AutoRun - Revision history

CCRDude: /* Examples */ more generic

2008-02-23T17:36:38Z

Examples: more generic

← Older revision		Revision as of 17:36, 23 February 2008
Line 15:		Line 15:

	===Examples===		===Examples===
	AutoRun:"~~AdRoarUpdate~~","<$WINDIR>\~~ARUpdate~~.exe","filesize=86016,md5=1234567890ABCDEFFEDCBA0987654321"		AutoRun:"MalwareEntry","<$WINDIR>\MyMalware.exe","filesize=86016,md5=1234567890ABCDEFFEDCBA0987654321"

	This example searches registry Run keys (global and for all users) for entries named ''~~AdRoarUpdate~~'', pointing to a file ''~~ARUpdate~~.exe'' inside the Windows folder, that matches the specified [[Advanced file parameters\|advanced file parameters]].		This example searches registry Run keys (global and for all users) for entries named ''MalwareEntry'', pointing to a file ''MyMalware.exe'' inside the Windows folder, that matches the specified [[Advanced file parameters\|advanced file parameters]].

	===Description===		===Description===

CCRDude: /* Usage */ added var types

2008-02-22T15:51:24Z

Usage: added var types

← Older revision		Revision as of 15:51, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	AutoRun:<value ~~name~~>,<filename ~~data~~>[,advanced file parameters]		AutoRun:<value(string)>,<filename(string)>[,advanced file parameters]

	===Examples===		===Examples===

CCRDude: /* Examples */ updated md5 to make it more clear that this is an invented example only

2008-02-22T15:47:09Z

Examples: updated md5 to make it more clear that this is an invented example only

← Older revision		Revision as of 15:47, 22 February 2008
Line 15:		Line 15:

	===Examples===		===Examples===
	AutoRun:"AdRoarUpdate","<$WINDIR>\ARUpdate.exe","filesize=86016,md5=~~5F45E52554D022A757BA637E4E03B0A5~~"		AutoRun:"AdRoarUpdate","<$WINDIR>\ARUpdate.exe","filesize=86016,md5=1234567890ABCDEFFEDCBA0987654321"

	This example searches registry Run keys (global and for all users) for entries named ''AdRoarUpdate'', pointing to a file ''ARUpdate.exe'' inside the Windows folder, that matches the specified [[Advanced file parameters\|advanced file parameters]].		This example searches registry Run keys (global and for all users) for entries named ''AdRoarUpdate'', pointing to a file ''ARUpdate.exe'' inside the Windows folder, that matches the specified [[Advanced file parameters\|advanced file parameters]].

CCRDude: added "or later" to version

2008-02-22T13:42:47Z

added "or later" to version

← Older revision		Revision as of 13:42, 22 February 2008
Line 2:		Line 2:
	\|SYNTAX = AutoRun		\|SYNTAX = AutoRun
	\|PENAME = SpybotSD.exe		\|PENAME = SpybotSD.exe
	\|PEVERSION = 1.4		\|PEVERSION = 1.4 or later
	\|GROUP = Registry		\|GROUP = Registry
	\|MINUPDATE = n/a		\|MINUPDATE = n/a

CCRDude: added special param

2008-02-22T13:33:20Z

added special param

← Older revision		Revision as of 13:33, 22 February 2008
Line 8:		Line 8:
	\|ADVREGPARAMS = no		\|ADVREGPARAMS = no
	\|ADVBUILDPARAMS = no		\|ADVBUILDPARAMS = no
	\|ADVSPECIALPARAMS = no		\|ADVSPECIALPARAMS = [[flagifnofile]]
	}}Autorun helps you detect registry autorun settings.		}}Autorun helps you detect registry autorun settings.

CCRDude: added info box

2008-02-22T13:30:49Z

added info box

← Older revision		Revision as of 13:30, 22 February 2008
Line 1:		Line 1:
	Autorun helps you detect ~~registrx~~ autorun settings.		{{SbiCmdInfo
			\|SYNTAX = AutoRun
			\|PENAME = SpybotSD.exe
			\|PEVERSION = 1.4
			\|GROUP = Registry
			\|MINUPDATE = n/a
			\|ADVFILEPARAMS = yes (third)
			\|ADVREGPARAMS = no
			\|ADVBUILDPARAMS = no
			\|ADVSPECIALPARAMS = no
			}}Autorun helps you detect registry autorun settings.

