My Problem:

I got a neat little Problem concerning my Windows installation. I noticed a malicious looking executable in my Windows/temp folder and choose to scan my PC with Hitman Pro and Malwarebytes. Malwarebytes adware cleaner certainly found something. A registry key was flagged as PUP.Adware.Heuristic.

Sadly after it deleted the key i lost internet connection. After a quick restart of my PC i realized that i got an infinite boot screen.

I luckily have a dual boot with Arch Linux on it which gave me access to the disk, i installed windows on (access via mount). The adware cleaner did a backup of the reg key name, aswell as the data saved inside of it on my windows disk.

HKCUSOFTWARE67452301efcdab8998badcfe10325476a is the deleted reg key and i got the data in form of raw bytes inside of an unknown format file.

What i tried:

After a quick backup of all my registry files i tried to directly merge my NTUSER.DAT and the “key” – file, which as most of you might already expect resulted in nothing.

My Approach might be to use something like “chntpw” to create the key in HKCUSOFTWARE and then somehow transfer the data from the backup file into the key, though my knowledge about the windows registry is to small to do that savely and without completely destroying everything which is the reason i am here to ask 🙂

I have about 300 GB of pretty important stuff on that disk so a windows reinstall would be bad, even though i know it would probably be the best option regarding an unknown executable was in my temp folder