Disable Run Commands

[spools.exe]

As many people have noticed most if not all virii put a key in your registry so that they may still "live" after you reboot your system.

Here are a couple of ways you can set your registry to deni specific startup methods on your computer. This in return will allow to to "kill" a virus simply by restarting you computer after detecting a running one.

First Find: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]

Value Names:
-DisableLocalMachineRun
-DisableLocalMachineRunOnce
-DisableCurrentUserRun
-DisableCurrentUserRunOnce

Data Types: REG_DWORD (DWORD Value)

Value Data: (0 = enable run, 1 = disable run)

Examples:
[Name]--------------------------------[Type]-----------------[Data]
DisableLocalMachineRun_______REG_DWORD_____1
DisableLocalMachineRunOnce___REG_DWORD_____1

[nihil]

For those who do not want to mess with the Registry, or more likely, are advising non-computer literate folks, please try

http://www.diamondcs.com.au


It is a worth a visit site, and you can download their Registry protector software, that intercepts attempts to edit the Registry. I has done the business for me on more than one occasion

Cheers

EDIT I have already mentioned WinPatrol from BillP Studios. Another nice little addition to your second line of defence.

[spools.exe]

I also belive that the function in Ad-Aware 6.0 called Ad-Watch will also block keys being written to Startup in your registry.

[nihil]

Hi spools.exe,

You are obviously a highly competent technically "savvy" person. I generally have to "mind the store" and deal with basically computer illiterate persons.

That is why I tend to go for the ready made "TV dinner" solutions.

We would probably make an excellent team?......................I haven't killed and eaten a User yet


You are right about AdAware, but that is their commercial version AFAIK.

WinPatrol will protect your start-up, your browser homepage and so on, and is free for private use.

My nick should tell you......."nihil" means "nothing" in Latin. That is usually the budget I am given, hence my like for freeware/no cost shareware, or write it yourself.

I like your posts and only attempt to add value if I know of a ready made solution that would be safe to deploy in a non-technical enviromnent.


Cheers

[spools.exe]

We would probably make an excellent team?......................I haven't killed and eaten a User yet

From what i hear they don't taste as good as they sound.

[moxnix]

nihil

http://www.diamondcs.au

Does not work (says address can not be found.

[nihil]

Ooops!,


Sorry about that folks, it is:

http://www.diamondcs.com.au

It is an interesting site anyway, so please have a look

Spools.exe....................you could be right................in the past I have just pushed them to the side of the plate and eaten the vegetables


Once again, sorry about the dud link


Cheers,

Johnno

[da'dodo]

From what i hear they don't taste as good as they sound.

lol

I don't think I've ever heard a user that actually sounds good. Usually they sound a bit... well, I'm sure you all know!

[PoSer]

I've noticed that every theard I've looked at today has this "retard button" (I think thats how it is spelled) posting trash. Is there a way to shut him/her down without killing an otherwise good theard.

[Jnet]

Assign positive AP to this thread!
Send an email to the admins!