Registry Fix After Trojan Infection

[Dogpatch]

This is a very common problem. A computer gets infected by a trojan or virus, new antivirus software detects the trojan or virus and cleans it, but does not fix the registry changes by the trojan or virus, so you still suffer from the trojan or virus having been there.

You can't run Task Manager, and/or the Administrator account is disabled, and so on.

You can't connect to internet, deleting all protocols and the NIC ethernet controller and reinstalling doesn't work, you still aren't allowed to set up an internet connection to True manually, and so on.

There are a lot of registry fix programs out there, but none of them I've seen really address repairing settings by trojans. viruses, and dialers.

Does anyone have any experience with this where you can recommend a registry fix program for this?

[AlexLah]

Urrrrrr.....

Hijack this could be of help. it looks for hooks as well.

Go here for Highjack this and some other usefull progs: http://www.spywareinfo.com/~merijn/programs.php

But in a worst case scenario like you describe I would do a unconditional format and a fresh install.

And then before you hook up on the net I would install the following:

All Windows updates

Zonealarm go here: http://www.zonealarm.com/store/content/cat...=US〈=en

HitmanPro (activate Surfright) Go here: http://www.hitmanpro.nl/hitmanpro/content/view/3/9/lang,en/

A-vast anti virus go here: http://www.avast.com/eng/download.html

Windows defender

Download the PDF and disable some not needed services: http://www.digitalmediaminute.com/article/...can-be-disabled

Processguard go here: http://www.diamondcs.com.au/processguard/

Go here: http://www.grc.com/default.htm and download:Shoot the messenger and unplug and pray and run them.

Once you are online, update all progs and run them. Close down Processguard before you run HitmanPro after it is finished switch on again.

This should keep you save unless you click all kind of .exe, .Scr files visit Pron sites without knowing what they are and what they do.

I hope this helps.

Alie

[Dogpatch]

Thanks, Alie, it was very kind of you to compose such a useful and thorough response.

It looks like HijackThis is the best solution for repairing the registry.

Notably, I use Kaspersky antivirus and firewall because many reviewers give it high ratings in tests finding real threats, and it takes the minimum of system resources. Indeed, it has worked most smoothly from my experience. However, the latest version has new parental control features which are active by default! They block so many normal, non-adult websites. They read the page in advance and look for keywords, and if those keywords exist then they block the page. Just go into config and disable parental control and you're OK, though it's not quick and easy to figure out and find.

A techie friend told me: "most viruses will anyway not be caught by a active scanner ... these times are over ... there should be a network scanner so the virus won't detect that they are getting scanned ... usally viruses these days are smart enough to eliminate first the virus scanner." Not so sure how accurate this is.

[stumonster]

A techie friend told me: "most viruses will anyway not be caught by a active scanner ... these times are over ... there should be a network scanner so the virus won't detect that they are getting scanned ... usally viruses these days are smart enough to eliminate first the virus scanner." Not so sure how accurate this is.

he is correct

a lot of malware will replace the virus/malware scanner/s with their own modified version and will even go as far as removing any malware that is not part of its systems.

the trend is now to installing rootkits which are really not detectable by most AV software and usually require a full re install of the OS to be sure they have been removed

[quiksilva]

are these so called "zero day" anti virus solutions useful with these new viruses? These are said to operate based on a activity, as opposed to signatures?