BCDALAI's Tech. Support Blog: Restore your PC Settings

Restore your PC settings after cleaning viruses, spywares

Updated on: 28th August 2008

Warning: This article is for informational purposes and contains no warranty whether express or implied.

Note: This document may change and updated from time to time depending upon the latest and new information available.

Introduction:
Security is the most important concept in computing. So everyone needs to be secure to make the data and application to avoid loss. The object of this article is to give some awareness to the computer users to protect the data, time and money. If you have any more information relating to this topic, please send to me or add those in a comment.

These are the security setting generally affected by some Viruses/malicious scripts/spywares. Following settings/components are affected:

>> Autorun Settings
>> Command Prompt (cmd)
>> Folder Options (control folders)
>> Registry Editor (regedit)
>> Startup Settings
>> Task manager (taskmgr)
>> Website blocking (e.g. Orkut, Gmail and may be other sites.)
>> Windows Automatic Update
>> Windows Installer

Step-1 (Recommended)
Methods to secure your system

First of all you have to clean the Viruses/malicious programs from your system by using a good AntiVirus/Antispyware/Rootkit cleaner.

Security Risks:
Adware
Backdoor
Botnet
Crimeware
Dialers
Downloader
Hack tools (keygens/cracks/patches)
Joke programs
Keylogger / Keystroke Recorder
Macrovirus
Malbot
Mass Mailer
Pop-ups
Pornware
Remote Access
Riskware
Rootkit
Spyware
Trackware
Trojan horse
Virus
Worm
Note: See the detailed glossary here.

Recommended programs to secure your Computer (recommended by bcdalai).
AntiVirus programs:
Norton Antivirus 2008 or Norton Internet Security 2008
F-Secure Client Security 2008

Note: If you are using any other program then check that the program is up-to-date means, Product license/subscription is valid, the definition and program is up-to-date, it is running with the Windows startup programs and if that program has Firewall then is it ON/OFF, always turns it ON. If that program has no firewall then turns ON the windows firewall from “Control Panel”. It is recommended to use the firewall that comes with that Antivirus software. You must update that program through internet.

Anti-spyware/anti-malware/anti-adware/anti-Rootkit programs:
Spybot Search & Destroy
Spyware Doctor
Webroot Spy Sweeper 5.5
Lavasoft Ad-Aware 2007
Sophos Anti-Rootkit
Microsoft Malicious Software Removal Tool
Windows Defender

Now major antivirus software are comes with some additional protection feature, such as spyware/adware protection, Rootkit detector, Anti-spam etc. There are some products providing all-round protection like Norton 360.
When you are buying any of the security products, check all these feature to sure that these are present in that software.

Step-1
Restore your settings to default system settings

After cleaning the viruses, spywares and other security problem you should check the system settings whether they are affected or not. If the system settings are not restored by the antivirus or the software used to clean the security risks, then you have to do those manually.

1- Autorun Settings: This setting is affected and the symptoms are, when you click a drive (whether fixed/removable) it will not open. It will run a script from a file running “Microsoft Windows Based Script Host” (wscript.exe/wwscript.exe) and Microsoft Console Based Script Host (cscript.exe) and you can’t end these processes from “Task Manager”. If you will right-click that device/drive, then you will see “Autoplay” as the default action instead of “open”.

Step-1: First show hidden and system files and folders from “Folder Options” from control panel. Go to each drive and manual delete the “Autorun.inf” hidden file. Now log off and log on. If the problem is not solved then update the antivirus and scan the system (run complete scan).

Step-2: After scanning the system if the problem is not solved then use group policy to disable the auto run settings.
Go to Start > Run type "gpedit.msc" press Enter.
Expand "Computer Configuration" and navigate to "Administrative Templates\System"
Then open “Turns off Autoplay" option and click the enabled option to disable autoplay on all drives.

2- Command Prompt: Some times Command Prompt is disabled and you cannot open from Start > All Programs > Accessories or by typing cmd from Run box.
You may see this message when trying to open command prompt.