Sysinternals updates

You're welcome mate. No, it's definitely not only on your end. A few users on our forum shared that VT is not working for them too. Some with Windows 10 and some with Windows 11 (beta testers). So it's not due to Windows version but Autoruns itself. I hope that Mark will fix the issues soon.

 

That was a shock seeing Autoruns released with very vital parts of it terribly limited. I also sure hope they can rebound with a working one again very soon.

You can download a working Autoruns 13.98 from FileHippo like I had to do.

From now on it's advised not to overwrite those SysInternals with updates until we can be sure they're not messed up releases like 14 is.

 

Regarding this topic, Autoruns 14 is broken for sure and confirming that it is not only us who are experiencing these issues.

https://malwaretips.com/threads/autoruns-windows-sysinternals-updates-thread.109716/

Also in v14 there is no text "File not found". The yellow color is still present for such entries, tho.

13.100 is working great for me.

 

Sysinternals Suite (September 1, 2021)
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

These applications have been updated:

 

Thanks mood.

VT is now working as expected. Will test the other issues soon to see if they are resolved as well.

 

Unfortunately not all bugs are fixed.

1. The text file not found is still missing for the yellow entries.
2. VT results are not in red color (for the detected entries).
3. Version 14.01 shows some codecs as missing, but they exist regarding version 13.100 (It shows wrong Image Path ⇒ C:\Program Files.exe... But the registry entries are fine):

https://i.ibb.co/8KMm1hW/Untitled.png

4. It shows duplicate entries.

Ok, they fixed the VT blank column and the errors when you try to disable or delete entries, but there are still too many bugs for my taste.

13.100 is still the best version for me so far.

 

What's got into the dev?

CONFIRMED! Issues Persist.
First thing noticable it rendered funny like chewing gum. That's no prob. But the Scheduled Tasks are still not showing the whole picture and that's with nothing hid.

 

To compare, 13.100 detects the codecs as it should and the VT entries (false positives) are with nice red color to be easier to see them.

https://i.ibb.co/SXwB7WL/Untitled.png

 

Why 13.98 instead of 13.100? Any particular reasons?

BTW, on a friend's computer, Autoruns 14.01 incorrectly autofills information about an entry. The HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run does have a GalaxyClient value, but it has no data, i.e. points to no executable. Autoruns displays the GalaxyClient value but seems to automatically fill the rest of the information (description, publisher, image path, timestamp) for the entry with its own.

https://i.ibb.co/CzvSj4g/image-2021-09-02-10-34-28.jpg

A total mess with the last two versions.

 

Maybe an older version?
Hash for mine is 68a535dad712d542c7f3e89be3e0cbb1687cfb75 ?SHA1*Autoruns64.exe
and 2ae5fb6595738e057649e1ed7c4f0bd15ef3ebcc ?SHA1*Autoruns.exe

 

ProcDump for Linux 1.2 Released (September 17, 2021)
Website (GitHub)
Download

 

I think the developer needs another redo for Autoruns.

 

Sysinternals Suite (September 22, 2021)
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

These applications have been updated:

 

Finally, they fixed most of the reported bugs.

However, for some entries, I still see "Unable to disable" message, but they are probably write-protected (I didn't check yet).

So far, so good. 13.100 is no longer needed then.

 

Haven't tried on Windows 10 yet but of a Fact Autoruns64 and regular issue continues for Scheduled Tasks. Now it only gets worse-there's another disruption that shows just 2 (even less then the last version) on Windows 8.1 with all hides unchecked. Reverting to earlier accurate good release(s)

 

I have to agree. 14.02 didn't detect one scheduled task detected by 13.100

\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join (Not verified) Microsoft Corporation c:\windows\system32\autoworkplace.exe 22.8.2013 г. 4:40 0/75

and I unchecked for the test Hide MS and Windows entries.

Will keep 13.100 for now. Maybe 14.03 will be ready for daily use.

 

Autoruns releases of late continue to carry a risk of insufficient results.

This is a sample of what a working Scheduled Tasks is presented for years on one of my systems until lately. It's become necessary to revert back to an earlier accurate distribution.

 

Autoruns shows more entries if you use the "Run as administrator" option.

 

It doesn't show any of the Microsoft scheduled tasks, even with admin and unhidden.

 

Confirmed that TAB is ineffective. As already mentioned above displays 2 where even the version released beforehand only showed 6. This autoruns program is compromised.

As described by yet another poster recently before this latest one, false information is been determined and those results gratefully shared to this thread for others to take note of.

https://www.wilderssecurity.com/threads/sysinternals-updates.354968/page-12#post-3030305

 

Not in my case =

 

There is another bug. On a friend's PC, AutoRuns shows this:

https://i.ibb.co/pZ5S9nZ/image-2021-09-23-11-04-41.png

But when he right-clicked and select Jump to entry, it is opening

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shell

instead of

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

So there are still bugs needed to be fixed in 14.02.

 

Thanks for sharing yet another finding of issues to autoruns. It's definitely not near what it use to be.

They should pass that project over to Nirsoft. Now there's a consistent coder.
Although in assembly machine language. Which is amazingly fast!

 

Autoruns 14.02 only shows all tasks on Win7. Doesn't for Win8 and Win10. I assume the image you posted applies to Win7 no?