Understanding Auto Start Registry In TDS3

Discussion in 'Trojan Defence Suite' started by FireDancer, Sep 11, 2003.

Thread Status:
Not open for further replies.
  1. FireDancer

    FireDancer Registered Member

    Joined:
    Jul 24, 2003
    Posts:
    316
    Hello all,

    Welp to start off with I got my registerd key file lastnight from DiamondCS and I am thrilled to to be a new registerd user :) of TDS3. I am not to familiar with registry editing so I tend to stay away from it as I do not understand it to much..(very little). Last night I downlaoded TDS3. EXE and installed it. I then added the key file to the directory and ran the auto update, configured settings and all went well.

    I got home today and wanted to look around more on my new toy and when I opened up TDS3 I got the warning that auto start registry had changed. I understand what this function does as it looks for changes in the registry and the only thing I can find that changed is one of two things, Last night when installing after the download I disconnected from the internet and removed NOD32v2 and Kerio 2.1.5 as well as SpyWareGuard from start up so it would not interfere with me while installing and running a reboot.

    Once TDS3 was installed and configured I reconnected to internet and went to start up and re checked the applications I had shut down for a while. And the other thing I see is that NOD had updated today as it was supposed to. I have not made any changes to my system prior to or after the install of TDS3 and have had no problems in a long while. Would either of the things I did prior to the install of TDS3 or the updtae of NOD caused this warning with TDS3?

    Regards,
    ~FireDancer~
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi again FireDancer TDS family member!
    If you just close a program, that is not affecting the registry or autostart, but if you uncheck it from the autostart (f.e. in msconfig > tab startups) and afterwards check them again then you do make changes in the autostart andyou can expect a notification.
    Also if you install something which has a "runOnce" registry key and after reboot it is further installed and the key is empty then you can expect a warning for a change.
    If you have like me the habit to delete the QuickTime player from the autostart, once used it adds itself to the autostart and you'll see a warning for the change.
    So it is not alwayd big alarm, it can be logical but i think every time it alerts you it is worth to have a look.
    In TDS4 what has changed will be indicated to spare us searching and puzzling.

    You might like to add some files to the CRC32scan.txt like for those who you allow autoupdating and more; there are some threads about this subject and i think they are really usefull: i ever started at least with adding the Radius.td3 file so i know it is changed with my update :)

    Hope this helps!
     
  3. FireDancer

    FireDancer Registered Member

    Joined:
    Jul 24, 2003
    Posts:
    316
    Hello Jooske,

    Thanks for the reply :) as always you are right on it!!!
    If I understand you correctly, and after taking a closer look at the auto start registry I see that it could of very well been my firewall and NOD that created the alert in auto start when I re checked them to run on start up.

    They are both listed as RUNONCE, RUNONCEEX, RUNSERVICES.

    As far as adding to the CRC32 file I added my radius.td3 file to the list as you suggested. Again if I understand correctly you suggest this for apps that update automaticly so that you can see that the checksum has changed.. thus letting you know that the update did in fact take place? My list now looks like this and I gather that when TDS3 up dates again I will get a alert as to a CRC file being changed. The file in question would be radius.td3 correct?


    ; System files list for CRC32 testing
    %WINDIR%\win.ini
    %WINDIR%\system.ini
    %WINDIR%\explorer.exe
    %WINDIR%\regedit.exe
    %WINDIR%\taskman.exe
    %WINDIR%\NETSTAT.exe
    %WINDIR%\DRWATSON.exe
    %WINDIR%\rundll32.exe
    %WINSYSDIR%\systray.exe
    %WINDIR%\taskman.exe
    %WINSYSDIR%\icmp.dll
    %WINSYSDIR%\regsvr32.exe
    %WINSYSDIR%\netapi.dll
    %WINSYSDIR%\ntdll.dll
    %WINSYSDIR%\wininet.dll
    %WINDIR%\winsock.dll
    %WINSYSDIR%\wsock32.dll
    %WINSYSDIR%\ws2_32.dll
    %WINSYSDIR%\shell.dll
    %WINSYSDIR%\shell32.dll
    %TDSDIR%\tds-3.exe
    %TDSDIR%\RADIUS.TD3 <---------- this file here

    Now if I am thinking on this right I could add my NOD file as well to correct? To show that the update did take place... but then again NOD has a log file aready so maybe it is not nessecary.


    Maybe some one can offer some advise as to what files to add besides the ones I have on WIN98SE. I hope I understood correctly :)

    Regards,
    ~FireDancer~ ;)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.