AutoRunByValue - Revision history

PepiMK: /* Scan Results */ added more details on locations

2008-06-26T15:03:48Z

Scan Results: added more details on locations

← Older revision		Revision as of 15:03, 26 June 2008
Line 29:		Line 29:

	===Scan Results===		===Scan Results===
	* Any entries in ~~''Run'', ''RunServices'', ''RunOnce'' or ''RunServicesOnce'' (from ''\SOFTWARE\Microsoft\Windows\CurrentVersion\'' for both HKEY_LOCAL_MACHINE and all users)~~ that are identified by ''value''.		* Any entries in the supported locations that are identified by ''value'' and optional parameters.
	* The files associated with the entries, if they were found.		* The files associated with the entries, if they were found.
	* The directory specified in the second parameter.		* The directory specified in the second parameter.

			===Locations===
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
			HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServiceOnce\
			Where HKEY_CURRENT_USER actually scans the registry of every available user account.
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
			HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServiceOnce\
			Where HKEY_LOCAL_MACHINE actually scans the global registry hive of every detected and loaded Windows installations (see [[/allhives]] and [[/nouserhives]]).

	==See also==		==See also==

CCRDude: /* Usage */ added var types

2008-02-22T18:33:03Z

Usage: added var types

← Older revision		Revision as of 18:33, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	AutoRunByValue:<value ~~name~~>,<directory>[,advanced file parameters]		AutoRunByValue:<value(string)>,<directory(string)>[,advanced file parameters]

	===Examples===		===Examples===

CCRDude: added "or later" to version

2008-02-22T13:42:29Z

added "or later" to version

← Older revision		Revision as of 13:42, 22 February 2008
Line 2:		Line 2:
	\|SYNTAX = AutoRunByValue		\|SYNTAX = AutoRunByValue
	\|PENAME = SpybotSD.exe		\|PENAME = SpybotSD.exe
	\|PEVERSION = 1.3		\|PEVERSION = 1.3 or later
	\|GROUP = Registry		\|GROUP = Registry
	\|MINUPDATE = n/a		\|MINUPDATE = n/a

CCRDude: added info box

2008-02-22T13:34:03Z

added info box

← Older revision		Revision as of 13:34, 22 February 2008
Line 1:		Line 1:
	Searches for a registry run entry by the registry value name~~. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it~~.		{{SbiCmdInfo
			\|SYNTAX = AutoRunByValue
			\|PENAME = SpybotSD.exe
			\|PEVERSION = 1.3
			\|GROUP = Registry
			\|MINUPDATE = n/a
			\|ADVFILEPARAMS = yes (third)
			\|ADVREGPARAMS = no
			\|ADVBUILDPARAMS = yes (third)
			\|ADVSPECIALPARAMS = no
			}}Searches for a registry run entry by the registry value name.

	==Usage==		==Usage==

CCRDude at 09:26, 18 February 2008

2008-02-18T09:26:38Z

← Older revision		Revision as of 09:26, 18 February 2008
Line 1:		Line 1:
	~~{{Outdated SBI\|AutoRun}}~~
	Searches for a registry run entry by the registry value name. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.		Searches for a registry run entry by the registry value name. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.

	==Usage==		==Usage==
	AutoRunByValue:~~[Value~~ name],[~~Directory]~~,<advanced file parameters>		AutoRunByValue:<value name>,<directory>[,advanced file parameters]

	===Examples===		===Examples===
Line 16:		Line 15:

	# The first parameter describes the value to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}}		# The first parameter describes the value to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}}
	# The second parameter means an additional folder that might get flagged if the run entry points to a file inside a folder of that name. You may also keep this directory parameter empty, but you may not obmit it.		# The second parameter means an additional folder that might get flagged if the run entry points to a file inside a folder of that name. You may also keep this directory parameter empty, but you may not obmit it. Use the wildcard ''*'' (with care) to flag any folder that belongs to identified entries.
	# You may specify [[Advanced file parameters\|advanced file parameters]] to limit detection in case of ambigious value names (which nearly all are, so make use of this)!		# You may specify [[Advanced file parameters\|advanced file parameters]] to limit detection in case of ambigious value names (which nearly all are, so make use of this)!

			===Scan Results===
			* Any entries in ''Run'', ''RunServices'', ''RunOnce'' or ''RunServicesOnce'' (from ''\SOFTWARE\Microsoft\Windows\CurrentVersion\'' for both HKEY_LOCAL_MACHINE and all users) that are identified by ''value''.
			* The files associated with the entries, if they were found.
			* The directory specified in the second parameter.

	==See also==		==See also==

CCRDude at 16:14, 17 February 2008

2008-02-17T16:14:23Z

← Older revision		Revision as of 16:14, 17 February 2008
Line 13:		Line 13:

	===Description===		===Description===
	This command is only to be used in rare cases where the autorun entry might be the only lead to a totally random directory name. It detects a Run value, much like [[AutoRun]], and also an associated directory. ~~Again~~, you may specify [[Advanced file parameters\|advanced file parameters]] to limit detection in case of ambigious value names (which nearly all are, so make use of this)! ~~You may also keep the directory parameter empty, but you may not obmit it. [[AlgoPrefix\|Algo-Prefixes]] are supported only for the value name.~~		This command is only to be used in rare cases where the autorun entry might be the only lead to a totally random directory name. It detects a Run value, much like [[AutoRun]], and also an associated directory.

			# The first parameter describes the value to find. [[AlgoPrefix\|Algo-Prefixes]] are supported only here. {{AlgoPrefix}}
			# The second parameter means an additional folder that might get flagged if the run entry points to a file inside a folder of that name. You may also keep this directory parameter empty, but you may not obmit it.
			# You may specify [[Advanced file parameters\|advanced file parameters]] to limit detection in case of ambigious value names (which nearly all are, so make use of this)!

	==See also==		==See also==

CCRDude at 14:46, 16 February 2008

2008-02-16T14:46:54Z

← Older revision		Revision as of 14:46, 16 February 2008
Line 25:		Line 25:

	[[Category:SBI Commands]]		[[Category:SBI Commands]]
			[[Category:SBI Commands supporting AlgoPrefix]]

CCRDude at 14:07, 16 February 2008

2008-02-16T14:07:43Z

← Older revision		Revision as of 14:07, 16 February 2008
Line 1:		Line 1:
	{{Outdated SBI\|AutoRun}}		{{Outdated SBI\|AutoRun}}

	Searches for a registry run entry by the registry value name. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.		Searches for a registry run entry by the registry value name. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.

CCRDude at 14:06, 16 February 2008

2008-02-16T14:06:32Z

← Older revision		Revision as of 14:06, 16 February 2008
Line 23:		Line 23:
	* [[AutoRun]]		* [[AutoRun]]
	* [[AutoRunByFilename]]		* [[AutoRunByFilename]]
			* [[AutoStart]]

	[[Category:SBI Commands]]		[[Category:SBI Commands]]

CCRDude at 14:01, 16 February 2008

2008-02-16T14:01:35Z

← Older revision		Revision as of 14:01, 16 February 2008
Line 1:		Line 1:
	{{~~Veraltertes~~ SBI~~\|AutoRunByValue~~\|AutoRun}}		{{Outdated SBI\|AutoRun}}

	Searches for a registry run entry by the registry value name. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.		Searches for a registry run entry by the registry value name. If the directory parameter is set, a directory of the given name will be detected too, if the file resided inside it.
Line 25:		Line 25:

	[[Category:SBI Commands]]		[[Category:SBI Commands]]
	~~[[Category:SBI Commands (outdated)]]~~