Disable Run Commands

As many people have noticed most if not all virii put a key in your registry so that they may still "live" after you reboot your system.

Here are a couple of ways you can set your registry to deni specific startup methods on your computer. This in return will allow to to "kill" a virus simply by restarting you computer after detecting a running one.

First Find: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]

Value Names:
-DisableLocalMachineRun
-DisableLocalMachineRunOnce
-DisableCurrentUserRun
-DisableCurrentUserRunOnce

Data Types: REG_DWORD (DWORD Value)

Value Data: (0 = enable run, 1 = disable run)

Examples:
[Name]--------------------------------[Type]-----------------[Data]
DisableLocalMachineRun_______REG_DWORD_____1
DisableLocalMachineRunOnce___REG_DWORD_____1

For those who do not want to mess with the Registry, or more likely, are advising non-computer literate folks, please try

http://www.diamondcs.com.au


It is a worth a visit site, and you can download their Registry protector software, that intercepts attempts to edit the Registry. I has done the business for me on more than one occasion :)

Cheers

EDIT I have already mentioned WinPatrol from BillP Studios. Another nice little addition to your second line of defence.

I also belive that the function in Ad-Aware 6.0 called Ad-Watch will also block keys being written to Startup in your registry.

Hi spools.exe,

You are obviously a highly competent technically "savvy" person. I generally have to "mind the store" and deal with basically computer illiterate persons.

That is why I tend to go for the ready made "TV dinner" solutions.

We would probably make an excellent team?......................I haven't killed and eaten a User yet :D


You are right about AdAware, but that is their commercial version AFAIK.

WinPatrol will protect your start-up, your browser homepage and so on, and is free for private use.

My nick should tell you......."nihil" means "nothing" in Latin. That is usually the budget I am given, hence my like for freeware/no cost shareware, or write it yourself.

I like your posts and only attempt to add value if I know of a ready made solution that would be safe to deploy in a non-technical enviromnent.


Cheers

Quote:

---

We would probably make an excellent team?......................I haven't killed and eaten a User yet

---

From what i hear they don't taste as good as they sound.

nihil

Quote:

---

http://www.diamondcs.au

---

Does not work (says address can not be found.

Ooops!,


Sorry about that folks, it is:

http://www.diamondcs.com.au

It is an interesting site anyway, so please have a look :)

Spools.exe....................you could be right................in the past I have just pushed them to the side of the plate and eaten the vegetables :D


Once again, sorry about the dud link


Cheers,

Johnno

Quote:

---

From what i hear they don't taste as good as they sound.

---

lol

I don't think I've ever heard a user that actually sounds good. Usually they sound a bit... well, I'm sure you all know!

I've noticed that every theard I've looked at today has this "retard button" (I think thats how it is spelled) posting trash. Is there a way to shut him/her down without killing an otherwise good theard.

Assign positive AP to this thread!
Send an email to the admins!