orangegrouptech/Windows-Malware-Effects-Remediation-Tool

Some suggestions and bug fixes

Closed this issue · 10 comments

You should add a

Reset mouse buttons

feature. It should go to HKCU\Control Panel\Mouse\SwapMouseButtons.

Another feature I have is

Delete logon colorization

It should go to HKLM\Software\Policies\Microsoft\Windows\System

All because I still want to see the landscape backgrounds.

Any fixes will be added in a new comment.
(https://user-images.githubusercontent.com/97461027/156777395-00e8cb03-6efe-4705-8145-e4dedf4c68f5.jpg)

Alright, I'll add these to the upcoming update

Hello,
could you elaborate on the "delete logon colorisation" feature? do you mean disablelogonbackgroundimage?

Reset mouse buttons has been added to 3.1

What does "run as safe user" do

No safe user.
Anyways, in the AutomaticRepair window, there was a little mistake. I tested it on a virtual machine that had DisableCMD, and apparently AutomaticRepair did not detect it.
Code: if ((int?)checkcmd.GetValue("DisableCMD") == 0)
I checked the WinForms version and it is:
if ((int)checkcmd.GetValue(“DisableCMD”) != 0
I have no idea how to fix this. Fix it please.

You're right, it seems like I made a typo there. Should have been != 0 instead of == 0 so that it'll detect it if the DisableCMD policy is enabled (1, 2, 3) and not disabled (0). I'll push an update shortly.
And yeah sorry I have been taking a break from all of this so I didn't look into this until now.

Update 3.2.1 has been pushed out to address this. Try it out and see if that fixed the issue.

Update 3.2.1 has been pushed out to address this. Try it out and see if that fixed the issue.

Yep, it worked!

I forgot to include a patch (in 3.2.1) where if you reset txt and exe icons, it will launch Explorer.exe file manager instead of task bar. Change this code: cmd /c explorer.exe
into this: cmd /c start explorer.exe
I dunno if this will work, but sure, I think this is the way.

Both are pretty much the same thing and the reason why it launches the file manager instead is because explorer.exe is already running and you're creating a second instance