Missing Command names in System Configuration Utility

[Anthony R. Gold]

I find that some of the Startup commands are anonymous in the display of
System Configuration Utility while Regedit shows that all the commands in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run are properly named.

http://cari.ahjg.co.uk/System Configuration.jpg

Clues please on why, and whether those names can be forced to display.

Tony

 

[Gerry]

Anthony

What are your anti-virus and anti-spyware arrangements?

To identify what loads when you boot use Autoruns (freeware from
Microsoft).
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from
starting,or you can right click an item and then delete it. If you
uncheck you can recheck to re-enable the item. It is a much safer
approach than editing the Registry and better than using msconfig..
Another useful feature of the programme is that you can right click an
item and select Search Online to get information about the item
selected.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Tim Meddick]

A couple of points.

In "MSConfig.exe" you will find that along with the items listed under the "Startup"
tab, is a column that states the origin of the entry.

This would be either "HKLM\....\Run", "HKCU\...\Run", "Startup dir" or other
locations.

So it's not as simple as going to just the one key you spoke of (HKLM\....\Run) but
the other locations also.

This is where the previously suggested "AutoRuns.exe" program can be of some
considerable usefulness in tracking down the origin of the offender.

Finally, if the item is "unchecked" (disabled) then it's not stored under the "Run"
keys, but under the "MSConfig" key.
So the "fault" would lie with "MSConfig.exe" and not the "Run" key value.

==

Cheers, Tim Meddick, Peckham, London.

 

[Anthony R. Gold]

Thanks but all the nameless commands are both checked and also are shown as
initiated by presence in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tony

A couple of points.

In "MSConfig.exe" you will find that along with the items listed under the "Startup"
tab, is a column that states the origin of the entry.

This would be either "HKLM\....\Run", "HKCU\...\Run", "Startup dir" or other
locations.

So it's not as simple as going to just the one key you spoke of (HKLM\....\Run) but
the other locations also.

This is where the previously suggested "AutoRuns.exe" program can be of some
considerable usefulness in tracking down the origin of the offender.

Finally, if the item is "unchecked" (disabled) then it's not stored under the "Run"
keys, but under the "MSConfig" key.
So the "fault" would lie with "MSConfig.exe" and not the "Run" key value.

==

Cheers, Tim Meddick, Peckham, London.

I find that some of the Startup commands are anonymous in the display of
System Configuration Utility while Regedit shows that all the commands in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run are properly named.

http://cari.ahjg.co.uk/System Configuration.jpg

Clues please on why, and whether those names can be forced to display.

Tony

 

[Lem]

Thanks but all the nameless commands are both checked and also are shown as
initiated by presence in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tony

A couple of points.

In "MSConfig.exe" you will find that along with the items listed under the "Startup"
tab, is a column that states the origin of the entry.

This would be either "HKLM\....\Run", "HKCU\...\Run", "Startup dir" or other
locations.

So it's not as simple as going to just the one key you spoke of (HKLM\....\Run) but
the other locations also.

This is where the previously suggested "AutoRuns.exe" program can be of some
considerable usefulness in tracking down the origin of the offender.

Finally, if the item is "unchecked" (disabled) then it's not stored under the "Run"
keys, but under the "MSConfig" key.
So the "fault" would lie with "MSConfig.exe" and not the "Run" key value.

==

Cheers, Tim Meddick, Peckham, London.

I find that some of the Startup commands are anonymous in the display of
System Configuration Utility while Regedit shows that all the commands in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run are properly named.

http://cari.ahjg.co.uk/System Configuration.jpg

Clues please on why, and whether those names can be forced to display.

Tony

I don't understand what you mean by

all the nameless commands are shown as initiated by presence in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Do you mean that when you look at that key in regedit you see *two*
separate lines where the "data" field is blank? What is in the "name"
and "type" field of the blank lines?

It's not unusual to have *one* entry in HKLM\...\Run where
"Name" is (Default)
"Type" is REG-SZ
"Data" is blank

In msconfig, the above gives a blank for "Startup Item" and "Command"

 

[Anthony R. Gold]

I don't understand what you mean by

all the nameless commands are shown as initiated by presence in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Do you mean that when you look at that key in regedit you see *two*
separate lines where the "data" field is blank? What is in the "name"
and "type" field of the blank lines?

Yes. http://cari.ahjg.co.uk/System Configuration.jpg

It's not unusual to have *one* entry in HKLM\...\Run where
"Name" is (Default)
"Type" is REG-SZ
"Data" is blank

In msconfig, the above gives a blank for "Startup Item" and "Command"

Okay, then that's one of four.

Tony

 

[Anthony R. Gold]

Yes. http://cari.ahjg.co.uk/System Configuration.jpg

Sorry, that should be "No." The nameless presence items are found in the
display of System Configuration Utility/Startup and I can not tie them to
items in the Registry.

 

[Lem]

Sorry, that should be "No." The nameless presence items are found in the
display of System Configuration Utility/Startup and I can not tie them to
items in the Registry.

That's why Gerry and Tim Meddick suggested that you use Autoruns to
determine where *besides*
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run items in msconfig
might be coming from.

