របៀប Kill Virus​ នៅក្នុង Regedit

មេរោគ Play boy virus

1_Kill process

2_Program>  Run > regedit .exe

3_HKEY_LOCAL_MACHINE\Software\Microsoft\windows\current version\ policy\explorer\Run( Delete Data Type in Run)

4_search *.exe

មេរោគ Oh la la world virus

It just makes your computer slowly than before.

1_We kill process:   SVIQ.EXE ;    FUN.EXE ;   DC.EXE ;

2_HKEY_CURRENT_USER\Software\Microsoft\windows\current version\Run (Delete Data Type in run)

3_HKEY_CURRENT_USER\Software\Microsoft\windows NT\Current Version\Windows ( Delete tMél in Data Type load & Run )

4_HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\Current Version\Winlogon (change tMél shell to explorer.exe)

5_search *.exe

មេរោគ My Funny virus

We can’t open process taskmgr end process and show hidden file on windows

1_Easy to kill go to safe Mode, choose Safe  Mode with Command Prompt

2_Prees Crtrl+Alt+Delete and then click File>Create new task>Type regedit.exe

3_HKEY_CURRENT_USER\Software\policies\Microsoft\Windows\ system (Delete system or disable CMD )

4 HKEY_CURRENT_USER\Software\Microsoft\windows NT\current version\ Windows (delete tMél Value Data in load)

5_HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\Current Version\Policies ( Delete Key all except Non enum ; Ratings ; system )

6_HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\Run ( Delete Winsys)

7_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\ Current Version\Winlogon (change tMél shell to explorer.exe)

8_Close regedit > click File>Create new task>Type explorer.exe

9_Search *.exe *.com *.vbs

10_Delete New Story.reg and Recyle Bin

 មេរោគ Phnom Penh virus

When we open window, it’s showed doll picture. It’s hidden regdit, search, folder option and control panel.

1_Kill process ” window.exe“

2_Drive C:\>window\ double click on regedit.exe

3_HKEY_CURRENT_USER\software\Microsoft\windows\currentversio\ policies\explorer ( delete all exept No drive type Auto Run )

4­­_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\Run ( Delete Data type in key Run )

5_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\ Current Version\Winlogon (change tMél shell to explorer.exe)

6_Search *.exe

7_ and picture in C:\>window ( wallpaper. BMP )

 មេរោគ BBU.EXE virus

It’s hidden regedit taskmgr run and make your computer slowly than before. it’s nameIT_student_BBU@yahoo.com.exe

1_Kill process Accounting.exe

2_New short cut>gpedit.msc  or  we write note pad to open regedit  or  use program to open regedit

3_On gpedit.msc > adminstrator template> system> prevent access to registry editing tool> tick Enable >Apply and then tick  Not configured or disable > Apply again .

4_HKEY_CURRENT_USER\Software\Microsoft\windows\current version\policies\explorer ( delete No find , No folder options, No run )

5_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\Run ( delete The king of ghost )

6_ search *.exe

 មេរោគ Word.exe or leana virus

it’s hidden document of office9 ( word, excel…) we can not show hidden file go to regedit. If you show or go to regedit, your computer will restart as soon as. Especially we can not open safe Mode too.

1_kill process services.exe ( word picture )

2_go to window and rename regedit.exe to regedit.com. Other way Run type command.com

C:\>cd windows

C:\>Windows>ren regedit.exe regedit.com

3_HKEY­_CLASS_ROOT\exefile\shell\open\command (change tMél to default. Here are [“%1″ %*])

4_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\ Current Version\Winlogon (change tMél shell to explorer.exe)_­

5_ HKEY_LOCAL_MACHINE \system\control set001\control\Safe Boot (change tMél Alternate shell to cmd.exe )

6_ HKEY_LOCAL_MACHINE \system\control set002\control\Safe Boot (change tMél Alternate shell to cmd.exe )

7_ search *.exe

 មេរោគ AutoRun.exe Virus

1_kill process svchost.exe ( our svchost has service. svchost of virus hasn’t service) , there are three process : computer name,  user name, and  svchost

2_go to windows > double click on regedit.exe

3_HKEY_CURRENT_USER\Software\Microsoft\windows\current version\policies\explorer\Run (Delete Run)

4_HKEY_CURRENT_USER\Software\Microsoft\windows\current version\Run (Delete Data Typein Run)

5_HKEY_CURRENT_USER\Software\Microsoft\windows NT\current version\ Windows (DeleteValue Data in load and run)

