As usual, I Borrowed/Swiped this from somewhere else. The full write-up can be found at:
This Utility, Autoruns
, will help you in discovering what programs/processes are started up when you fire up your Computer.
Like most other things you find on my pages, I suggest you use this with caution.
How to remove these infections manually
We have finally arrived at the section you came here for. You
are most likely reading this tutorial because you are infected with some
sort of malware and want to remove it. With this knowledge that you are infected,
it is also assumed that you examined the programs running on your computer
and found one that does not look right. You did further research by checking
that program against our Startup Database or
by searching in Google and have learned that it is an infection and you now
want to remove
If you have identified the particular program that is part of the malware,
and you want to remove it, please follow these steps.
Download and extract the Autoruns
program by Sysinternals to C:\Autoruns
- Reboot into Safe
Mode so that the malware is not started when you are doing
these steps. Many malware monitor the keys that allow them to start and
if they notice they have been removed, will automatically replace that
startup key. For this reason booting into safe mode allows us to get
past that defense in most cases.
- Navigate to the C:\Autoruns folder you created in Step
1 and double-click on autoruns.exe.
- When the program starts, click on the Options menu and
enable the following options by clicking on them. This will place a checkmark
to each of these options.
- Include empty locations
- Verify Code Signatures
- Hide Signed Microsoft Entries
- Then press the F5 key on your keyboard to refresh the
startups list using these new settings.
- The program shows information about your startup entries in 8 different
tabs. For the most part, the filename you are looking for will be found under
the Logon or the Services tabs, but you
should check all the other tabs to make sure they are not loading elsewhere
as well. Click on each tab and look through the list for the filename that
you want to remove. The filename will
There may be more than one entry associated with the same file as it is common
to create multiple startup entries. It is important
to note that many malware programs disguise themselves by using
filenames as valid
Microsoft files. it is therefore important to know exactly which file, and
the folder they are in, that you want to remove. You can
check our Startup
Database for that information
or ask for help in our computer help forums.
- Once you find the entry that is associated with the malware, you want to
delete that entry so it will not start again on the next reboot. To do that
right click on the entry and select delete. This startup
entry will now be removed from the Registry.
- Now that we made it so it will not start on boot up, you should delete
the file using My Computer or Windows Explorer. If you can not see the file,
it may be hidden. To allow you to see hidden files you can follow the
steps for your operating system found in this tutorial:
How to see hidden files in Windows
- When you are finished removing the malware entries from the Registry and
deleting the files, reboot into normal mode as you will now be clean from