manual driver backup?

tobe1424 · Post by **tobe1424** » Thu Sep 02, 2010 8:13 pm

How can I backup drivers off a hard drive that does not boot. It will only boot to safe mode. I need to reformat but need the drivers.

It seems like a trojan has hijacked the apps. Every time an application tries to execute, there no file association along with it...

I just want to wipe and load and keep my drivers...keep in mind, at this point I cannot even run a utility...

Thanks in advance.

Rob

Post by **YeOldeStonecat** » Fri Sep 03, 2010 7:08 am

You can use Symantecs UnhookExec.inf to restore your file associations which are hammered by some trojans. As well as a utility called FixWin. Tools out there today to make cleaning up PCs hit by trojans/rootkits quite easy these days, instead of throwing in the towel and going through all the effort in doing a backup/format/reinstall/restore.

However, there are some free tools out there which can perform backup and restore of your drivers. Such as http://www.raymond.cc/blog/archives/200 ... r-drivers/ But if your system is tanked with file association...you'll have to fix that first before using these utilities.

Doing it manually....heh....prepare for a long task in front of you. Tracking all the files, and doing all the registry and regsrvr stuff by hand. That path isn't practical.

tobe1424 · Post by **tobe1424** » Fri Sep 03, 2010 12:26 pm

I'll give the unhook a try and keep you posted.

I also have a HDD that does not boot. Can a utility back up drivers from a slaved HDD?

Thanks again.

Post by **YeOldeStonecat** » Fri Sep 03, 2010 1:01 pm

I doubt it would be able to pull drivers from a slaved hard drive, it probably needs to be tied into the host OS so it can pull registry entries 'n such.

tobe1424 · Post by **tobe1424** » Fri Sep 03, 2010 1:33 pm

How would I utilize the unhook inf?

tobe1424 · Post by **tobe1424** » Fri Sep 03, 2010 1:40 pm

How can I even obtain it. I am having a hard time finding a good source. Even on the Symantec site. Thanks

Post by **YeOldeStonecat** » Fri Sep 03, 2010 1:56 pm

First hit on Google, Symantecs page with instructions and download link
http://www.symantec.com/security_respon ... 14-0532-99

I keep a copy of that file on my USB drive along with other tools...all you have to do is plug the drive into an infected machine, right click the file..and select "Install" from the context menu.

tobe1424 · Post by **tobe1424** » Fri Sep 03, 2010 2:16 pm

When I click on a link it opens the file. I am having a hard time finding an actual download link. Am I suppose to copy and paste the attributes within the file?

Thanks again!

Post by **YeOldeStonecat** » Fri Sep 03, 2010 2:17 pm

Right click, save as. Sometimes Firefox opens the file directly.

tobe1424 · Post by **tobe1424** » Fri Sep 03, 2010 2:38 pm

For the record...Thanks...I seem to be back on track...Hope the hurricane doesn't cause any damage up north..

-Rob