Generally we click the program icon in the start menu or on the desktop to run certain programs. But the utility programs are not all available in the start menu or the desktop. These programs (such as Regedit.exe, cmd.exe) usually run through the Start menu> Run. What can we do if there is no Run menu in the start menu?
Here are a few alternatives to run a particular program in a way that 'unusual':
a. Utilizing Windows Explorer
Run the Windows Explorer, locate the file you want running the program in the folder C: \ Windows, or in C: \ Windows \ System, or in C: \ Windows \ System32. Then double-click on the file program.
b. Utilizing the Command Prompt (cmd.exe)
= Click Start> Programs> Accessories> Command Prompt, or run cmd.exe with the first way above.
= Type in the name of the program you want running, then press enter.
C: \ Documents and Settings \ mr. orche!> REGEDIT
c. Using Batch Files
= Run Notepad through the start menu or through Windows Explorer.= Type in the name of the program who want to run, for example, "regedit" (without quotation marks).= Save the file using the extension. Bat, for example, "TES.BAT".= Run the file. Bat it through Windows Explorer (double click).
d. Using Task Manager (taskmgr.exe) (Windows XP)
= Press Ctrl Alt Del.= Click button [New Task ...] on the Applications tab.= Type in the name of the program, and press enter.
e. Browser exploit Files in ACDSee
ACDSee = Run from the Start Menu.= Find the file you want running the program in the file browser window.= Double-click the program file.
2. Alternative ways of Registry Operations
If you can not run regedit, registry operations can still be done with some of the following alternatives:
Alternative 1: Using the command REG
1. Run Command Prompt (cmd.exe).
2. To see a list of key and value, use the REG QUERY command lokasikey.Example:REG QUERY HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ ExplorerREG DELETE HCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
3. Type REG DELETE namakey / V namavalue to remove certain value.
Example:REG DELETE HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoRunREG DELETE HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoFolderOptions
Note:
= Root name should be abbreviated, HKCR for HKEY_CLASSES_ROOT, HKLM for HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER to HKCU, HKU to HKEY_USERS, and so on.
= For key names that contain spaces, key name enclosed in double quotation marks.
= To find out more about the operating procedures using the REG command, type "REG /?" Without the quotation marks.
Alternative 2: Using files. REG1. Run Notepad and type as the following example:
The new format (WinXP):Windows Registry Editor Version 5.00[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]"NoFolderOptions" = dword: 00000000
Old format (Win9X/NT):REGEDIT4[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]"NoFolderOptions" = dword: 00000000
2. Save the file with the extension. REG, then double click on. Reg file that you saved.
Explanation:
= First line, "Windows Registry Editor Version 5.00" or "REGEDIT4", is a fixed rule to mark the registry file.
= Second line, "[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]" indicates the location of the registry key, where the list value with the value data mentioned below will be stored.
= Third line, "NoFolderOptions" = dword: 00000000, value names and data they want to value them. In this example the mean change / give the data value 0 at the value named "NoFolderOptions".
= File is typed regedit winxp format (new format) or long format (Win9X/NT), both of which can be used for Windows XP, but the old format can only be used for Windows 9X/NT.
Alternative 3: Using a Startup Disk (only valid for Win9x)This method is the most difficult, and perhaps the only effective way to restore the registry when the system is already completely paralyzed.
1. Boot using the Startup Diska. Enter your Win95/98 Startup Disk into the floppy drive.b. Restart (make sure the configuration settings in the BIOS boot sequence pointing to the floppy).
2. Go to the directory (folder) C: \ WindowsA: \> C:C: \> CD WINDOWS
3. Do the export of data from the registry to a file. Reg specific for the desired keyFormat command:REGEDIT / E namakey namafilereg
Example:REGEDIT / E HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer TES.REG
If the key name contains spaces, use quotation marks:REGEDIT / E "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer" TES.REG
3. Reach the Back Menu Folder Options in Windows Explorer
Some viruses need to hide certain files that the user (computer user) is not aware of the virus and% 0mengetikkan following command at C20agar removed the virus more difficult, by creating a hidden file. File hioleh user if the Folder Options settings on the option 'Show hidden files and folders' enabled. Sometimes even this menu be eliminated by the virus to ensure the virus files remain invisible. To hide the Folder Options menu, the easiest and most commonly applied by the virus is to change the registry settings, by inserting the value "NoFolderOptions" is worth 1. To bring back the Folder Options menu, this value should be removed, or changed the value to "0".
