Windows 注册表^(Registry)是Windows计算机中最敏感的部分之一，负责处理发生的每个操作。在Windows 11/10计算机上遇到注册表恶意软件并不罕见，这会导致系统被黑或资源故障。Windows 11/10中从注册表中检查和删除恶意软件的手动过程。

如何在Windows 11/10注册表^(Registry)中的恶意软件

很难判断您的 PC 是否感染了任何此类注册表恶意软件。无文件恶意软件^{(Fileless Malware)}有时也可能隐藏在Rootkit^(Rootkits)或Windows 注册表^{(Windows Registry)}中。但是，如果您怀疑恶意软件感染了您的计算机，您可以删除它或让反恶意软件^{(remove it or have antimalware)}为您执行此操作。

一旦恶意软件感染系统注册表，它就会劫持指挥中心，这可能导致系统和数据崩溃，有时甚至无法恢复。

要在Windows 10^{(Windows 10)}的注册表中检查并手动删除恶意软件，请执行以下操作：

由于这是注册表操作，建议您备份注册表^{(back up the registry)} 或 创建系统还原点 作为必要的预防措施。完成后，您可以执行以下操作：

• 按Windows key + R调用“运行”对话框。
• 在“运行”对话框中，键入regedit并按 Enter 以打开注册表编辑器^{(open Registry Editor)}。
• 导航或跳转到下面的注册表项路径：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

• 在该位置的左侧窗格中，向下滚动以找到以Run开头的文件夹。

根据您的计算机，您可能会找到一到六个这样的文件夹。

• 现在，单击每个运行文件夹^{(Run folders)}，其中包含您的计算机被编程为在您启动机器时自动运行的程序列表。

请务必特别注意条目，因为许多恶意软件程序的名称可能拼写错误，或者您可能看起来不熟悉。如果您找到任何此类名称，您可以在Google或任何搜索引擎上搜索并进行研究。一旦您对该条目不合法且可能是恶意软件感到满意，请右键单击该条目，然后选择删除。

• 删除可疑条目后，您可能已经删除了注册表恶意软件。

恶意软件使用的其他常见注册表项^(Registry)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

如果您发现难以删除锁定的注册表项^{(Registry Keys)}或DWORDS。等，您可以使用Registry DeleteEx。

阅读^(Read)：针对初学者的恶意软件删除指南和工具^{(Malware Removal Guide & Tools for Beginners)}。

使用免费的 Registry Auditor

Registry Auditor扫描您的注册表中的广告软件^(Adware)、恶意软件和间谍软件条目——包括寄生虫和特洛伊木马，并通过彩色图标告诉您特定对象是安全的还是有害的——

• 绿色图标代表安全，
• 未知的黄色图标和
• 有害条目的红色图标。

你可以在这里下载^{(download it here)}。

相关阅读^{(Related read)}：使用卡巴斯基 WindowsUnlocker清理受勒索软件感染的注册表。

就是这样！

How to check Registry for malware in Windows 11/10

Windows Rеgistry is one of thе moѕt sensіtive parts of a Windows computer that takes care of every operation that oсcurs. It’s not unusual to encounter registry malwаre on your Windows 11/10 computer, which results іn system hack or failure of resources. In this post, we will walk you through the mаnual procedure to check and remoνe malware from the registry in Windows 11/10.

How to check Registry for malware in Windows 11/10

It is not easy to tell if your PC is infected with any of such registry malware. Fileless Malware sometimes may also hide in Rootkits or the Windows Registry. However, if you doubt malware has infected your machine, you may either remove it or have antimalware do it for you.

Once the malware infects the system registry, it hijacks the command center, which may result in system and data collapse that sometimes is beyond recovery.

To check and manually remove malware from the registry in Windows 10, do the following:

Since this is a registry operation, it is recommended that you back up the registry or create a system restore point as necessary precautionary measures. Once done, you can proceed as follows:

• Press Windows key + R to invoke the Run dialog.
• In the Run dialog box, type regedit and hit Enter to open Registry Editor.
• Navigate or jump to the registry key path below:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

• At the location, on the left pane, scroll down to locate folders starting with Run.

You may find one to up to six of such folders depending on your computer.

• Now, click on each of these Run folders, which contain a list of programs that your computer is programmed to run automatically as soon as you boot the machine.

It is important you pay extra attention to the entries as many malware programs may be there with misspelled names or they may look unfamiliar to you. If you find any such name, you can search for it on Google or any search engine and research. As soon as you’re satisfied that the entry is not legit and may be malware, right-click the entry, and choose delete.

• Once you’ve deleted the suspected entry, you’ve possibly removed a registry malware.

Other common Registry keys that malware uses

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

If you find it difficult to delete locked Registry Keys or DWORDS. etc, you may use Registry DeleteEx.

Read: Malware Removal Guide & Tools for Beginners.

Use free Registry Auditor

Registry Auditor scans your registry for Adware, malware and spyware entries – including parasites and trojans, and tells you by colored icons whether specific Objects are known to be safe or harmful –

• Green icon stands for Safe,
• Yellow icon for Unknown and
• Red icon for Harmful entries.

You can download it here.

Related read: Clean up a ransomware-infected Registry using Kaspersky WindowsUnlocker.

That’s it!

Related posts

• 免费Malware Removal Tools在Windows 11/10中删除Specific Virus

• 如何从Windows 11/10删除Chromium Virus

• 如何防止Malware - 保护Windows 11/10的提示

• 如何从Windows 10中删除病毒; Malware Removal Guide

• 如何在Windows 11/10中使用Command Prompt恢复Registry

• Group Policy Registry Location在Windows 10

• Windows 10中的Fix Bluetooth声音延迟

• Windows 10中的Startup Paths，Folders and Registry Settings列表

• Microsoft Edge Browser Tips and Tricks用于Windows 10

• 如何获取所有权和完全控制Registry keysin Windows 10

• CPU在Windows 11/10中的全speed or capacity不运行

• 如何在Windows 11/10中测试Webcam？它在工作吗？

• Power Management tab中缺少Device Manager上Windows 10

• HDMI playback设备未显示在Windows 10中

• 如何检查在Windows 10的Shutdown and Startup Log

• 如何将Group Policy Editor添加到Windows 10 Home Edition

• Best免费ISO Mounter software的Windows 10

• 如何监控和跟踪Windows 11/10的Registry

• 启用Network Connections而在Modern Standby上Windows 10

• 如何在Windows 10备份，Move，Move，或Delete PageFile.sys关闭