Processes querying HKU "load" locations

C

cusnap

Hi,
Is it normal for processes to query the "load" location in user subkeys
(e.g., HKU\S-1-5-21-xxxxxxx\Software\Microsoft\Windows
NT\CurrentVersion\Windows\load)? We had an anti-virus program apparently
removing data from that value (it didn't tell us what it was removing and the
vendor couldn't really help), so we set up procmon with a filter to watch
anything touching those load locations and processes such as net1.exe
llsmgr.exe and userinit.exe were observed to query there. I am not a
developer and really don't know what's normal process behavior and what
isn't. There was no writing, just the queries. Thanks.
 
D

Dave Patrick

Yes, perfectly normal. App installations that write there are probably win9x
applications.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
 
D

Dave Patrick

Or possibly even win3.x apps. Probably not used any more but if you're
looking there don't forget win.ini, system.ini are also parsed.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
 
C

cusnap

Hi,

Thanks for the reply. Could you elaborate at all? It's normal for Win9x apps
to write to the load value, but these seem to be common (more or less)
Windows processes, not necessarily Win9x as far as I can tell (llsmgr.exe,
userinit.exe, etc.), that are reading that location. Just trying to
understand better. Thanks again.

Dave Patrick said:
Yes, perfectly normal. App installations that write there are probably win9x
applications.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


cusnap said:
Hi,
Is it normal for processes to query the "load" location in user subkeys
(e.g., HKU\S-1-5-21-xxxxxxx\Software\Microsoft\Windows
NT\CurrentVersion\Windows\load)? We had an anti-virus program apparently
removing data from that value (it didn't tell us what it was removing and
the
vendor couldn't really help), so we set up procmon with a filter to watch
anything touching those load locations and processes such as net1.exe
llsmgr.exe and userinit.exe were observed to query there. I am not a
developer and really don't know what's normal process behavior and what
isn't. There was no writing, just the queries. Thanks.
Click to expand...
Click to expand...
 
C

cusnap

OK, thanks, that helps. I appreciate you taking the time to answer.

Dave Patrick said:
Windows 2000 would still read them for backward compatibility.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


cusnap said:
Hi,

Thanks for the reply. Could you elaborate at all? It's normal for Win9x
apps
to write to the load value, but these seem to be common (more or less)
Windows processes, not necessarily Win9x as far as I can tell (llsmgr.exe,
userinit.exe, etc.), that are reading that location. Just trying to
understand better. Thanks again.
Click to expand...
Click to expand...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Some security related questions about Win XP files and processes 1
awtrOhHy.dll 3
Taskbar and desktop icons not loading 5
HELP: Desktop/Task Bar MISSING after Windows 2000 startup, but I can start desktop/task bar manually 0
USMT 3.0 Error 31 0
The Aftermath of the Deadly Win32/Sality Virus 1
xp pro wont allow log in 1
PC Infected Full of TROJANS......Can’t Delete & Keep Coming Back!! 1

Top