Tag: malware

RegEdit and Task Manager are two useful Windows tools for managing your computer. RegEdit allows you to edit the Windows registry, a global configuration setting repository. Task Manager, on the other hand, allows you to start and stop applications and processes among others.

What’s one use for these tools? Malware cleanup. Typically viruses, worms, and other malware would be hooked up into your registry to run upon Windows startup. You need to stop the malware process using Task manager. Press Ctrl-Alt-Delete, Select the Processes tab, choose the malware process, and click End Process. Of course you’ll need to know the name of the process. If I don’t, I would normally just stop everything I can and then run regedit :P

Once the malware process is (hopefully) stopped, you would want to be able to  edit out  their entries in the registry using RegEdit. Click Start->Run…, type “regedit”, and press Enter. Typically malware startup values would be under “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run”). Just carefully delete them.

Now here’s a  problem: Some malware disables both these tools. The solution? Use alternate tools that provide the same or even bettter functionality such as RegAlyzer and Task Killer.

One big cause for your computer getting infected by viruses, worms, and other malware would be Window’s autorun “feature”. Plug in a hard disk, optical disk, memory card, etc and autorun launches and runs a program. Guess what that program usually is? Yup, malware.

So one of the easiest ways to protect your computer is to simply disable autorun. There are many ways to do it but by far, this procedure from annoyances.org works best for me:

1. Click Start->Run…
2. Type “regedit” and press Enter.
3. Navigate the tree on the left pane to “My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies”
4. Expand “policies”
5. If there’s no “Explorer” folder, right-click “policy” and select New->Key. Type “Explorer” and press Enter.
6. Open the “Explorer” folder.
7. If there’s no “NoDriveTypeAutoRun” entry on the right pane, right-click on it and select New->DWORD Value. Type “NoDriveTypeAutoRun” and press Enter.
8. Right click on “NoDriveTypeAutoRun” and select Modify
9. Enter “ff” on the Value Data Field and select Hexadecimal for Base. Click OK
10. Close Regedit
11. As with anything you do in Windows, restart your computer.

Voila! No more autorun.