Kaspersky WindowsUnlocker is a free program by Russian security company Kaspersky that you can use to remove the effects of malware that is blocking you from accessing parts or all of the system.

The program ships as an ISO image that you need to burn on CD or copy to an USB device before you can make use of it. The program itself runs independently from the Windows operating system so that the malware has lesser options to block it from doing its deeds.

You can use Kaspersky’s USB Rescue Disk Maker to copy the contents on a USB device, or a CD burner like ImgBurn if you prefer to burn the program to CD.

Once copied or burned, you need to configure the target computer to boot first from CD or USB. You will see the Kaspersky Rescue Disk boot screen if that operation was successful.

You are then asked to select one of the available interface languages. Available are roughly 20 different languages from English and German to Swedish and Dutch.

Select graphic mode on the next screen. You can alternatively boot the program in text mode, display hardware information, reboot or boot from the hard disk instead.

Click on the start button and select Kaspersky WindowsUnlocker from the available selection. The program runs automatically now and starts disinfecting the Registry. Results are displayed directly in the program window so that you can keep an eye on what’s happening on your computer.

A log file is generated in the /var/kl or /var/tmp/ folder for each program run. Once you have finished the operation, reboot your computer, change the startup device to hard drive and boot into the Windows operating system.

If everything worked out, you should have access to your system again. And while this does not resolve all situations you may run into, it certainly can help you if ransom ware locked you out of your own computer (thanks Raymond)

The portable software program offers a selection of tools that can be included in the bootable disk image or copied to an USB device. The utilities are grouped into the four tabs antivirus, utility, Linux Live and Windows PE.

It is possible to select multiple programs of a group. The antivirus tab for instance offers to include the AVG Rescue Cd, Avira AntiVir Rescue System, Dr. Web Live Cd and the Kaspersky Kav Rescue CD among other choices. A click on a program downloads it to the local system, another click adds it to the disk image so that the rescue disk can be accessed whenever the system is booted from that CD, DVD or USB stick. A few rescue disks and programs need to be downloaded manually. A click on the program button launches a web page with the download option instead.

Sardu displays the total size of the current selection in the interface, there is however no indication of the size of individual tools. This would have been handy to make the selection process easier if there is a size limit for the rescue disk image.

The utilities group offers popular applications including Clonezilla, Gparted, Partition Wizard or the Ultimate Boot CD.

Linux Live CDs can be downloaded and integrated in the third group. Popular choices include Ubuntu, Damn Small Linux, Puppy Linux or BackTrack.

The fourth and final category lists options to include Windows PE on the rescue disk. Available are Windows PE 1.x, Windows PE > 2 and Windows Recovery Disks.

It is possible to download most of the disk images directly and place them in the ISO folder of the application. That can be helpful for users who want to download multiple rescue and system disks at once. Sardu can only download one file at a time, and downloading them externally can help speed downloads up. All images are linked on the Sardu project website.

Once the downloads and selections have been made it is time to create the iso image if the rescue disk should be burned on CD or DVD, or to copy the rescue disks to a connected USB device.

It is pretty easy to create a rescue disk with Sardu 2. The only problem that I have encountered during review is that some of the messages are in Italian, even if English is selected as the language. This has not been a big problem though as it was always clear what the notification meant.

Sardu is available for download at the developer website. (via)

Most antivirus rescue disks are supplied in the disk ISO format and need to be burned to CD or DVD. Kaspersky recently started to offer the Kaspersky USB Rescue Disk Maker which, as the name suggests, can create a bootable rescue disk on an USB flash drive.

Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is so severe that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities (such as Kaspersky Virus Removal Tool) running under the operating system.

Two downloads are necessary to create the bootable Kaspersky USB Rescue Disk:

• The most recent ISO image of Kaspersky Rescue Disk 10 [link]
• The Kaspersky USB Rescue Disk Maker [link]

The USB device needs to use the FAT16 or FAT32 file system, and not NTFS.

