BUG: System Internals check "Startup file does not exist"

[midas]

Posted this awhile ago but got no attention
The System Internals tool does not respect the system32 path (or perhaps any others?)
When a startup entry just says
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
or
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
or
nwiz.exe /install
without proper paths for the executable it is calling (just instead using the path entry from env vars)
It will then show up as an error
version 1.4 did not encounter this error I believe

 

[PepiMK]

Are you sure it got no attention?
Because I remember I worked on that problem :lip:

 

[midas]

The only stuff that comes up with System Internals is other unanswered threads
anyways, it's not just the startup entries but all of them, as a pchealth,inf uninstall entry comes up
also, install.exe, setup.exe, winnt32.exe entries should be ignored, they are part of the OS and some programs can have trouble installing if they are removed.
also, I am using 1.5.1.17 on a clean, normal xp sp2 install

 

[Rosenfeld]

I think it is the command line switches at the end of some of the entries that befuddle Spybot into thinking the file does not exist.

 

[PepiMK]

Has been discussed in the German sub-forum, that's why you probably didn't find it

Command line switches would only be a problem if they're in the same quotes as the filename, since Spybot should 1. if no quotes are there, cut off at the first space, otherwise 2. take the stuff between quotes. Plus a few special cases

 

[Rosenfeld]

These are the ones it flags on my system (exported from system internals check page):

Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\TweakMP9
Filename: RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\tweakmp.inf,DefaultUninstall
Data:

Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\TweakMP9
Filename: RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\tweakmp.inf,DefaultUninstall
Data:

Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCHealth
Filename: rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Data:

Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCHealth
Filename: rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Data:

I am not sure why each is duplicated.

In all these cases Spybot is flagging a bogus filename by including part of the commands after rundll32 or rundll32.exe.

That's what I meant by my remark in the previous post.

 

[PepiMK]

If RunAlyzer is showing the checksum for the proper file (and not a filesize of 0), the next update should have that fixed
(I implemented the RunAlyzer entry-to-file routine, which was much newer, into the System Internals recently)

 

[harishx]

hi...

i get the same message 'startup file does not exist'. This is cuz i removed the related program from program files.

But the problem am facing is that they are not getting removed from msconfig.

I used ur application (system internals), even thou delete option gets executed, when u scan again, the file comes up again.

I even went to extent of opening regedit.exe (from c:\windows\regedit.exe, I checked for stuff like regedit.com and none where there) and editing in local machine, microsoft, windows, current version, run !! I delete the entry and when i open again, the startup item i deleted shows up again.

What to do??

THanks,
Harish