|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
.I was asking about Autoruns results in a thread from Susan “Tasks for the Weekend” on Autoruns. Posting here as a new topic, as requested:
Please start a new thread and we’ll move your replies to it. Saves cluttering this one with specific problems. cheers, Paul
Paul, can you move my replies? thanks.
Hi dmt_3901:
Just an FYI that the How-To Geek site has a 10-part series Using Sysinternal Tools Like a Pro by Lowell Heddings that includes lots of helpful hints for using Autoruns, Process Explorer, Process Monitor, and other Sysinternal tools. Lesson # 6 in that series is Using Autoruns to Deal with Startup Processes and Malware.
I ran autoruns and see a lot of entries that are either yellow or red. I checked on Bleeping computer startup DB, but didn’t find exact matches. Also did internet search, but found nothing conclusive. I could use some help. What does it mean when an entry is yellow? Red? Some yellow entries say ‘file not found.’ And some are red
This topic of how to interpret and use Autoruns is probably worthy of a thread of its own!
But just running it can provide plenty of info about your PC and the programs that load at start-up. Be careful if you proceed to disable (by un-checking) any items. Read the brief “Help” file in the menu first.
The yellow entries are generally “file not found”, yet there is still a startup entry somewhere on your PC for that. Generally harmless.
If by red, you meant pink, those are generally unsigned. Checking those items with VirusTotal can generally verify them as harmless.
As a rule, I never delete any entries, just uncheck them, and Autoruns will alter your start-up settings so that they do not startup. You can just check them again to revert the change.
And NEVER mess with anything in the Windows folder, unless you really know what you are doing, and can recover your PC. I once rendered my system un-bootable by going there. You can use the options to hide Windows and Microsoft entries from view.
Windows 10 Pro 22H2
.
.
.
Oh and ANOTHER question! I use VT all the time for URLs and files. But how do I search on a process? e.g. c\windows\syswow64\wow64cpu.dll? How do I do the search that autoruns does when it is working? This one is pink in autoruns.
Like I mentioned earlier, please don’t mess with Windows entries. Anything from Windows or Microsoft should get a pass in here. Focus on 3rd party stuff. For example, disabling entries in “C:\Windows\syswow64” is where I killed my system.
I am replying here because this one is a high priority caution! But please do as PaulT suggested and start a separate troubleshooting thread for Autoruns…
Windows 10 Pro 22H2
If indeed autoruns still works or has been made to work again (MS deprecated it long ago), it just tells you what runs when Windows starts. It’s a great utility. One of the things that can be done with the results is disabling items you don’t want to start. There’s a drop down disable setting. Be sure to File>Save or nothing will change. Be very sure you know what you’re doing, many if not most of those process are needed to make Windows or programs work.
For example, Nvidia used to add a ton of telemetry processes, some of which could be useful for gamers but for general use just got in the way and compromise privacy; autoruns was useful for disabling them.
When computers were much less powerful than now, autoruns had good general value as long as you understood it. I can recall disabling a dozen or so unneeded Windows along with program processes and seeing noticeable speed gains. Today, maybe not so much. It’s still useful as a diagnostic tool.
If indeed autoruns still works or has been made to work again (MS deprecated it long ago),
Nope. Sysinternals not deprecated. MS is still updating it, even as recently as last month… see “What’s New” here >
https://docs.microsoft.com/en-us/sysinternals/
Latest on Autoruns v13.98: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
Windows 10 Pro 22H2
A file search for the entire name, including extension should return results. However, most results fom a web search don’t tell a lot about the file and many are designed to make people worry they may have malware – these may have some vague malware information and advice to “click here to scan your computer”. Don’t do it. if uncertain, use the virustotal website to scan your file. Even there, be wary. a score of 1 or 2 from 70 or so malware vendors is often nothing more than false positive. In other words, don’t panic about a low non-zero score.
File.net often gives advice whether removing an autorun is to be avoided.
Processlibrary seems generally reliable for example, click this link so see what it says about wow64cpu.dll That’s not a lot of information but is enough to give a hint to not disable it.
