up vote 0 down vote favorite
share [g+] share [fb]

I have reason to believe that I may have malware on my system in the form of an Explorer extension. I suspect this because Procmon shows that Explorer.exe keeps re-writing a certain Registry key that is intended to run a certain EXE at startup.

How do I find out what Explorer extensions are installed, and how do I remove them?

link|improve this question
57% accept rate
feedback

3 Answers

up vote 3 down vote

My personal favorite is Autoruns from Sysinternals (Microsoft). It goes well beyond just shell extensions and covers tons of areas where third party code can run.

Assuming you've done a virus scan and it didn't catch it, you might want to watch this excellent video from Mark Russinovich on advanced malware cleaning techniques.

link|improve this answer
feedback
up vote 1 down vote

?

"ShellMenuView - Disable/enable context menu items of Explorer"

http://www.nirsoft.net/utils/shell_menu_view.html

link|improve this answer
feedback
up vote 0 down vote

1.Get Auto Runs 2.Get Process Explorer.

Use process explorer to suspend any suspect processes to stop them from writing to registery. The use the Autoruns to look at everything that gets loaded at start up, into explorer and internet explorer and shut down any suspect services (non microsoft).

Find Google Updater, Adobe Updater and Flash Utils processes and rename and stop them from running. That is the least of what I can think of.

Thank you Josh Einstein :)

link|improve this answer
1  
Suspend the process instead of killing it. It keeps malware "buddies" from restarting each other. – Josh Einstein May 20 '11 at 3:55
@Josh: But not from unsuspending each other... :) – Timwi May 20 '11 at 15:07
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.