Thursday, January 30, 2014

How to Block an Application or .EXE from Running in Windows

While doing some cleaning up on a test computer around the office, we realized that we’ve never written about how to block an application from running using a registry hack. It’s easy, so here you go.
It’s worth noting that this doesn’t work for blocking things that will be running as services, and a lot of spyware and malware abuses the built-in Windows rundll32 utility to run their stuff without actually using an executable. This technique won’t work for that.
If you’re running the Professional version of Windows, you can use the Group Policy editor to make a list of allowed applications rather than a registry hack, or you can use this same technique to block applications.

Blocking Applications from Running with a Registry Hack

To make this work, you’ll need to browse through the registry and create a key or two. Open up regedit.exe through the WIN + R menu, and then head down to the following key:
Once you get to that key, create a new 32-bit DWORD called DisallowRun in the right-hand pane with the value set to 1. Then create a key under the Explorer key on the left-hand pane, and call it DisallowRun as well. If some of those keys don’t exist, you’ll want to right-click and create the keys like you can see in the next screenshot.
On the right-hand side underneath the DisallowRun key, you’ll want to create a bunch of String values with names starting with “1″ and going in numerical order (so the second one would be “2″ and the third “3″, etc). Set the value of each one to the name of the executable that you want to block. For instance, if you wanted to block Calculator and Notepad from running, you’d add two keys like this:
1    notepad.exe
2   calc.exe
This will end up looking something like the following screenshot:
Once you set this restriction and restart your computer, you can immediately see the change by just trying to run the application — you’ll get a popup that looks like the first screenshot in this article.

Alternative: Use this Pre-Made Registry Hack

So you don’t want to do all of that. Open up Notepad, paste in this text, adjust the name of the applications listed in the file, and save it out as SomeFileName.reg, making sure to end the filename in .reg so it’ll be usable. Then double-click on the file.
Windows Registry Editor Version 5.00
Nice and simple. Enjoy.

Friday, January 24, 2014


PUP (short for Potentially Unwanted Program) refers to an unwanted program or piece of software that may be installed along with the program or software that a user actually wants on their system.
A PUP is not classified as malware, but rather as adware, spyware, crapware, etc. What marks the distinction in classification is that users are ‘informed’ about the PUP via the EULA (end user license agreement). But since most people rush past the EULA, it makes it easier for those who push PUPs to have a ‘legal out’; after all, the information was literally spelled out in the EULA.
A rather ‘visible’ form of PUPs are the software installers that come with offers of extra ‘goodies’ such as toolbars, ‘search’ apps, etc., making it a good idea not to rush through any installation process!

Tuesday, January 21, 2014

Troubleshoot Wireless Router Problems


Reboot the Router

Have you tried rebooting it? Yes, once again,is the solution to many network problems. Whether websites are failing to load, everything network-related seems slow, connections are dropping, or your wireless is flaking out, you may just want to try rebooting your router.
This shouldn’t be necessary, but many routers seem to need an occasional reboot to keep working well. The reboot process is simple on most routers — unplug your router’s power cable, wait a few seconds, and then plug it back in. If you have separate modem, you may also want to try unplugging your modem’s power cable and plugging it back in after a few seconds. Some devices may have a power switch, but the unplug-and-plug-back-in method applies to all routers.
If you have to frequently reboot your router, the manufacturer’s firmware may just be unstable and buggy. Installing an alternative firmware like DD-WRT might help.

Check for Overheating

Like any other electronic device, routers can fall prey to overheating. This overheating can damage the router over time or just make it unstable. Check your router’s temperature to see how hot it is. If it seems very hot, ensure that it’s getting enough airflow. If the vents are blocked or you have the router in a hot location — like on top of a tower PC that heats up — overheating could be causing instability. It’s also possible that past overheating may have damaged the router.

Verify Cables Are Securely Connected

This may sound like a no-brainer, but we sometimes forget to check the most obvious solution before moving on to more complicated ones. Someone may have accidentally pulled on or kicked a cable, causing it to unplug or become loose. You should check all of the cables involved and ensure that they’re securely connected.
Be sure to check the power cables to your router and modem, the cable between your router and modem, the cable between the modem and the wall socket, and each Ethernet cable plugged into the back of the router. Check each end of the cable and ensure it’s securely connected — it could look connected but be a bit loose.

Change the Wireless Channel

If you’re in a location with a lot of wireless routers nearby, like an apartment building, there’s a good chance your router is subject to interference from other wireless routers sending signals on the same wireless frequency. Determining the optimal wireless channel for your area and changing your router to operate on that wireless channel instead of a more congested one can reduce this interference, improving your wireless signal.

