +.DEFAULT
 Â  Â  Â  Â  Â  Â  Â +Administrator_ON_C (c:\Documents and Settings\Administrator\NtUser.dat)
 Â  Â  Â  Â  Â  Â  Â +All Users_ON_C (same as above)
 Â  Â  Â  Â  Â  Â  Â +Default User_ON_C (same as above)
 Â  Â  Â  Â  Â  Â  Â +LocalService_ON_C (same as above)
 Â  Â  Â  Â  Â  Â  Â +NetworkService_ON_C (same as above)
 Â  Â  Â  Â  Â  Â  Â +Owner_ON_C (same as above)
 Â  Â  Â  Â  Â  Â  Â +S-1-5-18
 Â  Â  Â  Â  +HKEY_CURRENT_CONFIG

Why is this usefull?

Sometimes you can't even boot windows because of a virus that runs on startup (even in safe mode) or an incorrect/missing registry setting. All you have to do is boot ubcd4win and run EzPcFix then open "regedit" to edit the registry on the hard drive. One reason might be to disable "automatic reboot" when you can't boot into windows and it reboots too fast to even see the error message.

This setting is at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Crash Control
1=restart
0=don't restart

What else does it do?

The list is VERY long. In a nutshell, my goal is to show you what's being started from every possible location on your system.

For a detailed list, look at the links below.

How to clean-up your windows install using ubcd4win/EzPcFix:
http://www.ubcd4win....?showtopic=2162

EzPcFix Homepage:
http://www.ezpcfix.net/https://www.ubcd4win.com/l

EzPcFix Documentation:
http://www.ezpcfix.net/html/docs.html

EzPcFix Screenshots:
http://www.ezpcfix.net/html/shots.html

Tom