a better Chkdsk?

Hmmm. That sprestrt value data looks pretty fishy to me, that should
not be there after the Windows installation is properly completed. Are
you absolutely 100% sure that your installation is completely free of
virus or other pests?

John

Frank wrote:

> BootExecute value is autocheck autochk* sprestrt
>
>
>
> John John wrote:
>
>> Frank wrote:
>>
>>
>>> The HKLM...... Registry Key does not exist
>>
>>
>> The BootExecute value at:
>>
>> HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
>>
>> *must* exist else you could not schedule chkdsk to run on reboot nor
>> could you have autoconv run on startup! BootExecute is a REG_MULTI_SZ
>> value in that key.
>>
>> I'm thinking that maybe something Norton or something to do with AV
>> activity on reboot prevents the convert from happening?
>>
>> John
>>

"John John" wrote in message
news:Oz$qN19gIHA.4744@TK2MSFTNGP06.phx.gbl...
> Hmmm. That sprestrt value data looks pretty fishy to me, that
> should not be there after the Windows installation is properly
> completed. Are you absolutely 100% sure that your installation is
> completely free of virus or other pests?


The sprestrt value in that registry key will kick off the following
program when Windows starts up:

C:\Windows\system32\sprestrt.exe

According to "How Setup Works"
(http://technet2.microsoft.com/windowsserver/en/library/7b28284e-d1d2-4dc7-88d3-4e75bbf63a971033.mspx),
this program seems involved in the install of Windows (in getting a
usable desktop GUI to continue the install). If you right-click on
the file in WIndows Explorer and look at Properties under the Version
tab, the program's description is "Restores registry to restart
GUI-mode part of setup."

It is also possible that malware figured out to replace this file and
add the value to the registry key to get this malware to run on every
startup of Windows (and because the vast majority of security software
would load). Many utilities to show startup items do not include the
BootExecute key. Even some HIPS (host intrusion protection systems)
don't look for it. AutoRuns from SysInternals (now owned by
Microsoft) does list this key as a startup item. Mine has:

autocheck autochk *
Isdelete

(when you look at its value in its own window rather than the view
pane in regedit, there are 2 values for that key). The autocheck
entry will run:

C:\Windows\system32\autochk.exe

and the Isdelete entry will run:

C:\WIndows\system32\Isdelete.exe

So if any of those 3 files are infected or corrupted, the malware or
bad file runs early in Windows startup. For example, the VirtuMundo
pest alters the BootExecute key (but adds a different entry than
sprestrt.exe); see
http://wiki.castlecops.com/Malware_Removal:_Virtumundo. BootExecute
is right up there with the WinLogon events for programs that run far
before any security software gets loaded.

Frank shows sprestrt on the same line as autocheck but that might be
because he was looking at the view pane on the right in regedit.
Double-click the data item to show its value list in its own window.
sprestrt should be on its own line as another program to run on
Windows startup, not as a parameter to autochk. Some programs add
their own line to this data item. For example, and only from what
I've read, selecting to perform a boot-time scan in Avast anti-virus
will add an "aswBoot.exe ..." entry to this data item. It's a way to
get a program to run early during the startup of Windows.

See:

http://technet2.microsoft.com/windowsserver/en/library/7b28284e-d1d2-4...-88d3-4