I was given a computer that came installed with a deepfreeze workstation program.
The password was not known, so deep freeze can not be uninstalled the traditional way. I am determined to uninstall it manually so none of the files are lost.
The workstation was from an licensed enterprise deepfreeze console. If you don't know much about deepfreeze it can be found here:
System Restore Software for Enterprise: Deep Freeze Enterprise â
I installed a trial version of enterprise and created my own workstation executable on another computer. I then installed the workstation executable on a virtual machine and traced the install using revo uninstaller.
I read the trace and wrote down all of the files and registry items that looked important.
Then I booted the computer using ubcd live beta found here:
https://www.ultimatebootcd.com/ubcdlive.html
The reason for using this is it comes with a built in gui registry editor.
Here are the list of important looking files that it installs:
C:/
Persi0.sys
Persi0.dsk
Soft~on.dsk
Program Files (x86)/
Faronics (whole folder)
System32/Drivers/
DeepFrz.sys
DfDiskLo.sys
DFFilter.sys
FarDisk.sys
FarSpace.sys
Windows/SysWOW64/
DFC.exe
I can delete all of those just fine. But then the mouse and keyboard is frozen on the computer screen.
On to the important looking registry entries:
HKLM/system/currentcontrolset/control/class:
They are also created in all of the currentcontrolsets e.g. currentcontrolset001 and 003. Still a little confused as to why.
Starting with:
4D36E967: this is the Disk Drives class
4D36E96B: this is Keyboard class
4D36E96F: this is Mouse class
71A27CDD: this is Storage Volumes class
In the Disk Drives class, it adds LowerFilters with a multi_sz of DfDiskLo. It modifies the already existing UpperFilters by appending DeepFrz to the beginning.
In the Keyboard it modifies the already existing UpperFilters by appending DeepFrz to the beginning.
In the Mouse class it modifies the already existing UpperFilters by appending DeepFrz to the beginning.
In the Storage Volumes class, it adds UpperFilters with a multi_sz of DeepFrz and FarSpace.
Those are the main registry entries that I believe do all of the dirty work. Some more though that are still important:
system/currentcontrolset/control/services:
DeepFrz
DfDiskLo
DFFilter
FarDisk
Farspace
What I did next was delete all of the upperfilters and lower filters, and add them back with their default windows values. Then windows would say starting windows, never load the logo and give me a bsod.
What now? The registry was what I thought would fix it. I created a backup of the registry by copying system in system32/config so I could restore it.
Here I've attached the workstation file so you can try tracing it as well.
https://drive.google.com/file/d/0B_u6weYp5wTCQTFuS0pCOUc4a1U/view?usp=sharing
The password was not known, so deep freeze can not be uninstalled the traditional way. I am determined to uninstall it manually so none of the files are lost.
The workstation was from an licensed enterprise deepfreeze console. If you don't know much about deepfreeze it can be found here:
System Restore Software for Enterprise: Deep Freeze Enterprise â
I installed a trial version of enterprise and created my own workstation executable on another computer. I then installed the workstation executable on a virtual machine and traced the install using revo uninstaller.
I read the trace and wrote down all of the files and registry items that looked important.
Then I booted the computer using ubcd live beta found here:
https://www.ultimatebootcd.com/ubcdlive.html
The reason for using this is it comes with a built in gui registry editor.
Here are the list of important looking files that it installs:
C:/
Persi0.sys
Persi0.dsk
Soft~on.dsk
Program Files (x86)/
Faronics (whole folder)
System32/Drivers/
DeepFrz.sys
DfDiskLo.sys
DFFilter.sys
FarDisk.sys
FarSpace.sys
Windows/SysWOW64/
DFC.exe
I can delete all of those just fine. But then the mouse and keyboard is frozen on the computer screen.
On to the important looking registry entries:
HKLM/system/currentcontrolset/control/class:
They are also created in all of the currentcontrolsets e.g. currentcontrolset001 and 003. Still a little confused as to why.
Starting with:
4D36E967: this is the Disk Drives class
4D36E96B: this is Keyboard class
4D36E96F: this is Mouse class
71A27CDD: this is Storage Volumes class
In the Disk Drives class, it adds LowerFilters with a multi_sz of DfDiskLo. It modifies the already existing UpperFilters by appending DeepFrz to the beginning.
In the Keyboard it modifies the already existing UpperFilters by appending DeepFrz to the beginning.
In the Mouse class it modifies the already existing UpperFilters by appending DeepFrz to the beginning.
In the Storage Volumes class, it adds UpperFilters with a multi_sz of DeepFrz and FarSpace.
Those are the main registry entries that I believe do all of the dirty work. Some more though that are still important:
system/currentcontrolset/control/services:
DeepFrz
DfDiskLo
DFFilter
FarDisk
Farspace
What I did next was delete all of the upperfilters and lower filters, and add them back with their default windows values. Then windows would say starting windows, never load the logo and give me a bsod.
What now? The registry was what I thought would fix it. I created a backup of the registry by copying system in system32/config so I could restore it.
Here I've attached the workstation file so you can try tracing it as well.
https://drive.google.com/file/d/0B_u6weYp5wTCQTFuS0pCOUc4a1U/view?usp=sharing
My Computer
- Computer type
- PC/Desktop
- OS
- windows 7 and 8, 64 bit.
