Resetting shell\open\command registry keys

Dont you sometimes hate these GOD DAMN! viruses that affects your windows computer…. I do and recenlty my home computer was infected by accident… the registry and tools>folder options were also disabled… luckly my scanner disabled that F***ER but i was stuck with the disability… The Fix i found out was simple, just an ini file which resets the registrey…

Determining the problem:

As part of their routine, many worms and Trojans make changes to the registry. Some of them change one or more of the shell\open\command keys. If these keys are changed, the worm or Trojan will run each time that you run certain files.

For example, if the \exefile\shell\open\command key is changed, the threat will run each time that you run any .exe file. This may also stop you from running the Registry Editor to try to fix this.

They may also change a registry value so that you cannot run the Registry Editor at all. This can be identified, when u try to run the regedit command it will say "You dont have administrators rights"…


  1. Download the file UnHookExec.inf and save it to your Windows desktop.
  2. Right-click the UnHookExec.inf file and click install. (This is a small file. It does not display any notice or boxes when you run it.)

This is what the file contains: 



HKLM, Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe "%1""
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools,0x00000020,0

well hope this helps, make sure ur virus database are upto date and have an updated anti-virus scanner installed. I use Avast! anti-virus and AVG anti-virus and also i use Clam AV on Unix (all these are free and powerful as nod32, symantec)



About this entry