The CD Forum > Removing Deep Freeze

The CD Forum > Bart's PE Builder > General

matteochirco

May 16 2011, 05:24 PM

For those of you who don't know, Deep Freeze is a program which protects files and settings to be modified on a operating system. So each time the computer restarts, the computer goes back in its original state. That means, if I try to delete a file and empty the recycle bin with Deep Freeze installed, that file will come back exactly where it was after the computer gets restarted.

So anyway, I am trying to use Bart PE to edit some registry settings to get Deep Freeze not start up again. And before you say anything, NO, it does not appear in Add or remove programs of control panel. I tried following this guide here on answers.com and I will quote it:

QUOTE

How to Uninstall Deep Freeze for Windows 2000/XP/Vista without the password.

Note: Without a complete uninstallation you may not be able to reinstall Deep Freeze on your system.

What we are going to do is edit the registry and delete the startup references to Deep Freeze. This will prevent the Deep Freeze driver from starting up the next time you boot. (c:\windows\system32\drivers\deepfrz.sys)

1. First we need a way to edit the registry. The way to do this depends on your situation. If your computer is thawed you can simply use Regedit. If your computer is frozen or if it doesn't boot you'll need to find another way. Here are some alternatives:

If you have a multiboot computer with another copy of Windows 2K/XP you can boot from there. Or, you can physically mount the disk on another computer that uses Windows 2K/XP.

You will probably use a tool that lets you boot and edit the registry. A good example of this is PE Builder that lets you build a Windows PE CD and boot Windows from there. Or use Bart's, http://www.nu2.nu/pebuilder/ or Winternals ERD Commander.

There are several, including some USB memory sticks capable of booting like a CD. The goal here is to boot separately from your hard drive and access it while it is "asleep".

2. If your computer is thawed run Regedit. If it's not thawed follow one of the alternatives described above, and run Regedit (or Regedt32 on Windows 2K).

3. On the Find dialog box type UpperFilters and check only the Values checkbox. Then click Find Next.

4. The program will find a value with the name UpperFilters. Open this value and if there's a line with the name of the Deep Freeze driver (DeepFrz or DepFrzLo) delete it including the return, leaving the rest of the lines intact. Also, if you are using ThawSpace and you want to get rid of it delete that line too (ThwSpace), if you want to keep the ThawSpace leave it there. Press F3 to find the next match and repeat the operation until you have fixed all the UpperFilters values inside the HKLM\MySystem key.

5. Navigate to HKLM\MySystem\Select and check the value with the name Default. It has the number of the control set key that the system will use when booted. If it is 1 the control set is ControlSet001, if it is 2 the control set is ControlSet002, and so on. We'll assume the control set is ControlSet001 but you should use the one specified by the value Default.

6. Now go to HKLM\MySystem\ControlSet001\Services and delete the keys with the name of the Deep Freeze drivers (DeepFrz or DepFrzLo and DepFrzHi). Also, if you decided to get rid of the ThawSpace delete the key with the name of the ThawSpace driver (ThwSpace).

7. That's it. Now reboot and Deep Freeze will not load.

So I did what it said. I booted Bart PE with a CD and it loads successfully. Then I went into regedit as it said.

QUOTE

3. On the Find dialog box type UpperFilters and check only the Values checkbox. Then click Find Next.

4. The program will find a value with the name UpperFilters. Open this value and if there's a line with the name of the Deep Freeze driver (DeepFrz or DepFrzLo) delete it including the return, leaving the rest of the lines intact. Also, if you are using ThawSpace and you want to get rid of it delete that line too (ThwSpace), if you want to keep the ThawSpace leave it there. Press F3 to find the next match and repeat the operation until you have fixed all the UpperFilters values inside the HKLM\MySystem key.

Well, when I typed and opened up a value named "UpperFilters" it doesn't show the Deep Freeze line it it, at all. I even pressed F3 for other matches and I didn't find anything. Well that's weird because when I start up Windows Xp normally and go into the registry, I find it there. But in Bart PE it doesn't seem to show. Why is that?

That is the problem I'm getting. I'm trying to remove Deep Freeze using that guide but it won't show up in Regedit.

