HowTo: Repair Registry after Virus Attack

HowTo: Repair Registry after Virus Attack

One of the most frustrating things about being infected by a virus is they mess with your registry so much, there wasn’t much you can recognize from what remains in your PC even after you totally exterminate the virus either using antivirus or manually.

And on top of it, antivirus company seems reluctant to really clean up the damage, at least without extra money to buy an extra functionality from their software.

This is a collection of registry fix I compiled from most of Indonesian made virus since brontok to amburadul.

This registry fix can repair virus symptoms such as

• · Disabled task manager
• · Disabled regedit
• · Virus hook to explorer, safemode, and winlogon
• · Missing or disabled options regarding file extension, hidden files, and super hidden
• · Internet explorer caption
• · No run
• · No find
• · No control panel
• · And some more

Some of the entry I put in the repair file was credited to an Indonesian antivirus website I fond long-long time ago… I forgot the URL. Some was taken from a friend of mine which in turn take it from his friend mine which in turn take it from his friend… I simply don’t know who I should give credit to. I also created some of the entry.

Download Repair.inf here

To use the file simply right click and install it

Note:

Please be sure that there is no active virus in your computer when executing repair.inf. You can do this by using an antivirus or manually using process explorer tools such as ProcessXP from Sysinternals.

Some entry mark with “Your Product ID“,”Your Product Name“,”Your Organization“, and “Your Registered Owner” are meant to be change according to each person preference.

In some case, the virus registers an inf file with other file, for example a jpg file. In this case, the install option doesn’t appear when you right click on the file. If this happen, pray that run or command prompt not blocked.

If it’s not blocked, download repair.inf, put it somewhere on your hard disk, for example put it in your C: drive. Then just run “rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\repair.inf” command either from command prompt or run menu.

If it’s blocked, you’re screwed…