To create the bootable USB rescue disk do the following:

• Install Kaspersky USB Rescue Disk Maker on the PC.
• Browse to the ISO image of the Kaspersky Rescue Disk in the program interface after startup, and select one of the connected USB devices. This device will be used to create the bootable rescue disk.

kaspersky usb rescue disk

A click on Start copies the relevant files from the ISO image to the USB drive.

It is important to test the USB rescue device at least once, to make sure that it will work in emergencies. It is usually necessary to enable booting from removable devices in the BIOS, so that the boot process picks up the USB rescue disk before the actual operating system(s) on the hard drive.

Kaspersky’s Rescue Disk can be used to disinfect systems that have been rendered unbootable by a virus and in scenarios where it is not possible to disinfect the virus while the operating system is running.

It is naturally also possible to burn the ISO image to CD or DVD, if that is preferred.

The core program can be downloaded directly from the developer’s website. It does not ship with any of the antivirus rescue disks or system tools though. It is up to the user to download them individually with the possibility to skip programs by simply not downloading them.

The program itself is divided into four tabs that list the various tools that are supported by the antivirus rescue disk. The Italian interface can be switched to several other languages. A click on any entry will open a website with download possibilities. Some websites are also shown in the Italian language but it is usually not a big problem to change those to another language like English or German to download the tool in the right language.

The downloaded images and tools have to be placed in the right directory so that the program will recognize them during the creation of the bootable disk image. Here is the list of supported antivirus rescue CDs and other tools:

antivirus: Avira Antivir Rescue System, Bitdefender, Dr. Web Live CD, F-Secure, GData, Kaspersky Kav Rescue CD, Panda Safe CD and VBA Rescue

utility: Floppy win98SE, Clonezilla, Gparted, NT password, Parted Magic, System Rescue CD, Ultimate Boot CD

Linux: Austrumi, Damn Small Linux, NimbleX, Puppy Linux, Slax

PE: LiveXP, MegalabCD, WindowsPE, UBCD4Win, VistaPE

The program offers then to create either an ISO image which can be burned to CD and DVD or to make to copy the files to an USB device and make that device bootable.

Shardana Antivirus Rescue Disk Utility is slightly more complex to setup initially. The tools that are combined on the disk or USB device on the other hand might make it an interesting option for users who usually run multiple antivirus programs and utilities in situations where they are needed.

The program can be downloaded from the developer’s website.

The approach has a few advantages but also a disadvantage. The advantage is obviously that you can use it to remove known viruses, trojans, worms and other malicious software even if the computer cannot be booted into the operating system anymore. And since it is a standalone client it is not dependent on an installed anti-virus client but can be used on any computer that can be booted from CD. This also means that the program is independent from the installed operating system.

The disadvantage of the approach is that the virus definitions cannot be updated that easily and that it normally means that the full boot disk would have to be downloaded and burned to CD again meaning that this would have to be done regularly to stay up to date.

The good news is that you can download the Kaspersky Rescue Disk freely from an Kaspersky FTP and burn it to CD or DVD using a CD burning software like Nero.

The computer has to boot from the media and the boot sequence can be set in the computer BIOS. Make sure that the computer checks the DVD drive for a bootable device before it pulls the data from the hard drives.

The interface of the Rescue Disk is straightforward. It basically allows you to scan the computer for malicious software and offers ways to remove any that are found. This does not give a guarantee that the computer can be booted again after the cleanup though. A damaged file normally does not get repaired by anti-virus software.

I know that a lot of users reinstall Windows if they have forgotten their password because they cannot figure out how to get into the system again. I’m using the Trinity Rescue Kit to reset the Windows password. You actually have the choice between setting it to a blank password or changing it to a new one.

It can be run from a bootable CD, USB device or network over PXE. The bootable CD is my choice and I always keep one around in case of emergency. Just boot from the CD if you cannot login into Windows anymore because it asks for a password that you cannot remember.

You can start once the message “Welcome to Trinity..” appears on the screen. Use the command winpass -l to list all usernames of the system. Now enter winpass -u (for instance winpass -u Martin). This will lead to a series of dialogs, make sure to press n when asked if you want to deactivate Syskey.

You are given a choice to (1) remove the password, (2) set a new password or (3) make the selected user an administrator of the system.