= To alter the Folder Options, click the Tools menu> Folder Options in Windows Explorer.
= Value NoFolderOptions the registry are either or both of the following locations:
HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
Value can be removed by using the REGEDIT program, or by typing the following command in Command Prompt:
REG DELETE HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoFolderOptions
REG DELETE HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoFolderOptions
4. Reach the Run menu
Delete value "NoRun" or change the value to 0 by using the registry operation (see sample registry operation to raise above the Folder Options menu). Value "NoRun" is in the key:
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
5. Bring up the Find menu
Delete value "NoFind" or change the value to 0 by using the registry operation (see sample registry operation to raise above the Folder Options menu). Value "NoFind is" at the key:
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
6. Enabling REGEDIT
Sometimes it can not be executed because REGEDIT be disabled via registry settings by the virus. To recover, delete the value "DisableRegistryTools" or change the value to 0 by using the Command Prompt (for WinXP), or by creating a file. REG (only for Win9x).
7. Reach the Hidden Files with Command Prompt Change the attributes Through
Hidden files (hidden) can be raised without playing the Folder Options, but by disabling the hidden attribute on the file. Hidden file attributes can only be changed in Windows Explorer if the Folder Options settings allow hidden files displayed. The alternative is to change the attributes of the file via Command Prompt. To list hidden files via Command Prompt, use the command "DIR / AH". Next use the attrib command followed by the parameter attribute to be changed. The following example can be used to disable the hidden attribute, read only, and the system at once, on all files in current directory:
Attrib-r-s-h *.*
8. Finding Files With Command Prompt
a. View a list of files / folders in current folder:
DIR *.*
b. View a list of files / folders that are in the current folder, including file / folder is hidden:
DIR *.* / A "A" stands for "ALL"
c. View a list of files (not including the folder) in the current folder:
DIR *.* / AD "D" stands for "DIRECTORY", "-" means exclusion
d. View a list of folders (not including files) in the current folder:
DIR *.* / AD "D" stands for "DIRECTORY"
e. View a list of files / folders hidden:
DIR *.* / AH "H" stands for "HIDDEN"
f. View a list of files / folders sort by name:
DIR *.* / ON for files and folders, "O" means "ORDER BY", "N" means "NAME"DIR *.* / AD / ON to folders onlyDIR *.* / A-D / ON to file onlyDIR *.* / A-DH / ON for any hidden filesDIR *.* / ADH / ON for any hidden folders
g. View a list of files / folders sort by type (extension)
The trick is similar to sorting by name, only "/ ON" replaced with "/ OE".
h. Viewing file list sort by size
The trick is similar to sorting by name, only "/ ON" replaced with "/ OS".For detailed information about the rules of use DIR command, type "DIR /?" And press enter.
9. Suspected Deadly Process
The definition process is a program that runs in the background (background program), does not have a form because it is not made to interact with the user. Unlike the application program that does look at having to interact with the user. Viruses are usually made in such a way that when the virus is running is not visible at all, he is just a process. File viruses are currently running normally can not be deleted because the process is running. Usually the virus files can only be removed once the process is terminated. List of application programs and processes that are running can be viewed using the Windows Task Manager (taskmgr.exe) simply by pressing the Ctrl Alt Del. After the Windows Task Manager window appears, we can choose the "Applications" to see a list of application programs, or "Processes" to see a list of processes. Another option is "Performance", "Networking", and "Users".To stop the running application program, select the name of the application from the list, then click the "End Task". To stop the processes that are running, select the name of the process then click the "End Process". If Windows Task Manager can not be executed, we still can see and stop the processes that are running from the Command Prompt by calling the program "TASKLIST.EXE" to see the process list, then call the program "TASKKILL.EXE" to stop the process.