Monday, January 6, 2014

The Complete Malware Removal Guide

This guide will help you clean your computer of malware. If you think your computer is infected with a virus or some other malicious software, you may want to use this guide. It contains instructions that, if done correctly and in order, will remove most malware infections on a Windows operating system. It highlights the tools and resources that are necessary to clean your system. Malware is a general term for any malicious software, including viruses, trojans, rootkits, spyware and adware.
Many different symptoms indicate a malware infection. Sometimes, the symptoms can be difficult to detect. Below is a list of symptoms you may experience when you are infected with malware:
• Your computer shows strange error messages or popups.
• Your computer takes longer to start and runs more slowly than usual.
• Your computer freezes or crashes randomly.
• The homepage of your web browser has changed.
• Strange or unexpected toolbars appear in your web browser.
• Your search results are being redirected.
• You start ending up at websites you didn’t intend to go to.
• You cannot access security related websites.
• New icons and programs appear on the desktop that you did not put there.
• Your desktop background has changed without your knowledge.
• Your programs won’t start.
• Your security protection have been disabled for no apparent reason.
• You cannot connect to the internet or it runs very slowly.
• Your programs and files are suddenly missing.
• Your computer is performing actions on its own.
Disclaimer: This guide is for informational purposes only and is not a substitute for professional malware removal. Your use of this information is at your own risk.
I recommend that you back up all your important data before attempting to perform the malware removal process. In the unlikely event that something goes wrong, you can restore your data. Do not back up any system files, installers (.exe), or screensavers (.scr) because they may be infected by malware.
1. Several steps may need repeated a number of times in order to remove all threats.
2. In some cases, the only way to remove a malware infection is to do a complete reformat and reinstall of the operating system.
3. You may want to print out or make a copy of these instructions so that you may easily refer to them if needed.

2. Preparation for Removal

2.1 Reset Proxy Settings (Internet Connection Problems)

Some malware infections will turn on a proxy setting, which can prevent you from accessing the Internet or downloading tools required for disinfection. It can also cause redirects. Follow these instructions to reset the proxy settings:
Go to the Start menu, click Control Panel, and then double-click Internet Options. Go to theConnections tab, and click LAN settings. Uncheck the first box under Proxy Server, and then click the OK button to close the screen.
Alternatively, you can go to the Start menu, click Run, type inetcpl.cpl, and then click OK. Then continue with the instructions given above where you click the Connections tab.
malware 1 3 The Complete Malware Removal Guide

3. The Removal Process

If you have a malware infection that is blocking Internet access, disabling the desktop, or preventing programs from running, you will need to boot into safe mode. Some malware infections will not run in safe mode, thus allowing easier detection and removal.
To access safe mode, restart your computer and start tapping the F8 key before Windows begins to load. You will see a black screen with a number of options. Use the arrow keys to select theSafe Mode with Networking option, and then press the Enter key. Once you are in Safe Mode with Networking, move on to Step 1.
malware 2 3 The Complete Malware Removal Guide
For a detailed tutorial on how to start the computer in safe mode, visit How to Start in Windows Safe Mode
If safe mode is disabled or if for some reason you cannot get into safe mode, skip down to Can’t Boot Into Windows or Safe Mode?

3.1 Step 1 – Automatic Preliminary Rootkit Scan

You need to scan your computer for possible rootkits before running other anti- malware software.
TDSSKiller is an anti-rootkit tool from Kaspersky. It is specially designed to remove malware belonging to the rootkit family Rootkit.Win32.TDSS. This rootkit family downloads and execute other malware, delivers advertisements to your computer, and blocks programs from running. It also redirects Google searches as well as blocks access to security sites. TDSSKiller is simple to use and requires no installation.
Download and run TDSSKiller – Download here or here – Homepage
To run TDSSKiller, follow these instructions:
When the program opens, click the Start scan button. The scan time is very short (less than a minute). If the scan completes with nothing found, click Close to exit. If malicious objects are found, the default action will be Cure. Click on Continue. If suspicious objects are found, the default action will be Skip. Click on Continue. It may ask you to reboot the computer to complete the disinfection.
If TDSSKiller does not run, try renaming it. To do this, right-click on the TDSSKiller icon and select Rename. Give it a random name with the .com file extension (e.g. If you still cannot run TDSSKiller after renaming it, try running FixTDSS from Symantec. If FixTDSS does not work, you will need to use RKill to terminate malicious processes.

