Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Autoruns scan, a lot of missing files


  • Please log in to reply
13 replies to this topic

#1 Heekzg

Heekzg

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:42 AM

Posted 04 July 2017 - 08:23 AM

Hello people of bleepingcomputer.

 

I ran a autoruns scan since my computer had been acting weird after doing a fresh install. So after the scan I saw that there was a ton of missing files.

 

The program is in danish, however it just says that "The file was not found" where it says "den angivne fil blev ikke fundet".

 

Does this scan seem okay? or is there some wrong.



BC AdBot (Login to Remove)

 


#2 Heekzg

Heekzg
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:42 AM

Posted 04 July 2017 - 08:26 AM

How do post the autoruns scan file?



#3 ranchhand_

ranchhand_

  • Members
  • 1,670 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest
  • Local time:03:42 AM

Posted 04 July 2017 - 08:45 AM

It's nothing dangerous for your operating system; when you delete old programs, the Windows uninstaller will miss some references to deleted files in programs. In other words, it leaves the call to start the program on boot, but there is no programs any more. Autoruns is detecting these remnants of programs and notifying you about them. You can either ignore them (they are doing no harm) or right click on the entry, and choose delete file. Just be very sure to delete the correct file that is orphaned.


Help Requests: If there is no reply after 3 days I remove the thread from my answer list. For further help PM me.


#4 Heekzg

Heekzg
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:42 AM

Posted 04 July 2017 - 08:47 AM

It's nothing dangerous for your operating system; when you delete old programs, the Windows uninstaller will miss some references to deleted files in programs. In other words, it leaves the call to start the program on boot, but there is no programs any more. Autoruns is detecting these remnants of programs and notifying you about them. You can either ignore them (they are doing no harm) or right click on the entry, and choose delete file. Just be very sure to delete the correct file that is orphaned.

Even when the image path is c:\windows\syswow64\drivers\synth3dvsc.sys and such?


There is more than this, but this is just so you can get an idea http://imgur.com/a/esaGc


Edited by Heekzg, 04 July 2017 - 08:47 AM.


#5 Heekzg

Heekzg
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:42 AM

Posted 04 July 2017 - 09:26 AM

Anyone know of this imagehlp.dll? Autoruns says there is 1/62 antiviruses that found a virus in it?



#6 ranchhand_

ranchhand_

  • Members
  • 1,670 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest
  • Local time:03:42 AM

Posted 04 July 2017 - 09:51 AM

imagehlp.dll is a dynamic linked library file which is critical to Windows. In your screen shot, I notice some of the log is in English (toward the bottom) and most in Danish, that is a bit unusual.

 

Autoruns says there is 1/62 antiviruses

Autoruns can detect malware that loads on boot, but I am not aware that it specifically notifies the user that a certain entry is a virus. Is that what you meant? Or did a separate antivirus program notify you of 62 viruses? If so, which program?

As an alternative, you can de-select (clear) the checkbox in front of any file you want to test. Autoruns will not delete that file, but will prevent it from loading on boot. You can run your computer and see if you have problems, and if you do, then load Autoruns again and select (enable) that checkbox so that file loads again.

 

If this is a new installation and you age getting these notices from Autoruns, something does not seem right. When you reinstalled Windows, did you first remove the existing partition, reset a new partition and format in NTFS?


Help Requests: If there is no reply after 3 days I remove the thread from my answer list. For further help PM me.


#7 jwoods301

jwoods301

  • Members
  • 1,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:42 AM

Posted 04 July 2017 - 05:30 PM

Hello people of bleepingcomputer.

 

I ran a autoruns scan since my computer had been acting weird after doing a fresh install. So after the scan I saw that there was a ton of missing files.

 

The program is in danish, however it just says that "The file was not found" where it says "den angivne fil blev ikke fundet".

 

Does this scan seem okay? or is there some wrong.

 

The missing files are likely debris left behind by program uninstallers that did not do a thorough job of cleaning up.

 

I would uncheck them first and run for a few days to see if there are any issues...before deleting anything.

 

And if you do decided to delete anything. create a System Restore point first.

 

The VirusTotal checks are done by Autoruns to identify suspicious items.

 

It is ironic that 1 scanner identified Autoruns as suspicious...it is a false positive and has been reported to VirusTotal.

 

Since Autoruns uses approximately 65 different scanners, it's not unusual to see a few false positives.

 

However, when "major" scanners from vendors such as Emisoft, TrendMicro, Malwarebytes, F-Secure, Bitdefender, etc. flag something, it warrants further investigation.


Edited by jwoods301, 04 July 2017 - 05:42 PM.


#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:42 AM

Posted 04 July 2017 - 07:42 PM

AutoRuns shows the currently configured auto-start applications as well as the full list of registry and file system locations available for auto-start configuration. Autostart locations displayed by Autoruns include Logon entries, Explorer add-ons, Internet Explorer add-ons and Browser Helper Objects (BHOs), Appinit DLLs, image hijacks, Boot Execute Images, Winlogon Notification DLLs, Scheduled Tasks, Windows Services and Winsock Layered Service Providers.

For startup items, in most cases "File not found" indicates orphan registry entries still present, but the executables are gone so you can safely delete them. That is not the case for "System 32 Drivers Not Found"...see FAQ: Common Autoruns Issues - #12 Autoruns: System 32 Drivers Not Found which provides information in regards to these "File not found" entries.

