Hot answers tagged

5

There seems to be a new strand of the virus that places itself in a slightly different location and uses different registry keys. You should be able to find the virus under %AppData%\{7DD25B43-EDEC-C6A2-4E97-EB6E11BD11CD3}. Especially interesting: The virus can only access the registry of it's current user. It accordingly has nested into the HKEY_USERS/[.....


2

Sorry, that's not possible, at least not to the extent you seem to want. As mentioned in the comments by Ƭᴇcʜιᴇ007, all of Windows access control is based on users. Every process has a token attached to it, which determines what user it's running as. There is no difference between you performing an action and a program running under your account performing ...


2

Double-question mark paths are NT Object Manager object names. The Object Manager is a system that organizes lots of different kinds of system resources (e.g. devices, memory sections, window stations, events) into one tree-like structure. You can explore that tree with the WinObj tool. The \??\ pseudo-directory's contents can be seen in the GLOBAL?? ...


2

Edit the .reg in Notepad or any other text editor. The first thing in a .reg file is the path, example: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDriveTypeAutoRun"=dword:00000091 You'll see something similar to this, the first part is the path and the second line is the key it'...


2

Go to the .reg file > Right Click > Edit with Notepad View the key there and the location.


2

Check the (default) value data here: HKEY_CLASSES_ROOT\exefile\shell\open\command Must be set to "%1" %* And, select the following key. HKEY_CLASSES_ROOT\exefile\shell\open Right-click (default) and choose Delete. It should now read value not set. That fixes the menu caption - setting it to Open. REG file to automate the above Windows Registry ...


2

If you're not able to use Group Policies to get this configured, then check these registry keys, create them if they don't exist, and adjust accordingly for your needs. Locate and then check the following three registry subkeys, and then change the values of the Default_Page_URL and Start Page entry to your desired website. HKEY_CURRENT_USER\...


2

Is there any way to remove the registry entries for the non-existent applications? You can use CCleaner by Pirifom to do this: System Requirements Windows 10, 8.1, 8, 7, Vista and XP. Including both 32-bit and 64-bit versions. ... We also offer a portable version for installing on USB thumb drives. Visit the builds page to download. It ...


1

Check out the Microsoft tool for fixing this Windows problem located for download via the Fix problems that block programs from being installed or removed site via the download link. Just download and install the MicrosoftProgram_Install_and_Uninstall.meta.diagcab utility once the download completes and then run to fix the related problems. Fix problems ...


1

Drag and Drop from a standard user process (Medium integrity level) to an elevated process (High integrity) never works because it could be used in a Privilege escalation attack. A normal user could open a file in an elevated process and potentially execute some code with higher privilege than he holds. Running Visual Studio as admin is sometimes required ...


1

Configuring the IE Home Page Solutions. . . Fortunately there are several workarounds for this issue. First, if you want to force users to use a particular home page for IE on their corporate users, you can use the following Group Policy setting to do this: Disable changing home page settings This policy setting is found under this ...


1

How I can reverse these changes? You can reverse the changes by setting the permission entry is set to [1 17] which is Administrators Full Access and SYSTEM Full Access. Create a file (for example unblock.txt) with the following contents: HKEY_CLASSES_ROOT\Applications\cmd.exe [1 17] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe [1 17] ...


1

I need to block this key to prevent deletion or modification by malware. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe What command line can help me to do this? As per the answers in the link in your question, the easiest way to do this is to remove the Edit permissions from SYSTEM and the Administrators ...


1

I was looking into this same thing and found this (emphasis mine): If the value contains the sequence tilde [~], then the value is interpreted as a Null-delimited list of strings (REG_MULTI_SZ). For example, to specify a list containing the three strings a, b and c, use "a[~]b[~]c". The sequence [~] within the value separates the individual strings ...


1

Here is a REG file that sets IE as the default browser (except for HTM and HTML file types), and then associates HTM HTML and CSS files with Notepad++ Note: This registry edit won't work if you're using Windows 10.. as Windows 10 imposes strict rules pertaining file type associations - with the hashing algorithm in place to detect any tampering with User ...


1

I know this is a long-time later, but this may be a simpler way to do it; a one-liner that toggles the value on or off: set-itemproperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -name ProxyEnable -value (-not ([bool](get-itemproperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -name ProxyEnable)....



Only top voted, non community-wiki answers of a minimum length are eligible