08.11.05

Removing startup items - regedit, msconfig

Posted in Malware, Windows at 3:37 pm by Keith

If you don’t allready know about this tip then read carefully and error on the side of caution. It involves editing the Windows registry; which can ruin your Windows installation (i.e. computer won’t start) if done incorrectly. If in doubt get help from a professional.

Most malware programs set themselves to start automatically when the computer starts up. They do this by making an entry in one of a few specific directories in the registry. Removing these entries will prevent these malware programs from starting automatically, making them less bothersome and easier to remove.

You can edit the registry with regedit. To start regedit go to the start menu and select Run…, then type in regedit and click the OK button. The Registry Editor will open with a list of directories on the left side. The directories you are looking for are named Run, RunOnce, or other variations beginning with Run. They are located in two different places: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\. You can go through each of these Run folders and look for anything suspicious. It isn’t a good idea to remove everything from these Run folders (and don’t remove the folders themselves!); most of these entries will likely be legitimate such as your antivirus program, CD burning software, or display drivers/applications. Delete keys corresponding to any malware (do a google search for the key/executable name if in doubt) from each of these Run folders. After rebooting the corresponding malware shouldn’t start up. Now you can run your antivirus/spyware-removing programs with a better chance of getting rid of that pesky malware.

Another easier and safer, although not quite as thorough, way to access the same information is through msconfig (not available in Windows 2000). Go to the start menu and select Run…, then type in msconfig and click OK. The System Configuration Utility will open. Click on the Startup tab. Now you can look through the list that comes up for anything that you don’t want to start automatically, unchecking the corresponding check-box. Again, be careful not to remove anything you need. After clicking on the OK button you will be prompted to restart the computer. After restarting you will get a warning that the System Configuration Utility has been used, uncheck the box on this warning so that it won’t bug you everytime you reboot and click OK.

further info

Share This

Permalink Comments

08.10.05

Opening attachments in OE

Posted in Software, Windows at 10:36 am by Keith

Outlook Express can sometimes be overzealous in its email attachment blocking. However, before using the following instructions for disabling this attachment blocking check out this attachment opening lecture. If you feel it is safe to proceed…

Start Outlook Express.
On the Tools menu, click Options.
Click the Security tab, click to clear the Do not allow attachments to be saved or opened that could potentially be a virus check box under Virus Protection, and then click OK.

Share This

Permalink Comments

Attachment Opening Lecture

Posted in Malware, Windows at 10:08 am by Keith

Although there are some viruses that can infect your computer without user intervention through unpatched or unknown vulnerabilities most infections are enabled through the actions of the computer user. The most common method is email attachments. You should keep this in mind every time an attachment shows up in your inbox. There are some common sense things you can do to avoid opening a virus-laden attachment.

First and most important: don’t open an attachment that you aren’t expecting. Even if it is from someone you know! Many viruses will send through the infected computer’s email program or spoof the sender so that it looks like the email came from someone you know and trust.
Check out the file extension. If the file has a common file extension like .jpg or .gif it is probably safe. If you don’t recognize the file extension look it up. If it is any kind of executable file don’t open it (.pif, .scr, or .exe). Also, don’t be fooled by something like monkeypicture.jpg.exe; it’s the last file extension that matters. This is far from a foolproof method; so refer to rule #1.
Keep your PC up to date and secure. If you do open a virus-laden attachment it is less likely to do damage if your PC is up to date and secure. That means running Windows Update frequently (at least once per month), and running and updated Virus scan program (Bit Defender, AVG, McAfee, Nortons)

Share This

Permalink 1 Comment

08.06.05

Killing Aurora Popups

Posted in Malware, Windows at 7:50 pm by Keith

TeChico has a great write-up on how to get rid of Aurora popups. Aurora, A.K.A. ABI is some particularly nasty adware. So far the adware removal programs seem to have trouble with this one so TeChico’s manual removal instructions are your best bet. The fix is pretty involved and involves downloading a few files, but it will get the job done and may be the only option short of re-installing Windows.

Share This

Permalink 1 Comment

08.05.05

malware removal tricks

Posted in Malware, Windows at 5:31 pm by Keith

A couple general tricks for removing malware from a Windows machine:

Turn off System Restore

Windows’ System Restore will sometimes restore the malware that you are trying to remove. So, before you reboot your computer after removing malware do the following: right-click on My Computer and select Properties; click on the System Restore tab; click the check box for Turn off System Restore on all drives; click OK. Then go ahead and reboot the computer. You should turn System Restore back on after rebooting (just uncheck that check box); it may come in handy some time.

Boot to Safe Mode

The Windows operating system has multiple modes. Safe Mode does its best to only start the most basic of Windows functions; not allowing most malware to start automatically. Some malware programs know how to disable or hinder malware-removal programs, so it is best to make sure the malware isn’t running before you try to remove it. To access a non-default mode press the F8 key while your computer boots up. You will be presented with a short list of boot up options. Using your keyboard select Safe Mode and press Enter. Things will look a little different in Safe Mode; the resolution will probably be much lower than usual. Go ahead and run your malware removal program(s), such as Ad-Aware or Bit Defender and reboot when finished.

It is a good idea to use one or both of these techniques (even in tandem) when trying to get rid of pesky adware, spyware, and viruses.

Share This

Permalink Comments