--- a/virus.rst	Tue Dec 15 18:57:23 2015 +0200
+++ b/virus.rst	Tue Dec 15 19:10:52 2015 +0200
@@ -28,6 +28,16 @@
 
   http://www.rootkit.nl/projects/rootkit_hunter.html
 
+For Windows:
+
+ * `HijackThis <http://sourceforge.net/projects/hjt/>`_
+ * `Sysinternals suite <https://technet.microsoft.com/ru-ru/sysinternals/>`_
+
+Use HijackThis to detect malware registration in system.
+
+Use Sysinternals procexp.exe to find which process lock file and path to
+executable images for removing unwanted software.
+
 Antivirus software.
 ===================