Yellow: Indicates "File not found" in the expected location (Image Path). Meaning the startup entry is there, but the file or job it points to doesnt exist anymore. This coding is not always reliable if the full path is not in Windows Registry entry and even then you should check any subkeys. In most cases these entries are harmless leftovers (remnants) from uninstalled applications...many program uninstallers do not perform an adequate job of completely removing them.

AutoRuns is more of a tool for advanced users since it does not have the ability to recognize unsafe or dangerous items...it only displays what it finds. You should not uncheck anything without investigating first.

If you're going to use Autoruns, be careful using it and be sure to read the following resources before doing anything on your own:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 Heekzg

Heekzg
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:42 AM

Posted 04 July 2017 - 10:06 PM

imagehlp.dll is a dynamic linked library file which is critical to Windows. In your screen shot, I notice some of the log is in English (toward the bottom) and most in Danish, that is a bit unusual.

 

Autoruns says there is 1/62 antiviruses

Autoruns can detect malware that loads on boot, but I am not aware that it specifically notifies the user that a certain entry is a virus. Is that what you meant? Or did a separate antivirus program notify you of 62 viruses? If so, which program?

As an alternative, you can de-select (clear) the checkbox in front of any file you want to test. Autoruns will not delete that file, but will prevent it from loading on boot. You can run your computer and see if you have problems, and if you do, then load Autoruns again and select (enable) that checkbox so that file loads again.

 

If this is a new installation and you age getting these notices from Autoruns, something does not seem right. When you reinstalled Windows, did you first remove the existing partition, reset a new partition and format in NTFS?

Yes this is supposed to be a new installation, I downloaded windows down from microsofts website and then put it on a USB drive. When I get into the settings for formatting I delete / remove the existing partitions and then create new ones. I am unsure of what you mean by formatting in NTFS though. I usually just delete partitions and the create a new one and then I follow the installation.

Seeing as this is a fresh install, would you recommend that I try and give it another go and format again?



#10 jwoods301

jwoods301

  • Members
  • 1,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:42 AM

Posted 05 July 2017 - 01:24 AM

As mentioned above by @quiteman7 and myself (post #7 and post #8), the entries are simply orphaned, and are harmless.

 

The Autoruns flag is a false positive and harmless.

 

No need to format your hard drive.



#11 ranchhand_

ranchhand_

  • Members
  • 1,670 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest
  • Local time:03:42 AM

Posted 05 July 2017 - 08:23 AM

You did a good job of installing, no need to reinstall. I was just checking to make sure there wasn't a problem with the install, or if you possibly had a component in the process of failing.  It is very unusual for there to be so many orphaned entries already on a brand-fresh installation of Windows. Have you uninstalled several programs lately?

I have been using Autoruns for years, and it is an excellent tool to investigate and use. I use it constantly when problem computers come in with operating system problems.

Regarding format: formatting a hard drive (or SSD) means the installation of the file system that the operating system uses to store and access data. Lately the installation program automatically formats when a new partition is created, so you probably were not aware of it. In "the old days", you were given an option of two different file systems to use, but now it is done automatically and only NTFS is used now. So don't be concerned about it.

You said:

 

computer had been acting weird

We really should take a minute to investigate this; could you give a description of what your computer is doing? Just as a first thought, did you install the mainboard drivers for your computer after Windows was installed?


Edited by ranchhand_, 05 July 2017 - 08:36 AM.

Help Requests: If there is no reply after 3 days I remove the thread from my answer list. For further help PM me.


#12 Heekzg

Heekzg
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:42 AM

Posted 05 July 2017 - 09:58 AM

You did a good job of installing, no need to reinstall. I was just checking to make sure there wasn't a problem with the install, or if you possibly had a component in the process of failing.  It is very unusual for there to be so many orphaned entries already on a brand-fresh installation of Windows. Have you uninstalled several programs lately?

I have been using Autoruns for years, and it is an excellent tool to investigate and use. I use it constantly when problem computers come in with operating system problems.

Regarding format: formatting a hard drive (or SSD) means the installation of the file system that the operating system uses to store and access data. Lately the installation program automatically formats when a new partition is created, so you probably were not aware of it. In "the old days", you were given an option of two different file systems to use, but now it is done automatically and only NTFS is used now. So don't be concerned about it.

You said:

 

computer had been acting weird

We really should take a minute to investigate this; could you give a description of what your computer is doing? Just as a first thought, did you install the mainboard drivers for your computer after Windows was installed?

I did install several drivers, but I don't believe I actually did install any for my BIOS. However I did install chipset drivers and all that.

The acting weird part I did find out from my cousin who is into computers was normal and such. Problem with my is I am always kinda paranoid of viruses and such. So when I got these logs back I immediately thought something was wrong with my computer. I hadn't really uninstalled any programs but I did remove a lot of windows 10s games and that in the windows bar in the right side. Not sure if that counts.



#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:42 AM

Posted 05 July 2017 - 02:12 PM

Then it doesn't sound like you have anything to worry about.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 ranchhand_

ranchhand_

  • Members
  • 1,670 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest
  • Local time:03:42 AM

Posted 05 July 2017 - 04:24 PM

 

I did remove a lot of windows 10s games and that in the windows bar in the right side

That could account for the orphan references then. Since you are not having any actual problems with the unit I think you are fine. Post back if you have any future problems.


Help Requests: If there is no reply after 3 days I remove the thread from my answer list. For further help PM me.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users