Neuber also gives fairly good information but you need to search for the term using advanced search methods. For example, to search for information relating to lsass.exe, search as follows
“lsass.exe” site:.www.neuber.com
Wikipedia contains some information
Bleeping computers has startups information
Because you can switch something off, doesn’t necessarily mean you should. If you use something regularly, why bother. When switching something off the decision comes back to the wise advice given previously, “do you know what you are doing”.
Group A (but Telemetry disabled Tasks and Registry)
1) Dell Inspiron with Win 11 64 Home permanently in dock due to "sorry spares no longer made".
2) Dell Inspiron with Win 11 64 Home (substantial discount with Pro version available only at full price)
To answer the OP’s specific question – What to do with Autoruns results – I suggest:
1. Double-click on the appropriate Autoruns executable.
(Note: Do *not* right-click and select ‘Run as administrator’. In most cases you want Autoruns to report on the user account you normally log into Windows with. If you run it as ‘administrator’ then it will report different ‘per user’ settings. This is easily verified by saving an .ARN file whilst ‘Run as administrator’ then using File > Compare whilst run under the ‘ normal’ account.)
2. From Autoruns’ File menu, select Save and leave the format as Autoruns’ default .ARN format.
3. Zip the .ARN file and attach to a new post. (A typical .ARN file can be ~8MB or more. Neither the .ARN file format nor filesize can be attached directly to a post. Zipping the .ARN file will reduce it to ~250KB.) This will allow others to download and unzip the attachment then load the .ARN file into a local copy of Autoruns.
(Note: The free 7-Zip‘s ‘Ultimate’ compression level produces much smaller Zip files than Windows’ built-in ‘Send to > compressed (zipped) folder’.)
Hope this helps…
That post is basically rubbish, as evidenced by “Disable everything except Flash updater”. Flash is long deceased and you should not even have it installed.
A new PC with a standard W10 build is very fast and you don’t need to do anything to make it perform better.
You can turn off most of the telemetry with something like ShutUp10 if you feel the need.
When you install 1909, make sure you are disconnected from the internet to prevent Windows auto-updating you to 20H2. Also allows you to easily set up a local account.
cheers, Paul
p.s. I hope you have an M2 SSD in there. The single best speed improvement IMO.
You have to upload files for them to be checked, or have a file hash (SHA-256). FileAlyzer can generate those SHA-256 file hashes.
Correct, but when it is working properly with VT, Autoruns hashes them for you. It would take forever to actually auto upload all of the files scanned by Autoruns.
Windows 10 Pro 22H2
But there are still problems with 20H2 (chkdsk for one)
Not for everyone. “I’ve been contacted by several German blog readers by email and via comments within my German blog (thanks for that). They all pointing to a strange bug, obviously brought to systems with cumulative update KB4592438.”
As for 20H2 in general, I’ve been running it since its release without any problems. Of course this is anecdotal, but it’s easy enough to check for one’s self simply by making a drive image and upgrading to 20H2. If problems are encountered, just restore the drive image. If no problems are encountered, one can do whatever seems best.
What to switch off is not a straightforward ‘is it safe’ question. What you don’t need running is part of the decision. Another part is what you want to run.
To get you started, try pressing Ctrl+Alt+Delete to bring up Task Manager. Click on the Start-up tab. AFAIK these are all non-MS start-ups so should be non-essential BUT some manufacturers may have necessary utilities. Be cautious doing the following
On each of the lines, right-click and choose ‘search online’. That will launch a Bing search. Not all of the results will be dependable. File.net frequently gives you a small overview what the start-up program does. Double check it relates to the Start-up entry. Make you decision based on the description of what the file does and whether you need or want it. (e.g. I want my 3rd party firewall control to run but it is not essential). I currently have a list of 12, 7 of which are stopped. After that, get back to autoruns and do web searches. Some sites are reliable. Others try to get you to run their scammer (er, ‘scanner’).
Once you are certain a startup is not essential AND you don;t want it to run, righ-click and select ‘disable’.
When researching:
File.net is fairly reliable.
ShouldIremoveit.com is fairly reliable.
Processlibrary.com is fairly reliable
If it brings up results during a web search, Neuber.com is fairly reliable.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