QUOTE

6. Now go to HKLM\MySystem\ControlSet001\Services and delete the keys with the name of the Deep Freeze drivers (DeepFrz or DepFrzLo and DepFrzHi). Also, if you decided to get rid of the ThawSpace delete the key with the name of the ThawSpace driver (ThwSpace).

I even tried that, couldn't find any folders named Deep Freeze in Bart PE. But it shows in Win Xp.

Can anyone please help me solve this, I'm trying to remove this program, and its extremely annoying of not having it removed. I would be extremely appreciated it if ANYONE at all can tell me the problem, and how I can get Deep Freeze to show in Bart PE.

Ed_P

May 16 2011, 06:16 PM

If you have BartPE running why not rename the deepfrz.sys file to something else. That will stop it from running then boot the host and edit its Registry there.

matteochirco

May 16 2011, 07:02 PM

QUOTE (Ed_P @ May 16 2011, 07:16 PM)

If you have BartPE running why not rename the deepfrz.sys file to something else. That will stop it from running then boot the host and edit its Registry there.

Well, I don't know know if that will stop it from working, but I'll try? What does that file do, and also where can I find that in Bart PE?

GladiatorWarrior

May 16 2011, 09:50 PM

QUOTE (matteochirco @ May 16 2011, 07:02 PM)

What does that file do, and also where can I find that in Bart PE?

You can do a file search in BartPE of your Windows installation and locate the "deepfrz.sys" file and rename it, Or you can try the RegistryEditorPE plug-in to remotely edit the Registry of your Host OS from BartPE. Also you could try a third-party uninstaller such as Revo Uninstaller to see it can remove the program.

nuMe

May 16 2011, 10:51 PM

QUOTE (matteochirco @ May 16 2011, 08:02 PM)

and also where can I find that in Bart PE?

At c:\windows\system32\drivers\deepfrz.sys

At a BartPE Command Prompt window enter:

rename c:\windows\system32\drivers\deepfrz.sys deepfrz.sys.stop

and press Enter.

matteochirco

May 17 2011, 12:08 AM

QUOTE (GladiatorWarrior @ May 16 2011, 10:50 PM)

So if I delete this file, is it going to prevent it from running, or do I really have to rename it. What's the difference if I delete or rename the file?

GladiatorWarrior

May 17 2011, 01:38 AM

QUOTE (matteochirco @ May 17 2011, 12:08 AM)

So if I delete this file, is it going to prevent it from running, or do I really have to rename it. What's the difference if I delete or rename the file?

Before you make any changes, I think you need to read this

To not have your question go unanswered, here's my explanation:

We don't know, you will have to try it (at your own risk). Renaming "deepfrz.sys" lets say to "deepfrzcopy.sys" should make Deep Freeze think that "deepfrz.sys" is missing, hence it will cause Deep Freeze to "malfunction",id est, to not start. Thus allowing you to make changes to your system. On the other hand, if you delete "deepfrz.sys" then any repercussions the malfunctioning of Deep Freeze may have on your system can't be undone because the file will be lost, but if you just rename the file, then you can simply change the file to its original name, which hopefully will make Deep Freeze work again.

regards,

GW

jaclaz

May 17 2011, 03:10 AM

@matteochirco
In your post you didn't mention that you loaded in BartPE the OFFLINE Registry hives.

is it not that you were looking at the BartPE Registry?

If this is the case, you should load the relevant hive, which should be in your case C:\Windows\ System32\config\system, this can be done manually or as mentioned with something like regeditPE:
http://regeditpe.sourceforge.net/

Please also note that the "answers.com" is partially deceiving, there is no certainty that the used ControlSet is ControlSet001, you should check the HKEY_LOCAL_MACHINE\SYSTEM\Select key values and anyway check ControlSet002 too (or any other ControlSet0xy), for the record I remember finding a system (actually 2K) with some 20 of them.

jaclaz

matteochirco

May 17 2011, 09:34 AM

@jaclaz

So you're saying there's a difference between offline registry editing and normal editing with Bart PE? Does that mean I have to create my bart pe CD again with having the Registry Editor PE plugin included in order to get this problem solved?

bengt

May 17 2011, 10:14 AM

http://www.out-of-warranty.com/how-to-unin...different-ways/

Ed_P

May 17 2011, 10:21 AM

QUOTE (matteochirco @ May 17 2011, 10:34 AM)

So you're saying there's a difference between offline registry editing and normal editing with Bart PE? Does that mean I have to create my bart pe CD again with having the Registry Editor PE plugin included in order to get this problem solved?

