Quote:
Originally Posted by sun_kangane
yaa this is nice ..................
but what if the virus done the changes in registry to get "open with.." window. How to restore the original registry settings.
for the first time, each autorun virus needs this file, once the virus code gets executed, it modifies the registry entries. So there would be autorun.inf on your drive. Just open the autorun.inf with notepad and search for .bat or .exe or .com filename. Now open registry edit from run by typing "regedit" and search for the same file name you found in autorun.inf. and delete it yourself or you can just use any registry cleaner after deleting the virus code from your system. B'coz such cleaners look for the orphan registry entries which are not associated with any file.
For the safe deletion of virus code, use search feature of windows with the options selected to search in hidden files and system files. Usually such viruses copies itself into windows/system32 folder and one hidden system folder "system volume information". Just delete them. If any of the virus file is not getting deleted, then just check whether file is executing or not. You can check this using task manager / process monitor(recommended).
Just end process and thentry to delete the file.
I hope this info will help..