I just cleaned up a virus infection on my computer (running windows) by running an Anti Virus Scan. The malicious executable files are now deleted. However, the registry entries made by it remain. Also, this particular malware changed attributes on removable drives to make files and folders hidden. These files continue to remain hidden even after clean up.

This set me thinking, shouldn't Anti Virus Software remove all changes made by the malware instead of simply removing malicious executables?

Hope to hear your thoughts on this.

Thanks, Atul


Although AV programs will "do their best" to clean up a machine, it may be limited to killing the process and removing/cleaning the infected binaries. Although it may remove it from any "start automatically" (Run / RunOnce registry keys), it will be difficult to keep track of al changes the malware has caused, both during installation and operations.

Aside from some decent logging, it's difficult to find out "all registry changes" made by a particular executable.

As proposed by kiBytes, clean up the system and rebuild it.

  • Well, not always... This is why antivirus wants to run as root. So it can kill and delete anything... Think it like uninstaling a game or software... you delete the app, but sometimes empty folders remain behind sometimes not... If it is empty it is empty... However there might be some other malware in some other space... so nuke it! – cengizUzun Feb 11 '14 at 9:24

It's often hard to tell what changes on a system originate from malware and which originated from legitimate software or intentional user action.

Hidden files, for example. When the attributes of a file are set to "hidden", there is no information saved when this happened and by what program. The anti-virus software can hardly un-hide every file it finds, because it can't know if it was hidden by the virus or if these files are supposed to be hidden.

  • The malware in question hides all files and makes shortcuts which run a malicious exe and also open the file to which the shortcut refers.It should not be too complicated to look for all shortcuts which refer to the malicious executable, and then make the files which those shortcuts point to visible. Even for registry keys, i am seeing keys with the malicious executable's name in the windows registry. It should not be too complicated to search for those keys and if they refer to the deleted malicious exe - delete them don't you think? – Atul Feb 11 '14 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.