Autorun Report many entries

[danielm]

Has anyone fully found a resolution for the problem with the autorun report?

I saw a point to , http://www.paulscomputerservice.com/articles/article.php?ID=98

which I have tried and I think it worked on one pc but i tried 2 others and it seems to not do the trick.
Sometimes the startup is NOT blank in any case to start.

I'd hate for my database to be filled with useless junk, not to mention what else is going on here on the pc.

---also noticed,Win32_StartupCommand Class
the command seems to take info from many places. Does this mean I have to check manually every entry for every affect pc.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKU\ProgID\Software\Microsoft\Windows\CurrentVersion\Run
systemdrive\Documents and Settings\All Users\Start Menu\Programs\Startup
systemdrive\Documents and Settings\username\Start Menu\Programs\Startup

I was only looking in one place so far for the blank entries.

[danielm]

I would say it IS possible but I'd have to check on a per computer basis.
Most computers only have 1 person on it. Other than the ADMINS that log into it.
I'm seeing computers now pop up with the huge autorun entries just after I removed something for example.

example one pc
the history shows last change at 11/03/2011 18h and then 14/03/2011 07h a huge change list because something was removed.
Then again, perhaps the autorun was HUGH before and didnt notice it and I am only see it nowbecause of the change in autorun history.

At this point, I would just love a "CLEAN UP AUTORUN HISTORY" feature 🙂

On a note,
I've been told to fix the key at S-1-5-18 .
I hope I do not also have to do each user as well.
Or perhaps does this change if the user is logged in or not logged in?


ALSO
on this pc,
i just went to the reg s-1-5-18.....
changed the startup from C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup
to
"C:\Documents and Settings\Default User\Start Menu\Programs\Startup"

and forced full scan. and now my history shows thousands of - autorun,

CONFIG/AUTORUN shows normal entries now. weird!!!

[danielm]

ok i'll try that.
Now I have two pcs that just decided to ADD tones of junk in that autorun entry.
nothing changed and all of a sudden it's listing like every file in the windows dir.

I'm tempted to REMOVE the feature at this point.

Is there any chance of anyone finding how to fix this, OR, perhaps a nice manual autorun history clean would be nice. I hate browsing through 5 pages to get the the next usefull entry.

[Hemoco]

danielm wrote:
ok i'll try that.
Now I have two pcs that just decided to ADD tones of junk in that autorun entry.
nothing changed and all of a sudden it's listing like every file in the windows dir.

Is it possible a new user logged on to this computer (with the same empty key)?

[Hemoco]

you can delete it manually from table tblautorunhist

[danielm]

I wonder,
Is there any possibility to CLEAN the autorun history for just certain computers?
Or does this history only get kept for a certain time? I'd like to be able to clean up the computers that had this bug and that get fixed.
each pc ends up putting like 2000+ entries when it starts, and then another 2000+ when it gets fixed. that really eats up the report space on my screen when trying to view from the webpage.

[danielm]

I've been manually changing them again now. Sometimes it is blank. sometimes not.
if it's not blank it does seem to exist.
In any case, I've pasted in what seems to be more standard,

C:\Documents and Settings\Default User\Start Menu\Programs\Startup

and forced a FULL RESCAN and my history shows many removes from autorun.
I'll see how that goes.


For now, i've just made a simple report to look for append.exe in the list, ie

Select Top 1000000 tblComputers.Computername, tblComputers.ComputerUnique, tblComputers.Domain, tblAutorun.Command, tblAutorun.Location From tblComputers Inner Join tblAutorun On tblComputers.Computername = tblAutorun.Computername Where tblAutorun.Command Like '%append.exe%'

[Hemoco · Accepted solution]

This problem also happens if "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" points to a folder that does not exists.