Yes, there is a difference between the Registry of the live BartPE system and that of a Windows system on a hard drive that the BartPE system can access.

And yes, you will have to recreate your CD IF you want to use the Registry Editor plugin approach. But not if you simply rename the sys file.

According to bengt's link all you have to do to disable the app is click on an icon and enter a password. Who's harddrive are you trying to change that you don't know the password of the app?

jaclaz

May 17 2011, 11:47 AM

Let's clear the Offline/Online part.

In any Windows NT based system, there are a number of files in the %windir%\system32\config or %systemRoot%\system32\config, normally:
C:\WINNT\system32\config
C:\WINDOWS\system32\config

These 5 "base" files are:
http://www.windowsnetworking.com/nt/registry/rtips64.shtml

SYSTEM
SAM
SECURITY
SOFTWARE
ntuser.dat

See also here for an insight of the booting of a NT (before Vista

)
http://www.windowsnetworking.com/kbase/Win...ctionSteps.html

Basically out of these files when booting the NT builds the Registry, i.e. the Registry is an "assembly" of "hives" corresponding to files that are in the mentioned directory (including the dinamically generated hive "HARDWARE", see above).

If you boot a NT system it's Registry is ONLINE.
If you boot *anything* else (like a BartPE) on the same machine, the Registry of any NT install on the machine is OFFLINE.

When you boot a NT system and run Regedit, you access the ONLINE registry of the NT system you booted.
When you boot (as in the case of a BartPE) a NT based PE 1.x, when you run Regedit you access the ONLINE Registry of the PE you booted, AND NOT the OFFLINE one in any "resident" NT install that may be on the machine.

One of the ways to edit an OFFLINE Registry is to LOAD one (or more) of the files that constitute it as a HIVE.

See here:
http://smallvoid.com/article/winnt-offline...istry-edit.html

What the Registry Editor PE app does is simply to AUTOMATICALLY LOAD all files of the OFFLINE Registry as HIVES in the PE's ONLINE Registry, giving them meaningful names with "REMOTE_" prepended to them, compare with the images on the given page:
http://regeditpe.sourceforge.net/

It is an utility to automate a task that you can do manually allright, without needing to re-build your PE with the added plugin.

Specifically, you ONLY need to load as hive the SYSTEM file from the system directory of the NT install.

jaclaz

matteochirco

May 17 2011, 12:20 PM

@jaclaz

Okay, I think I understand now. There are 5 main files that correspond to the registry system that are in Windows/system32/config . So if I load those files into the registry, then I should have complete access to the windows operating system registry. But if I use the Registry Editor PE plugin, then it would just do it for me automatically. Correct?

jaclaz

May 17 2011, 12:37 PM

QUOTE (matteochirco @ May 17 2011, 07:20 PM)

Correct?

Yes

, but you only need to load 1 (one) file as hive : SYSTEM

(since you need to edit some values/keys in the OFFLINE HKLM\System hive)

http://www.windowsnetworking.com/nt/registry/rtips64.shtml

jaclaz

Ed_P

May 17 2011, 01:02 PM

@jaclaz

Careful jaclaz. If he doesn't have the password this may not be his pc he's trying to hack.

jaclaz

May 17 2011, 02:44 PM

QUOTE (Ed_P @ May 17 2011, 08:02 PM)

@jaclaz

Careful jaclaz. If he doesn't have the password this may not be his pc he's trying to hack.

Well, what is the board policy?
Require proof of property?

I presume that a "real hacker":

doesn't come here for help
knows much better than OP so far has showed

In any case in my post(s) there is nothing about "hacking" and (and this is the part actually saddening me

) nothing *new*, two links to a very reputable source and online since what? 2004:
http://replay.web.archive.org/200408160739...y/rtips64.shtml
and a brief, basic explanations of things any member here very well knows (or should know).

I will gladly be careful

anyway. (though I am lost at how this can be done)

jaclaz

matteochirco

May 17 2011, 04:37 PM

@Ed_P

Don't worry, I'm not a hacker. The computer that I'm using is only for testing purposes. Besides I have 2 other computers that I own, and this one I rarely use.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.