3.2 Step 2 – Scan and Clean (On-demand Scans)

There are many tools that will scan for and remove various malware infections. Unfortunately, none of them will detect and remove 100% of all malware; therefore, it is important to use more than one, in the hope that their combined detection is enough to find the problem.
Below are three highly recommended on-demand scanners. They do an excellent job at detecting threats and completely removing them.
Important notes:
• Make sure the scanners are updated before you scan with them.
• After you have downloaded and updated the on-demand scanners, disconnect your Internet connection. This will eliminate the possibility of any further malware installing on your computer.
• Do not use your computer for anything else until the scanning process has finished.
• Some of these scans may take over an hour to run.
• Do NOT run more than one scan at a time.
• You may need to restart your computer to complete the removal process.
• If you cannot run any of the scanners below, you will need to use RKill to
terminate malicious processes.
Download and install Malwarebytes – Download here or here (
Open Malwarebytes and perform a quick scan. You can also perform a full system scan, but that is optional.
Once the scan is complete, remove all found infections.
Malwarebytes is designed to run best in Windows normal mode. If you can run it in normal mode, then you should. If you cannot run it in normal mode, run it in safe mode. However, once you have the system running better, you should scan again in normal mode.
If Malwarebytes will not install, simply rename the downloaded file (mbam- setup.exe) toiexplorer.exe or winlogon.exe. Once you rename it, try running it again. If that does not work, skip down to SuperAntiSpyware. After you scan with SuperAntiSpyware, try installing Malwarebytes again.
Download and run SuperAntiSpyware Portable – Download here – Homepage
Why, you might ask, am I using the portable version? Because it requires no installation, contains the latest definitions, and automatically gives you a random filename, so malware can’t block it from running.
Select the Complete Scan option, and then click the Scan your Computer button to start scanning your computer.
Download and run Hitman Pro – Download here (32-bit)(64-bit) – Homepage Requires no installation.
Hitman Pro requires a working Internet connection to detect malware.
When the program opens, simply click the Next button.
Click the Next button again.
The scan should complete within a few minutes and display a list of threats. Click the Nextbutton to delete the threats.
Note: TDSSKiller, SuperAntiSpyware, and Hitman Pro are portable programs, which means they can run directly from a USB flash drive. You can take them anywhere and use them on any computer.

3.3 Step 3 – Run a Full Antivirus Scan

If the on-demand scan fails to find anything or if it finds malware that it can’t delete, it is time to launch a full antivirus scan.
If you currently have antivirus software installed on your computer, make sure it is up to date with the latest virus definitions, and perform a full system scan with it. Remove or quarantine everything that it finds.
Before removing anything, make sure it’s not a false positive. “A false positive is when antivirus software identifies a non-malicious file as a virus.” In other words, false positives are mistakes made by an antivirus. If you suspect a file to be a false positive, go to VirusTotal or Jotti’s malware scan and upload the file. They will scan the file with several antivirus engines
If you do not have antivirus software installed, get it immediately. Avast! and Microsoft Security Essentials are two highly recommended antivirus programs. You
should only have one antivirus program running on your computer.

4. After the Removal Process

4.1 Clean up System Restore

Your “restore points” may contain malware. The only way to remove the malware is to delete the restore points. This will remove any old points that contain malware. You can use Disk Cleanupto remove all but the most recent restore point. Follow these instructions to run Disk Cleanup:
Go to Start menu > All Programs > Accessories > System Tools and then click Disk Cleanup. Click on the More Options tab and locate the section near the bottom labeled System Restore. Click on the Cleanup button.
Here’s another way to open Disk Cleanup: Click the Start button . In the search box, type disk cleanup, and then, in the list of results, click Disk Cleanup.

4.2 Change All Passwords

Some malware infections will steal your personal data such as passwords, emails, and banking information. Change all your passwords immediately, especially if you do any banking or other financial transactions on the computer. Password Strength Checker

4.3 Clean up Temporary Files

After the removal process, you need to remove your temporary files. Removing your temporary files will delete the remaining malware files from the temp folders. It will also free up hard disk space, which will help to speed up your computer.
If you are experiencing problems like missing files or folders, skip this step and go on to Fix Post-Disinfection Problems.
Download TFC (Temp File Cleaner) – Download here – Homepage If you have CCleaner installed, you can use that instead, but do not use the registry cleaner.
Once downloaded, double-click TFC to open it. TFC will close all open programs when run, so make sure you have saved all your work before you begin. Click
the Start button to begin the process. Once it’s finished, it should automatically reboot your computer. If it does not, manually reboot to ensure a complete clean.

5. Fix Post-Disinfection Problems

Once you have removed the malware infection from your computer, you may experience some annoying problems. Fortunately, there are easy ways to fix these problems.

