AutoRunByFilename - Revision history

PepiMK: /* Description */ fixed reference to AutoRunByValue

2008-12-05T11:46:29Z

Description: fixed reference to AutoRunByValue

← Older revision		Revision as of 11:46, 5 December 2008
Line 18:		Line 18:

	===Description===		===Description===
	This command is only to be used in rare cases where the autorun entry might be the only lead to a totally random directory name. It detects a Run value, much like [[AutoRun]], and also an associated directory, but, contrary to [[~~AutoRunByFilename~~]], it checks the data which contains the target filenames.		This command is only to be used in rare cases where the autorun entry might be the only lead to a totally random directory name. It detects a Run value, much like [[AutoRun]], and also an associated directory, but, contrary to [[AutoRunByValue]], it checks the data which contains the target filenames.

	# The first parameter describes the filename to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}} {{PathTemplates}}		# The first parameter describes the filename to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}} {{PathTemplates}}

PepiMK: /* Scan Results */ added more details on locations

2008-06-26T15:04:02Z

Scan Results: added more details on locations

← Older revision		Revision as of 15:04, 26 June 2008
Line 25:		Line 25:

	===Scan Results===		===Scan Results===
	* Any entries in ~~''Run'', ''RunServices'', ''RunOnce'' or ''RunServicesOnce'' (from ''\SOFTWARE\Microsoft\Windows\CurrentVersion\'' for both HKEY_LOCAL_MACHINE and all users)~~ that are identified by ''filename''.		* Any entries in the supported locations that are identified by ''filename'' and optional parameters.
	* The files associated with the entries, if they were found.		* The files associated with the entries, if they were found.
	* The directory specified in the second parameter.		* The directory specified in the second parameter.

			===Locations===
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServiceOnce\
			Where HKEY_CURRENT_USER actually scans the registry of every available user account.
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServiceOnce\
			Where HKEY_LOCAL_MACHINE actually scans the global registry hive of every detected and loaded Windows installations (see [[/allhives]] and [[/nouserhives]]).

	==See also==		==See also==

CCRDude: /* Usage */ removed "list" from afp

2008-02-22T15:51:42Z

Usage: removed "list" from afp

← Older revision		Revision as of 15:51, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	AutoRunByFilename:<filename(string)>,<directory(string)>[,advanced file parameters~~(list)~~]		AutoRunByFilename:<filename(string)>,<directory(string)>[,advanced file parameters]

	===Examples===		===Examples===

CCRDude: /* Usage */ added "file" to parameters field name

2008-02-22T15:49:49Z

Usage: added "file" to parameters field name

← Older revision		Revision as of 15:49, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	AutoRunByFilename:<filename(string)>,<directory(string)>[,advanced parameters]		AutoRunByFilename:<filename(string)>,<directory(string)>[,advanced file parameters(list)]

	===Examples===		===Examples===

CCRDude: /* Usage */ added var types

2008-02-22T15:49:23Z

Usage: added var types

← Older revision		Revision as of 15:49, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	AutoRunByFilename:<filename>,<directory>[,advanced parameters]		AutoRunByFilename:<filename(string)>,<directory(string)>[,advanced parameters]

	===Examples===		===Examples===

CCRDude: added "or later" to version

2008-02-22T13:42:39Z

added "or later" to version

← Older revision		Revision as of 13:42, 22 February 2008
Line 2:		Line 2:
	\|SYNTAX = AutoRunByFilename		\|SYNTAX = AutoRunByFilename
	\|PENAME = SpybotSD.exe		\|PENAME = SpybotSD.exe
	\|PEVERSION = 1.3		\|PEVERSION = 1.3 or later
	\|GROUP = Registry		\|GROUP = Registry
	\|MINUPDATE = n/a		\|MINUPDATE = n/a

CCRDude: added syntax to box

2008-02-22T13:33:05Z

added syntax to box

← Older revision		Revision as of 13:33, 22 February 2008
Line 1:		Line 1:
	{{SbiCmdInfo		{{SbiCmdInfo
	\|SYNTAX =		\|SYNTAX = AutoRunByFilename
	\|PENAME = SpybotSD.exe		\|PENAME = SpybotSD.exe
	\|PEVERSION = 1.3		\|PEVERSION = 1.3

CCRDude: added info box

2008-02-22T13:32:52Z

added info box

← Older revision		Revision as of 13:32, 22 February 2008
Line 1:		Line 1:
	Searches for a registry run entry by the filename~~. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it~~.		{{SbiCmdInfo
			\|SYNTAX =
			\|PENAME = SpybotSD.exe
			\|PEVERSION = 1.3
			\|GROUP = Registry
			\|MINUPDATE = n/a
			\|ADVFILEPARAMS = yes (third)
			\|ADVREGPARAMS = no
			\|ADVBUILDPARAMS = yes (third)
			\|ADVSPECIALPARAMS = no
			}}Searches for a registry run entry by the filename.

	==Usage==		==Usage==

CCRDude at 09:26, 18 February 2008

2008-02-18T09:26:55Z

← Older revision		Revision as of 09:26, 18 February 2008
Line 2:		Line 2:

	==Usage==		==Usage==
	AutoRunByFilename:~~[Filename]~~,[~~Directory]~~,<advanced parameters>		AutoRunByFilename:<filename>,<directory>[,advanced parameters]

	===Examples===		===Examples===

CCRDude at 09:25, 18 February 2008

2008-02-18T09:25:22Z

← Older revision		Revision as of 09:25, 18 February 2008
Line 1:		Line 1:
	~~{{Outdated SBI\|AutoRun}}~~
	Searches for a registry run entry by the filename. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.		Searches for a registry run entry by the filename. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.

Line 12:		Line 11:

	# The first parameter describes the filename to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}} {{PathTemplates}}		# The first parameter describes the filename to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}} {{PathTemplates}}
	# The second parameter means an additional folder that might get flagged if the run entry points to a file inside a folder of that name. You may also keep this directory parameter empty, but you may not obmit it.		# The second parameter means an additional folder that might get flagged if the run entry points to a file inside a folder of that name. You may also keep this directory parameter empty, but you may not obmit it. Use ''*'' (with care) if you want to flag any folder that is associated with files identified by the first parameter.
	# You may specify [[Advanced file parameters\|advanced file parameters]] to limit detection in case of ambigious value names (which nearly all are, so make use of this)!		# You may specify [[Advanced file parameters\|advanced file parameters]] to limit detection in case of ambigious value names (which nearly all are, so make use of this)!

			===Scan Results===
			* Any entries in ''Run'', ''RunServices'', ''RunOnce'' or ''RunServicesOnce'' (from ''\SOFTWARE\Microsoft\Windows\CurrentVersion\'' for both HKEY_LOCAL_MACHINE and all users) that are identified by ''filename''.
			* The files associated with the entries, if they were found.
			* The directory specified in the second parameter.

	==See also==		==See also==
			* [[Advanced file parameters]]
	* [[AlgoPrefix]]		* [[AlgoPrefix]]
	* [[Advanced file parameters]]

	===Similar commands===		===Similar commands===