Session Manager Value Change Allow?

[kotanmj]

Hi, I am running xp

how do I know if I should allow a change? I had scanned my computer with Avast and it said there was an issue in my registry files with adware. I told it to delete it. I restarted and then win defender froze so I restarted again. This time this message appears and I don't know what to do. Should I allow change or deny?
old data:
autocheck autochk*\aswBoot.exe /A:"*"/L:"English"/KBD:2
new: autocheck autochk *\

thanks
Mary

[md usa spybot fan]

kotanmj:

You did not indicate the "Entry" being changed. I assume that entry is "BootExecute" and the content of the full TeaTimer dialog is:


Category: Session manager
Change: Value Changed
----------
Entry: BootExecute
----------
Old data: autocheck autochk*\aswBoot.exe /A:"*"/L:"English"/KBD:2
New data: autocheck autochk *\
If so, allow the change.

The category "Session manager" indicates a change to one of the ControlSet Session Manager registry keys:


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSetxxx\Control\Session Manager]
The default entry for "BootExecute" normally is (Name – Type - Data):


BootExecute - REG_MULTI_SZ - autocheck autochk *
It appears that avast! is returning the "BootExecute" to its default value.

[skeeter]

I am running windows xp also and am new to it. I also use Avast and Ad-Aware besides Sypbot Search and Destroy. This morning Spybot did an update and the following came up. This is the second time this has happened and I check deny change but not sure what the problem is. Below is the note I get.

Spybot - Search and Destroy has detected an important registry entry that has been changed.

Category: Session manager
Change: Value changed
Entry: BootExecute
Old Data: autocheck autochk*
New Data: autocheck autochk *\lsdelete\

My question is, do I allow the change, as I am not sure what it is changing? Any help would be greatly appreciated.

[md usa spybot fan]

skeeter:

The default for the "BootExecute" in the "CurrentControlSet" "Session Manager" is usually "autocheck autochk *". It appears that Lavasoft's Ad-Aware adds the extra parameter lsdelete.

If you were installing Lavasoft's Ad-Awareso, allow the registry change.

[KittyCentral]

I was using Window XP last night and had USB flash drive plugged in. I was going to eject the flash drive but got message, "Generic Volume Cannot Be Stopped..." I was going to shut down so I could remove my flash drive. When I shut down, windows did an automatic update. I waited and waited. It finally finished the update and shut down. When I tried to restart my computer, I got that msg that windows had failed to start correctly. I let it start by itself and got a dark screen. I turned it off and tried again. It still wouldn't start. So I waited till this morn. I turned it on and got the screen that windows had failed to start properly (something to that tune). So I started it under the last know configuration in which it was working.

Then spybot teatimer popped up with following msg:

Category: Session manager
Change: Value deleted
Entry: BootExecute
Old data: autocheck autochk *

I am assuming that since I started in the last known working configuration that a value would have changed as a result so I should allow the change. Is that the right assumption?

FYI: I use Norton Internet Security.

I'm sorry if I'm asking a stupid question but I would really appreciate any info you might be able to provide.

Thank you.

[shinealight]

The last two times I booted, I've had to wait two or more hours while Autocheck scanned my system, only to get clean reports each time.

I have done nothing to instruct any program to run a scheduled Autocheck. Is one of my programs, or WinXP, telling this to take place?

How can I get it stopped if I've got a clean disk?

After the Autocheck runs, I get a msg from Spyboy-Search&Destroy that is identical to the one described by skeeter in his above post #3 in this thread.

Any constructive comments are welcome and appreciated.

[shinealight]

Well, guys, I may (or may not) have stumbled upon the answer to the question I posted directly above (and possibly some assistance to others who've posted in this thread). If you're interested in a long, detailed read, go to: http://www.infocellar.com/winxp/chkdsk-and-autochk.htm (http://www.infocellar.com/winxp/chkdsk-and-autochk.htm).

Oh, and about the "dirty bit" mentioned in the article: I guess they mean a bad place on disk---no idea, really.

Also of interest may be some of the links contained within that article.

If you're less patient, well, you could try the method outlined within Microsoft's
Support site at: http://support.microsoft.com/kb/831426 .

I've got to try myself to see which is easiest.

Hope this helps someone.

[md usa spybot fan]

shinealight:

As indicated above the default of value of the BootExecute entry is "autocheck autochk *". When "autochk" runs it checks for the "dirty bit" on your drives and runs a "chkdsk" if it finds the "dirty bit" set.

Before you reboot the next time you could check to see if any of your drives are flagged as being dirty. To do that:
Click Start, select Run
In the Open box, type:
cmd
Click:
OK
To check the state of the dirty flag on your C: drive ,for example. Type the following at the command prompt:
fsutil dirty query c:
The response should be:
Volume - c: is NOT Dirty
Type Exit when you are done querying your drives.
You can also find more information on disk utilities in the following article:
Maintaining Hard Disk Drives
http://www.justdl.com/books/Windows_Command_Line_Administrators_Pocket_Consultant_MS_Press/DDU0046.html