Example:TasklistTaskkill / F / IM Notepad.exe / IM MSPAINT.EXETaskkill / F / PID 1230 / PID 1253 / T
Description:The parameter "/ F" which was
a. Utilizing Windows Explorer
Run the Windows Explorer, locate the file you want running the program in the folder C: \ Windows, or in C: \ Windows \ System, or in C: \ Windows \ System32. Then double-click on the file program.
b. Utilizing the Command Prompt (cmd.exe)
= Click Start> Programs> Accessories> Command Prompt, or run cmd.exe with the first way above.
= Type in the name of the program you want running, then press enter.
C: \ Documents and Settings \ mr. orche!> REGEDIT
c. Using Batch Files
= Run Notepad through the start menu or through Windows Explorer.= Type in the name of the program who want to run, for example, "regedit" (without quotation marks).= Save the file using the extension. Bat, for example, "TES.BAT".= Run the file. Bat it through Windows Explorer (double click).
d. Using Task Manager (taskmgr.exe) (Windows XP)
= Press Ctrl Alt Del.= Click button [New Task ...] on the Applications tab.= Type in the name of the program, and press enter.
e. Browser exploit Files in ACDSee
ACDSee = Run from the Start Menu.= Find the file you want running the program in the file browser window.= Double-click the program file.
2. Alternative ways of Registry Operations
If you can not run regedit, registry operations can still be done with some of the following alternatives:
Alternative 1: Using the command REG
1. Run Command Prompt (cmd.exe).
2. To see a list of key and value, use the REG QUERY command lokasikey.Example:REG QUERY HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ ExplorerREG DELETE HCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
3. Type REG DELETE namakey / V namavalue to remove certain value.
Example:REG DELETE HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoRunREG DELETE HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoFolderOptions
Note:
= Root name should be abbreviated, HKCR for HKEY_CLASSES_ROOT, HKLM for HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER to HKCU, HKU to HKEY_USERS, and so on.
= For key names that contain spaces, key name enclosed in double quotation marks.
= To find out more about the operating procedures using the REG command, type "REG /?" Without the quotation marks.
Alternative 2: Using files. REG1. Run Notepad and type as the following example:
The new format (WinXP):Windows Registry Editor Version 5.00[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]"NoFolderOptions" = dword: 00000000
Old format (Win9X/NT):REGEDIT4[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]"NoFolderOptions" = dword: 00000000
2. Save the file with the extension. REG, then double click on. Reg file that you saved.
Explanation:
= First line, "Windows Registry Editor Version 5.00" or "REGEDIT4", is a fixed rule to mark the registry file.
= Second line, "[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]" indicates the location of the registry key, where the list value with the value data mentioned below will be stored.
= Third line, "NoFolderOptions" = dword: 00000000, value names and data they want to value them. In this example the mean change / give the data value 0 at the value named "NoFolderOptions".
= File is typed regedit winxp format (new format) or long format (Win9X/NT), both of which can be used for Windows XP, but the old format can only be used for Windows 9X/NT.
Alternative 3: Using a Startup Disk (only valid for Win9x)This method is the most difficult, and perhaps the only effective way to restore the registry when the system is already completely paralyzed.
1. Boot using the Startup Diska. Enter your Win95/98 Startup Disk into the floppy drive.b. Restart (make sure the configuration settings in the BIOS boot sequence pointing to the floppy).
2. Go to the directory (folder) C: \ WindowsA: \> C:C: \> CD WINDOWS
3. Do the export of data from the registry to a file. Reg specific for the desired keyFormat command:REGEDIT / E namakey namafilereg
Example:REGEDIT / E HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer TES.REG
If the key name contains spaces, use quotation marks:REGEDIT / E "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer" TES.REG
3. Reach the Back Menu Folder Options in Windows Explorer
Some viruses need to hide certain files that the user (computer user) is not aware of the virus and% 0mengetikkan following command at C20agar removed the virus more difficult, by creating a hidden file. File hioleh user if the Folder Options settings on the option 'Show hidden files and folders' enabled. Sometimes even this menu be eliminated by the virus to ensure the virus files remain invisible. To hide the Folder Options menu, the easiest and most commonly applied by the virus is to change the registry settings, by inserting the value "NoFolderOptions" is worth 1. To bring back the Folder Options menu, this value should be removed, or changed the value to "0".
= To alter the Folder Options, click the Tools menu> Folder Options in Windows Explorer.
= Value NoFolderOptions the registry are either or both of the following locations:
HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
Value can be removed by using the REGEDIT program, or by typing the following command in Command Prompt:
REG DELETE HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoFolderOptions
REG DELETE HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer / V NoFolderOptions
4. Reach the Run menu
Delete value "NoRun" or change the value to 0 by using the registry operation (see sample registry operation to raise above the Folder Options menu). Value "NoRun" is in the key:
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
5. Bring up the Find menu
Delete value "NoFind" or change the value to 0 by using the registry operation (see sample registry operation to raise above the Folder Options menu). Value "NoFind is" at the key:
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
6. Enabling REGEDIT
Sometimes it can not be executed because REGEDIT be disabled via registry settings by the virus. To recover, delete the value "DisableRegistryTools" or change the value to 0 by using the Command Prompt (for WinXP), or by creating a file. REG (only for Win9x).
7. Reach the Hidden Files with Command Prompt Change the attributes Through
Hidden files (hidden) can be raised without playing the Folder Options, but by disabling the hidden attribute on the file. Hidden file attributes can only be changed in Windows Explorer if the Folder Options settings allow hidden files displayed. The alternative is to change the attributes of the file via Command Prompt. To list hidden files via Command Prompt, use the command "DIR / AH". Next use the attrib command followed by the parameter attribute to be changed. The following example can be used to disable the hidden attribute, read only, and the system at once, on all files in current directory:
Attrib-r-s-h *.*
8. Finding Files With Command Prompt
a. View a list of files / folders in current folder:
DIR *.*
b. View a list of files / folders that are in the current folder, including file / folder is hidden:
DIR *.* / A "A" stands for "ALL"
c. View a list of files (not including the folder) in the current folder:
DIR *.* / AD "D" stands for "DIRECTORY", "-" means exclusion
d. View a list of folders (not including files) in the current folder:
DIR *.* / AD "D" stands for "DIRECTORY"
e. View a list of files / folders hidden:
DIR *.* / AH "H" stands for "HIDDEN"
f. View a list of files / folders sort by name:
DIR *.* / ON for files and folders, "O" means "ORDER BY", "N" means "NAME"DIR *.* / AD / ON to folders onlyDIR *.* / A-D / ON to file onlyDIR *.* / A-DH / ON for any hidden filesDIR *.* / ADH / ON for any hidden folders
g. View a list of files / folders sort by type (extension)
The trick is similar to sorting by name, only "/ ON" replaced with "/ OE".
h. Viewing file list sort by size
The trick is similar to sorting by name, only "/ ON" replaced with "/ OS".For detailed information about the rules of use DIR command, type "DIR /?" And press enter.
9. Suspected Deadly Process
The definition process is a program that runs in the background (background program), does not have a form because it is not made to interact with the user. Unlike the application program that does look at having to interact with the user. Viruses are usually made in such a way that when the virus is running is not visible at all, he is just a process. File viruses are currently running normally can not be deleted because the process is running. Usually the virus files can only be removed once the process is terminated. List of application programs and processes that are running can be viewed using the Windows Task Manager (taskmgr.exe) simply by pressing the Ctrl Alt Del. After the Windows Task Manager window appears, we can choose the "Applications" to see a list of application programs, or "Processes" to see a list of processes. Another option is "Performance", "Networking", and "Users".To stop the running application program, select the name of the application from the list, then click the "End Task". To stop the processes that are running, select the name of the process then click the "End Process". If Windows Task Manager can not be executed, we still can see and stop the processes that are running from the Command Prompt by calling the program "TASKLIST.EXE" to see the process list, then call the program "TASKKILL.EXE" to stop the process.
Example:TasklistTaskkill / F / IM Notepad.exe / IM MSPAINT.EXETaskkill / F / PID 1230 / PID 1253 / T
Description:The parameter "/ F" which was
0 comments:
Post a Comment