6_ HKEY_CURRENT_USER\ Software\Microsoft\windows NT\Current Version\Winlogon (Deleteshell and Delete system)

7_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\policies\Explorer\Run ( Delete Run)

8_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\Run ( Deletecomputer name belong to your computer)

9_ HKEY_LOCAL_MACHINE \ Software\Microsoft\windows NT\Current Version\Winlogon (change tMél shell to explorer.exe and Delete system)

10_ HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\ Current Version\Winlogon (Delete Value Data in system and change Value Data In userinit toC:\Windows\system32\userinit.exe )

11_ HKEY_LOCAL_MACHINE \system\Control set001\control\safe Boot (change tMél Alternate shell to cmd.exe )

12_ HKEY_LOCAL_MACHINE \system\Control set002\control\safe Boot (change tMél Alternate shell to cmd.exe )

13- search *.exe *.com *.pif *.dll *.bat *.cmd

 មេរោគ Master virus

It is similar Autorun.

kill process and go to regedit

1_ HKEY_CURRENT_USER\Software\Microsoft\windows\current version\explorer\advance\folder ( Delete key folder )

2_ HKEY_CURRENT_USER\software\Microsoft\windows\current version\policies\explorer\Run(Delete run)

3_HKEY_CURRENT_USER\software\Microsoft\windows\current version\ Run ( Delete Data Type in Run )

4_HKEY_CURRENT_USER\Software\Microsoft\windows NT\current version\window ( Delete Value Data in load and run.com )

5_ HKEY_CURRENT_USER\Software\Microsoft\windows NT\current version\win logon ( Delete shell and system )

6_HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\policies\Explorer\Run ( Delete run or Explorer)

7_HKEY_LOCAL_MACHINE \Software\Microsoft\windows\current version\Run ( Delete Data Type run)

8_HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\ Current Version\Winlogon (Delete Value Data in system and change Value Data in userinit toC:\Windows\system32\userinit.exe )

9_HKEY_LOCAL_MACHINE \system\control set001\control\safe Boot (change tMél Alternate shell to cmd.exe )

10_HKEY_LOCAL_MACHINE \system\control set002\control\safe Boot (change tMél Alternate shell to cmd.exe )

11_ search *.exe *.com *.pif *.dll *.bat *.cmd

 មេរោគ Global.exe virus

It close all application we usually to use .

1_ go to safe Mode With Command Prompt or we rename process (it that procexp to anther name Ex:Procexp killer).

2_kill process : system.exe, Globle.exe, svchose.exe

3_ regedit.exe after kill process again like number2

4_HKEY_CLASS_ROOT\regfile\shell\open\command (change it to regedit.exe”%1“)

5_HKEY_CLASS_ROOT \MSCfile\shell\open\command ( change to %system Root%system32\mmc.exe “%1“%  or we copy from Run as that stay under command )

6_HKEY_CLASS_ROOT \exefile ( Delete NeverShow.ext )

7­_HKEY_CLASS_ROOT\comfile ( Delete NeverShow.ext)

8_HKEY_CLASS_ROOT \piffile ( Delete NeverShow.ext )

9_HKEY_CURRENT_USER\control panel\desktop ( change Scrnsave.exe toC:\windows\system32\logon.scr

10_HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\ System (Delete Key System)

11_HKEY_CURRENT_USER\ Software\Microsoft\Windows\Current Version\ policies\explorer ( Delete all except  NoDriveTypeAutoRun)

12_HKEY_CURRENT_USER\ Software\Microsoft\Windows\Current version\Run once ( DeleteValue Data of Default in Run once)

13_HKEY_LOCAL_MACHINE \Software\ Policies\Microsoft\Windows\ System ( Delete key system )

14_HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\Current Version\Explorer\Advanced\Folder\ SuperHidden (In valuename double click and add “d ” it so that “ShowSuperHidden”)

15_HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\Current version\Policies ( Delete Key Explorer)

16_HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\Current version\Run ( Delete  Data Type and include  Value  Data  of  Default in Run )

17_HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\

Current version\Run once ( Delete Value Data of Default in Run once)

18_HKEY_LOCAL_MACHINE \Software\Microsoft\windows NT\ Current Version\I mage file execution option ( Delete each key that have string is Debugger and in Value Data it writhe point to use it file other Drive  )

19_search *.exe *.pif *.com *.bat *.vbs