5.1 Cannot Open or Run Programs (.exe files)

This problem occurs when your .exe file associations are broken. This is usually caused by malware that changes the default file associations in Windows. Follow these instructions to fix this problem:
Download exeHelper from one of these two links: Link 1, Link 2 Double-click on exeHelper to run the fix. A black window should pop up.
Press any key to close, once the fix is completed.
If exeHelper does not work, follow the instructions provided in the following links:

5.2 I’m Being Redirected to Random Websites

If you’re having a problem with redirects, your hosts file may be corrupted. In order to fix this problem, you have to reset the hosts file back to the default. To reset the hosts file automatically, simply go to How do I reset the hosts file? and click the Fix it button. Then follow the steps in the Fix it wizard.
If you still have redirect issues after resetting the hosts file, try running GooredFix. GooredFix fixes Firefox browser redirection problems. If you do not use Firefox, you can skip this. Download GooredFix and save it to your desktop. Close Firefox first, and then run the tool. When prompted to run the scan, click Yes. Once the scan is complete, a log will appear; you can close it. Open Firefox and see if you have redirects.
If you still have redirect issues after trying all of the above, your router may be hijacked by malware. In order to fix this problem, you have to reset your router to its default settings. How to Reset a Router Back to the Factory Default Settings

5.3 Repair System Settings

SuperAntiSpyware includes a repair feature that allows you to repair or restore various settings, which are often changed by malware infections. It can repair broken Internet connections, Desktops, Registry editing, Task Manager and more. You can find the repair feature by clicking the Repairs button at the main menu.

5.4 Web Browser Hijacked

Malware will usually try to hijack and redirect your web browser. Your homepage and default search may be changed. Open your web browser options, and correct the choices. How to Change Browser Settings

5.5 Unhide All Files / Restore Quick Launch and the Start Menu

Some malware infections will hide all the files on your computer from being seen. To make your files visible again, download Unhide.exe to your desktop.
Once downloaded, double-click on Unhide and allow it to run. It will remove the hidden attribute on all files and attempt to restore Quick Launch and Start Menu items to their proper location.
You may also want to use Re-Enable, which can undo many changes made by a malware infection.

6. Get Expert Analysis

If you want to be certain that your computer is fully cleaned or just want a second opinion, you can create a topic at one of the forums listed below and ask for help. These forums have people who are well trained and experienced in malware removal. Be sure to mention in your topic that you followed this guide. Please note that it may take a couple of days to receive a reply, so be patient.

6.1 Can’t Boot Into Windows or Safe Mode?

If the malware infection is so severe that you cannot boot into Windows or safe mode, then I recommend using an antivirus rescue CD. An antivirus rescue CD is a bootable CD that can be used to scan your computer for malware without having to boot into the operating system. Many antivirus companies provide free rescue CDs. They are extremely effective at removing malware.
Below are three highly recommended antivirus rescue CDs.
• Burn the antivirus ISO file to a CD using CD burning software.
• Insert the CD into the infected computer’s CD-ROM drive.
• Enter the computer’s BIOS, set it to boot from the CD, and reboot the computer.
• Scan the computer with the rescue CD.
Read 51 Uses For Live CDs for more information about Live CDs.
If all else fails, you must reformat your hard drive and reinstall Windows. When should I re-format? How should I reinstall?

7. Conclusion

Your computer should be fully cleaned of all malware after following this guide. If you believe your computer is still infected, seek professional help to remove the malware. If you have any questions or comments regarding this guide, you can contact me by You can also reach me at my website: Real Security
• 9 Easy Ways To Never Get A Virus by James Bruce

7. Further Help

7.1 Perform an Online Malware Scan

If you believe your computer is still infected, you can perform an online scan of your computer. Both ESET and F-Secure provide a good second opinion on whether you are infected.

7.2 Additional Malware Detection / Removal Tools

Some of these tools are advanced, so use caution when using them.
Kaspersky Virus Removal Tool (AVPTool): utility designed to remove all types of infections from your computer.
Microsoft Safety Scanner: a tool that provides on-demand scanning and helps remove viruses, spyware, and other malicious software.
Microsoft Standalone System Sweeper: a recovery tool that can help you start an infected PC and perform an offline scan to help identify and remove malware.
aswMBR: a rootkit scanner that scans for TDL4/3, MBRoot (Sinowal) and Whistler rootkits (by Avast).
SARDU (Shardana Antivirus Rescue Disk Utility): combines all of your bootable antivirus ISO images and turns them into a single ISO with a boot menu.
TaskManager.xls: a simple task manager implemented in Excel/VBA. It can list processes, terminate, suspend and resume selected processes. It can be useful when fighting malware that prevents you from using Task Manager or Process Explorer.

7.3 Notable Links

Guide Published: August 2011
This manual is the intellectual property of MakeUseOf. It must only be published in its original form. Using parts or republishing altered parts of this guide is prohibited without permission from
Think you’ve got what it takes to write a manual for We’re always willing to hear a pitch! Send your ideas to justinpot [at] makeuseof [dot] com