Alternatively, because the msconfig window itself can't be enlarged,
you'll have to adjust the column sizes of "Startup Item", "Command", and
"Location" so that you can see the *entire* entry in the location
column. Put the mouse over the vertical line between the column headings
until it shows as a double headed arrow and then drag the line to resize
the column. There's one of these lines at the right side of the
"Location" column as well.

Once you see the entire entry in the "Location" column, you'll know
where to look for the blank entries.

 

[Anthony R. Gold]

That's why Gerry and Tim Meddick suggested that you use Autoruns to
determine where *besides*
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run items in msconfig
might be coming from.

Sorry, there may be a misunderstanding. I am not asking about where
startup items may be coming from, I am only asking about why some startup
items listed in System Configuration Utility have blank names and commands.

Alternatively, because the msconfig window itself can't be enlarged,
you'll have to adjust the column sizes of "Startup Item", "Command", and
"Location" so that you can see the *entire* entry in the location
column. Put the mouse over the vertical line between the column headings
until it shows as a double headed arrow and then drag the line to resize
the column. There's one of these lines at the right side of the
"Location" column as well.

Once you see the entire entry in the "Location" column, you'll know
where to look for the blank entries.

All of the anonymous items show the same location of:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If anyone knows why several items, all from that same location, are shown
in System Configuration Utility without either a name or a command, then
I'd like to be told about it.

Tony

 

[Lem]

Sorry, there may be a misunderstanding. I am not asking about where
startup items may be coming from, I am only asking about why some startup
items listed in System Configuration Utility have blank names and commands.


All of the anonymous items show the same location of:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If anyone knows why several items, all from that same location, are shown
in System Configuration Utility without either a name or a command, then
I'd like to be told about it.

Tony

Sorry if I misunderstood. If you're saying that

1. There are 4 entries in msconfig that show a blank under "Startup
Item" and "Command"

2. That the "Location" for *each* of those entries is
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and

3. There is only *one* entry in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run where the "Data"
column is blank (the one where the "Startup Item" is "(Default)")

then I don't have any explanation for the extra 3 blank entries in msconfig.

 

[Anthony R. Gold]

Sorry if I misunderstood. If you're saying that

1. There are 4 entries in msconfig that show a blank under "Startup
Item" and "Command"

2. That the "Location" for *each* of those entries is
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

and

3. There is only *one* entry in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run where the "Data"
column is blank (the one where the "Startup Item" is "(Default)")

Yes, that is the exact situation.

then I don't have any explanation for the extra 3 blank entries in msconfig.

Thanks.

Tony

 

[Jose]

I find that some of the Startup commands are anonymous in the display of
System Configuration Utility while Regedit shows that all the commands in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run are properly named.

http://cari.ahjg.co.uk/System Configuration.jpg

Clues please on why, and whether those names can be forced to display.

Tony

At least one in your picture is in HKCU.

You can change the column width to see the rest of the registry key.

Could be, malicious software, aborted install, improper install,
aborted uninstall, improper uninstall...

Find out what it is, then decide what to do.

 

[Anthony R. Gold]

At least one in your picture is in HKCU.

They are all.

You can change the column width to see the rest of the registry key.

Could be, malicious software, aborted install, improper install,
aborted uninstall, improper uninstall...

Find out what it is, then decide what to do.

How?

Tony

 

[Pegasus [MVP]]

I find that some of the Startup commands are anonymous in the display of
System Configuration Utility while Regedit shows that all the commands in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run are properly named.

http://cari.ahjg.co.uk/System Configuration.jpg

Clues please on why, and whether those names can be forced to display.

Tony

To see what's behind the empty items, do this:
1. Open msconfig.
2. Untick one of the empty items under the Startup tab.
3. Close msconfig.
4. Run regedit.
5. Navigate to this spot:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
6. Check for a key that has an "Item" value with no data. This is the one
you have just disabled. You will now see each and every attribute for this
entry. As an example, have a look at this picture:
http://www.hotlinkfiles.com/view/full/2788592_4ast7. The "tgcmd" key has a
blank "Item" value. In msconfig it shows up as a blank. If I restored its
tick mark in msconfig then it would do nothing at all because it has no data
for the "Command" value.

 

[Jose]

They are all.




How?

Tony

Drag the column header to resize them (smaller) to see the rest of the
key.

It is possible for things to show up in MSCONFIG, but not be in the
two popular registry locations.

There are seven run keys in the registry that are used to start
programs:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
\Setup

If you can't find them in the registry, uncheck them in MSCONFIG and
use this to remove unchecked items from the MSCONFIG startup tab:

http://www.get-in-control.com/msconfig-cleanup/

Just uninstall the cleaner upper when you are done if you don't want
it.

A spic-n-span MSCONFIG is a happy MSCONFIG.

 

[Anthony R. Gold]

To see what's behind the empty items, do this:
1. Open msconfig.
2. Untick one of the empty items under the Startup tab.
3. Close msconfig.
4. Run regedit.
5. Navigate to this spot:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
6. Check for a key that has an "Item" value with no data. This is the one
you have just disabled. You will now see each and every attribute for this
entry. As an example, have a look at this picture:
http://www.hotlinkfiles.com/view/full/2788592_4ast7. The "tgcmd" key has a
blank "Item" value. In msconfig it shows up as a blank. If I restored its
tick mark in msconfig then it would do nothing at all because it has no data
for the "Command" value.

Many thanks, that sounds like a plan.

Tony