AutoRuns for Windows v9.0

Thanks Ron!

 

From Windows Sysinternals Autoruns page

article

 

I ran Autoruns immediately and it found this very suspicious object in my online and even off-line system partition under :

HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
Autorun Entry: 0
Description...: blank (very suspicous)
Publisher......: blank (very suspicious, unknown source)
Image Path...: File not found About:Home (very suspicious, completely hidden)

I was stupified, because that was in theory impossible.
Was this a sneaky rootkit or keylogger ?
Was this a malware that infected the firmware of all my hardware components ?
Was this an object caused by one of these "invisible" things of Joanna ?
Was I infected by Rustock A upto Z ?
Was this malware telling me I'm a zero as a bad joke ?
I don't know. After the first panic and taking a valium pill, I got my common sense back.

I have an image of WinXPproSP2 only, which has never been on-line, not even for activation.
If that image also contained this suspicious object, I was malware-free.

So I restored that image, ran Autoruns and this suspicious object appeared again in the Autoruns List, which means it was NOT a malicious object.
Case closed and back to normal.

This is typical M$ : scaring the user about nothing. This is the second time.

 

Ta

 

@Erik, fwiw I have that also, so perhaps that provides additional reassurance that it actually is an MS entry.

 

Thanks for the tip! I'm running Autoruns v8.6. can I install v9 over my v8.6 or do I have to uninstall v8.6 first? Thanks

 

I just replace all 4 existing files with the 4 new ones...

 

There is no install (as such). Just replace the old exe with the new one.

 

I installed right over the old one. Works for me!

Ah Ron -- 10Q!

 

Thanks all.

 

Erik,
Autoruns isn't a blacklist scanner. It only informs you about certain system variables and it's up to you to verify/decide on them.
It's a forensic tool (like HijackThis, Runscanner, anti-rootkits, integrity checkers, etc) and it isn't targeted to "newbies", although you can learn how to use it without fear.