	==Usage==		==Usage==

CCRDude at 09:22, 18 February 2008

2008-02-18T09:22:08Z

← Older revision		Revision as of 09:22, 18 February 2008
Line 2:		Line 2:

	==Usage==		==Usage==
	AutoRun:[value],[filename data],<advanced file parameters>		AutoRun:<value name>,<filename data>[,advanced file parameters]

	===Examples===		===Examples===
Line 14:		Line 14:
	# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix\|Algo-Prefixes]]. {{AlgoPrefix}}		# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix\|Algo-Prefixes]]. {{AlgoPrefix}}
	# The second parameters takes a file path and name. It understands both [[AlgoPrefix\|Algo-Prefixes]] and [[Path templates\|path templates]]. {{AlgoPrefix}} {{PathTemplates}}		# The second parameters takes a file path and name. It understands both [[AlgoPrefix\|Algo-Prefixes]] and [[Path templates\|path templates]]. {{AlgoPrefix}} {{PathTemplates}}
	# The third parameter allows you to specify [[Advanced file parameters\|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them.		# The third parameter allows you to specify [[Advanced file parameters\|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them. Also, a special advanced parameter [[flagifnofile]] can be used here, in case you specified advanced file parameters, but the associated file does not exist.

			===Scan Results===
			* Any entries in ''Run'', ''RunServices'', ''RunOnce'' or ''RunServicesOnce'' (from ''\SOFTWARE\Microsoft\Windows\CurrentVersion\'' for both HKEY_LOCAL_MACHINE and all users) that are identified by both ''value name'' and ''filename data''.
			* The files associated with the entries, if they were found.

	==See also==		==See also==
			* [[Advanced file parameters]]
	* [[AlgoPrefix]]		* [[AlgoPrefix]]
	* [[Advanced file parameters]]
	* [[Path templates]]		* [[Path templates]]
	* [[Description templates]]		* [[Description templates]]
Line 28:		Line 32:

	[[Category:SBI Commands]]		[[Category:SBI Commands]]
	~~[[Category:SBI Commands (current)]]~~
	[[Category:SBI Commands supporting AlgoPrefix]]		[[Category:SBI Commands supporting AlgoPrefix]]

CCRDude: /* Description */

2008-02-17T16:36:55Z

Description

← Older revision		Revision as of 16:36, 17 February 2008
Line 11:		Line 11:
	===Description===		===Description===
	This parameter takes two to three parameters, with the third one highly recommended.		This parameter takes two to three parameters, with the third one highly recommended.

	# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix\|Algo-Prefixes]]. {{AlgoPrefix}}		# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix\|Algo-Prefixes]]. {{AlgoPrefix}}
	# The second parameters takes a file path and name. It understands both [[AlgoPrefix\|Algo-Prefixes]] and [[Path templates\|path templates]]. {{AlgoPrefix}}		# The second parameters takes a file path and name. It understands both [[AlgoPrefix\|Algo-Prefixes]] and [[Path templates\|path templates]]. {{AlgoPrefix}} {{PathTemplates}}
	# The third parameter allows you to specify [[Advanced file parameters\|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them.		# The third parameter allows you to specify [[Advanced file parameters\|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them.

CCRDude at 16:11, 17 February 2008

2008-02-17T16:11:17Z

← Older revision		Revision as of 16:11, 17 February 2008
Line 11:		Line 11:
	===Description===		===Description===
	This parameter takes two to three parameters, with the third one highly recommended.		This parameter takes two to three parameters, with the third one highly recommended.
	# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix\|Algo-Prefixes]].		# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix\|Algo-Prefixes]]. {{AlgoPrefix}}
	# The second parameters takes a file path and name. It understands both [[AlgoPrefix\|Algo-Prefixes]] and [[Path templates\|path templates]].		# The second parameters takes a file path and name. It understands both [[AlgoPrefix\|Algo-Prefixes]] and [[Path templates\|path templates]]. {{AlgoPrefix}}
	# The third parameter allows you to specify [[Advanced file parameters\|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them.		# The third parameter allows you to specify [[Advanced file parameters\|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them.

CCRDude at 14:46, 16 February 2008

2008-02-16T14:46:44Z

← Older revision		Revision as of 14:46, 16 February 2008
Line 28:		Line 28:
	[[Category:SBI Commands]]		[[Category:SBI Commands]]
	[[Category:SBI Commands (current)]]		[[Category:SBI Commands (current)]]
			[[Category:SBI Commands supporting AlgoPrefix]]