Difference between revisions of "AutoRun"
(→Description) |
|||
| Line 11: | Line 11: | ||
===Description=== | ===Description=== | ||
This parameter takes two to three parameters, with the third one highly recommended. | This parameter takes two to three parameters, with the third one highly recommended. | ||
| + | |||
# The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix|Algo-Prefixes]]. {{AlgoPrefix}} | # The first parameter specifies the name of the registry value to look for; this parameter can be used with [[AlgoPrefix|Algo-Prefixes]]. {{AlgoPrefix}} | ||
| − | # The second parameters takes a file path and name. It understands both [[AlgoPrefix|Algo-Prefixes]] and [[Path templates|path templates]]. {{AlgoPrefix}} | + | # The second parameters takes a file path and name. It understands both [[AlgoPrefix|Algo-Prefixes]] and [[Path templates|path templates]]. {{AlgoPrefix}} {{PathTemplates}} |
# The third parameter allows you to specify [[Advanced file parameters|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them. | # The third parameter allows you to specify [[Advanced file parameters|advanced file parameters]] to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them. | ||
Revision as of 16:36, 17 February 2008
Autorun helps you detect registrx autorun settings.
Usage
AutoRun:[value],[filename data],<advanced file parameters>
Examples
AutoRun:"AdRoarUpdate","<$WINDIR>\ARUpdate.exe","filesize=86016,md5=5F45E52554D022A757BA637E4E03B0A5"
This example searches registry Run keys (global and for all users) for entries named AdRoarUpdate, pointing to a file ARUpdate.exe inside the Windows folder, that matches the specified advanced file parameters.
Description
This parameter takes two to three parameters, with the third one highly recommended.
- The first parameter specifies the name of the registry value to look for; this parameter can be used with Algo-Prefixes. AP
- The second parameters takes a file path and name. It understands both Algo-Prefixes and path templates. AP PT
- The third parameter allows you to specify advanced file parameters to limit the scan to entries that point to files that have specific contents. Since file names can be misleading and ambiguous, it is highly recommend to specify them.
