Windows 10: Find some files in registry editor and wanna confirm if they are windows files or some...

Hi,I found some files in the registry editor which are suspicious. They look like malware register information, but I'm not suer. Because I just reset my PC few days ago. Unfortunately, some trogan viruses and back door related files detected on my PC yesterday afternoon. At least 28 files deleted with Microsoft malware tool. So far, no warning message from windows defender.Can anyone help confirm this? Below are the paths and SSs.\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings\WSD\SetupPlatform\SettingsIt looks like a phishing website with domain name insideruser.

:)

 

Recent File List

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file1

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file2
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file3
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file4
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file5
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file6
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file7
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file8
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file9
...

you get the idea. ( too lazy to put it in a for loop and test it.

or just open regedit and remove all the fileX from that key.

 

Are my Registry Files all legitimate programs?

Isn't there a web tool whereby I can check if programs listed in my REGISTRY FILES are legitimate programs?

 

Custom Registry Files

Techpowerup nor myself are in no way responsible for anything that may or may not go wrong with a users system if s/he decides to use these registry hacks. You are doing so at your own risk and agree to release me and or Techpowerup from fault that may occur. If a user decides to use these registry hacks, you must BACKUP YOUR REGISTRY FIRST!

To backup your registry click Start>Run (or use windows search from the start menu) and type "Regedit" without quotes. Click on File>Export. Name the file whatever you wish and save it somewhere that is NOT on your Windows drive.

Contained inside the attached RAR file you will find 13 registry hacks. They are:

• Copy To - Adds Copy To to the right click context menu
• Move To - Adds Move To to the right click context menu
• Enable Balloon Notification - Self explanatory
• Disable Balloon Notification - Self explanatory
• Extended UI Hover Time - Despite its name it decreases the time it takes to preview a thumbnail
• Instant Aero Peek - Self explanatory
• Last Active Click - If you have multiple of the same program open, click the icon and it will bring to you your last open window of that program. Click again and you can cycle through.
• Menu Show Delay - Decreases the time it takes for the start menu to appear
• Move Kernel - Moves the Windows Kernel from the HDD to memory increasing system performance slightly.
• Stop Snap - Disables the Windows 7 Snap feature (when you drag a window to the corner of the screen)
• Stop Space Checking - Keeps Windows from constantly checking disk space
• USB Write Protect - Disallows Windows to write to any USB device but will still allow the device to be read from.
• Wait To Kill Service Timeout - Decreases the time it takes windows to wait for a program to fully close before shutting down.

I have tested all but Move Kernel, Stop Space Checking, and USB Write Protect and they all work 100%. If you open up the registry file I provide, it will give you more information on where the key specifically is along with some information on what it does. Obviously the Aero Peek and Hover time hacks will not work on versions of Windows earlier than 7.

I got the Copy To and Move to from How To Geek and the rest I just Googled and turned into a registry file for convenience. Not sure how many of you guys will need this but i found some new registry hacks that Ill be using now while doing this so I thought I would share with the community. Make me good for something. *Roll Eyes

If I come across more Ill edit this post and upload the new zip. Feel free as well to tell us any registry hacks you use and I could even add them to the list. *Smile

Enjoy!