Results 1 to 2 of 2

Thread: allow or deny bootexecute

  1. #1
    Junior Member
    Join Date
    Sep 2007

    Default allow or deny bootexecute

    Like a number of other people I have been getting these alerts from teatimer. Although I have found useful background information about these no-one has yet said what they do and whether is is best to allow or deny them.

    Please just tell me!

    Category: Session Manager
    Change: Value deleted
    Entry: BootExecute
    Old data: hex(7): 61,75,74,6F,63,68,65,63,6B,20,61,75

    Category: Session Manager
    Change: Value deleted
    Entry: ExcludeFromKnownDLLs
    Old data: hex(7): 00"

  2. #2
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005


    For the meaning of the BootExecute and ExcludeFromKnownDlls registry entries, see:

    It appears that a change is taking place to the following registry key:
    • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]


    BootExecute REG_MULTI_SZ

    Default:   autocheck autochk *
    Specifies programs to run during startup. For example, if CONVERT.EXE has been used to convert the file system on a hard disk drive, this value is added to BootExecute so that conversion occurs when the system is restarted: BootExecute = autocheck autoconv \DosDevices\x: /FS:NTFS

    Without knowing what was going on in your system it is not possible to tell you whether to allow or deny the change. However unless you suspect that something malicious is deleting those values than more that likely some update took place that executed something at bootup and the entry is now being removed, in which case you should allow the change.

    Getting an answer is one thing, learning is another.

    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts