How to manually remove viruses! (Or check for them)

Today I stayed home from school, giving me time to write about how to manually remove most viruses, and also just check for them.

It's quite a simple task, however if you mess something up it could damage your computer, so please be wary and don't do anything rash.

First thing to know: Most viruses are RAT's, Keyloggers, or other things that infect you for the Infecter's personal gain, and most run when your computer is started up.

To make a program stop running on start up, there are a few places to look, the first one would be the most obvious, the start up folder which can be found;

XP/2K
•C:\Documents and Settings\All Users\Start Menu\Programs\Startup
•C:\Documents and Settings\<username>\Start Menu\Programs\Startup
Vista/7
•C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup (Note - this directory is hidden by default)
•C:\Users\<username>\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\Startup
Once there, delete any program that you do not wish to run on Startup, Generally you don't need any unless you want them there.

How to get to where you need to be: Click the start menu button and search "Regedit" Open it as an administrator and then navigate to a location below, i suggest going to the ones that're bold first.

Once you have navigated yourself to one of the destinations below, look to see if anything looks suspricious, if anything is obviously a virus right click it, and delete it. If you are not sure what it is, but want to get rid of it and see, back up that registry file, as in Write down all it's information, save it in a notepad, or create a system restore point in case anything goes wrong. Once it's safe to delete, go ahead and try it. Once you think you've got the registry all cleaned up go ahead and restart your computer, and see how everything goes.

HK_Current_User\Software\Microsoft\Windows\Current Version\Run

HK_Current_User\Software\Microsoft\Windows\Current Version\RunOnce

HK_Local_Machine\Software\Microsoft\Windows\Curren tVersion\Run

HK_Local_Machine\Software\Microsoft\Windows\Curren tVersion\RunOnce

HK_Local_Machine\Software\Microsoft\Windows\Curren tVersion\RunServices .


HK_Local_Machine\Software\Microsoft\Windows\Curren tVersion\RunServicesOnce
The ones that are in bold are the most likely to have infected items, and probably your best bet on where to look.

If your computer is still not fixed, you could have other corrupt registry files, which can be fixed with CCleaner or manually finding the archived back up registry files and replacing them.


If you feel your computer and information is truly at risk, and you have a serious virus, you could reinstall windows, which would fix all your problems, back up any important files before you do, however I know Windows 7 backs them up for you when installing a new windows.

Lastly: The simplest way is click on the start menu button, Search "System Restore" and restore it to awhile back, I know I'm a bastard for saving this until the end, when it could be your simplest way of fixing it.

Hope I helped? Comments, Questions, things I left out, how to make this thread prettier, post below.

AntiVirus could help stop virus's infecting your computing. But thanks for the tutorial!

This is for the viruses that're crypted and anti-viruses can't pick up for trace.