Discussion Locked

Removing registry entries

0 helpful
8 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
My company has been getting bombarded with a virus. After removing the virus though, it leaves an entry in the registry. How can I automate a removal?

8 replies

by curacao_dejavu

You can not. Virus could infect different entries in the registry and therefor there is not 1 automatic tool that removes the entries of all virusses.

There are tools to remove specific viruses.
Head to http://www.symantec.com/avcenter/tools.list.html and you will find some tools to remove the most known viruses.

On symantec, when providing information on the virus they specify also how manually to remove the virus from the registry, again most you have to do manually , some are automate.
if you are looking for the sirc32 worm there is a automated tool for that one.

regards,

by tejota

This is in reference to the SirCam virus. I do have the tool that removes it but the virus leave two pointers in the registry that the utility does not remove. The pointers, although harmless, are pointing to the scam32.exe and sirc32.exe. I justwant to rid every single remnant of that virus.

by bdivine

Tejota,

What you need to do is create an inf file to remove those registry settings. I have a document that I have written that explains the creation of them and how to remove entries from the registry. Please send me an email and I will attachmy document.

by sergey kovzik

In Win98 "REGEDIT [/L:system] [/R:user] /D regpath2" but it will work only from DOS.
other way - using WSH - look for \WINDOWS\SAMPLES\WSH\REGISTRY.VBS
In Win2000 there is REGINI program
Resource kit provides information for creating own .inf forboth OS
And last way - you send keys/values, i send program to delete them :)

This discussion is closed to new replies.