Difference between revisions of "AutoRunByFilename"
(→Usage: added var types)
m (→Usage: added "file" to parameters field name)
|Line 12:||Line 12:|
Revision as of 15:49, 22 February 2008
|Main Application||Version 1.3 or later|
|File Parameters||yes (third)|
|Build Parameters||yes (third)|
Searches for a registry run entry by the filename.
AutoRunByFilename:<filename(string)>,<directory(string)>[,advanced file parameters(list)]
This command is only to be used in rare cases where the autorun entry might be the only lead to a totally random directory name. It detects a Run value, much like AutoRun, and also an associated directory, but, contrary to AutoRunByFilename, it checks the data which contains the target filenames.
- The first parameter describes the filename to find. Algo-Prefixes are supported only here. AP PT
- The second parameter means an additional folder that might get flagged if the run entry points to a file inside a folder of that name. You may also keep this directory parameter empty, but you may not obmit it. Use * (with care) if you want to flag any folder that is associated with files identified by the first parameter.
- You may specify advanced file parameters to limit detection in case of ambigious value names (which nearly all are, so make use of this)!
- Any entries in Run, RunServices, RunOnce or RunServicesOnce (from \SOFTWARE\Microsoft\Windows\CurrentVersion\ for both HKEY_LOCAL_MACHINE and all users) that are identified by filename.
- The files associated with the entries, if they were found.
- The directory specified in the second parameter.