REG:win.ini: run=

broni · 2007/12/04

Sometimes, I can see these two entries on peoples HJT logs:
F3 - REG:win.ini: run=
F3 - REG:win.ini: load=
I assume, that they are safe, since there is nothing listed after "= ", but where do they come from, anyway?
In this particular case, it comes from a person with Windows XP, and I know for a fact, that he's really careful about his computer.
Thanks.

TeMerc · 2007/12/04

Here is some info on the F entries:

F2 and F3 entries correspond to the equivalent locations as F0 and F1, but they are instead stored in the registry for Windows versions XP, 2000, and NT. These versions of Windows do not generally use the system.ini and win.ini files. Instead of backwards compatibility they use a function called IniFileMapping. IniFileMapping, puts a all the contents of a an .ini file in the registry, with keys for each line found in the .ini key stored there. Then when you run a program that normally reads their settings from an .ini file, it will first check the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping for an .ini mapping, and if found will read the settings from there instead. You can see that this key is referring to the registry as it will contain REG and then the .ini file which IniFileMapping is referring to
Click to expand...

Taken from here

Oh, and they can be 'fixed' with HJT as the ones you'r pointing to do not designate a file.

broni · 2007/12/04

Yeah, thanks. I know that info, but it doesn't explain what is the source of those empty (nothing after "= ") entries.
It's not biggy, nothing dangerous there, I just wanted to find out, why?

Log in or Sign up

REG:win.ini: run=

broni Moderator Malware Analyst Thread Starter

TeMerc Inactive Alumni

broni Moderator Malware Analyst Thread Starter

Share This Page

Log in or Sign up

REG:win.ini: run=

broni Moderator Malware Analyst Thread Starter

TeMerc Inactive Alumni

broni Moderator Malware Analyst Thread Starter

Share This Page

Useful Searches