That’s actually just one tool that the Trinity Rescue Disk offers. I could write about other useful ones if you like. Oh, one last remark. The file system is based on Linux which means that you will not see the usual c,d,e drives like you do in Windows. Hda, hdb, hdc are the hard drives connected to your computer and the numbers behind are the partitions of those hard drives. Hda1 for instance means the first partition of the first hard drive which is usually the location of the Windows installation while hdc2 would refer to the second partition of the third hard drive.

Start pebuilder.exe which is located in the BartPe folder. Select No at the beginning and put your Windows XP disc in the drive. Now browse to the drive in Source and pick the drive letter of the CD. Click on Build afterwards and Yes to create the new directory. Bart PE processes the files on the disk now and should end the process without Warnings.

Please note that this is only working if you have Windows XP with Service Pack 2 on the disk. If you have an old CD you need to download the Service Pack 2 from Microsoft so that it can be integrated. Click on Source > Slipstream in Bart PE afterwards, check Source is read only and add the downloaded Service Pack 2 under Servicepack. Click on OK afterwards. Below is a screenshot of that process.

Move the folder srsp1 into the newly created BartPE directory (the directory where all the files from the Windows XP Cd have been copied into, not the root folder with pebuilder.exe).

Adding additional applications:

The default USB Rescue Stick contains several useful applications such as Check Disk and a File Manager. It is possible to add additional applications, called plugins, to the Rescue Stick. I would suggest to at least include a CD Burning Program and some applications that scan the computer for Trojans and Malicious software.

The plugins listing at the official website lists a lot of plugins, I would like to explain how plugins are added and leave it up to you which you add to your Rescue Stick.

If you click on the Plugins button you notice the enabled tab which either says YES or NO. No means the plugin is not installed yet. I will use the Irfanview example to explain how to add plugins that have not been enabled yet. Those require additional files most of the time.

Mark the IrfanView row and click on help. A website should pop up explaining what to do. In this case two files from the IrfanView software that can be downloaded from the IrfanView developers have to be added to the BartPE plugins directory.

A great plugin package can be downloaded from the WinBoard, it adds plugins for Firefox, 7-Zip, Acrobat Reader, several routers, Putty and Raid drivers (which I had to deactivate because they created an error during installation).

Creating the bootable USB Stick:

Open the command window again and use the following command from within the root BartPe folder to copy the files to the USB stick. (g: is the drive letter that could be different on your computer.)

pe2usb -f g:

The first part of this article explains what you need to create an USB Rescue Stick both hardware and software wise. All required download links are given in this part so that you can start the downloads right away. The second part will describe how the rescue stick can be created and configured.

You do need an USB stick that has at least 256 Megabytes of space and a motherboard that supports booting from USB sticks. Consult the manual of your motherboard to see if this is possible or try it out by connecting an USB stick to your computer and opening the bios configuration.

Preparing the System:

You do need a software called Bart PE which will be used to create the bootable USB Rescue Stick, two files from the Microsoft Windows 2003 Server Service Pack 1 download and the Windows XP Service Pack 2 CD.

Download Bart PE and install or unpack it. We need to unpack the Windows 2003 Server Service Pack 1, this is done using the following command in the command line. (Start > Run > cmd > Enter)

Change to the directory of the executable and enter the following phrase:

>WindowsServer2003-KB889101-SP1-x86-ENU.exe /x

This asks for a directory to unpack the executable to, just enter one and hit enter. Hint: You do not have to enter the full file name, just start typing and hit tab after WindowsServer and Windows should fill out the rest of the filename automatically so taht you only need to add /x at the end.

Now create a new directory, name it srsp1 for example and move the following two files into that directory: ramdisk.sy_ and setupldr.bin which are both located in the i386 folder after unpacking the Service Pack 1. The rest of the folders and files of the service pack can be deleted afterwards.

We have to expand the file ramdisk.sy_ afterwards. This is also done from the command line. Change the directory to the SP1 folder and enter the following command:

expand ramdisk.sy_ ramdisk.sys

Now delete the old ramdisk.sy_ file in the directory. We have finished all preparations and the article will continue in part 2.