btb_london
2007-09-07, 14:50
Like a number of other people I have been getting these alerts from teatimer. Although I have found useful background information about these no-one has yet said what they do and whether is is best to allow or deny them.
Please just tell me!
Category: Session Manager
Change: Value deleted
Entry: BootExecute
Old data: hex(7): 61,75,74,6F,63,68,65,63,6B,20,61,75
Category: Session Manager
Change: Value deleted
Entry: ExcludeFromKnownDLLs
Old data: hex(7): 00"
md usa spybot fan
2007-09-07, 15:44
For the meaning of the BootExecute and ExcludeFromKnownDlls registry entries, see:
BootExecute
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/46697.mspx
ExcludeFromKnownDlls
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/69679.mspx
It appears that a change is taking place to the following registry key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
From:
REG: CurrentControlSet Entries PART 2: SessionManager
http://support.microsoft.com/kb/102985
BootExecute REG_MULTI_SZ
Default: autocheck autochk *
Specifies programs to run during startup. For example, if CONVERT.EXE has been used to convert the file system on a hard disk drive, this value is added to BootExecute so that conversion occurs when the system is restarted: BootExecute = autocheck autoconv \DosDevices\x: /FS:NTFS
____________________
Without knowing what was going on in your system it is not possible to tell you whether to allow or deny the change. However unless you suspect that something malicious is deleting those values than more that likely some update took place that executed something at bootup and the entry is now being removed, in which case you should allow the change.