Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Automatic startup addition: is this a problem?


  • Please log in to reply
3 replies to this topic

#1 saluqi

saluqi

  • Members
  • 581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:southern San Joaquin Valley, Calfornia
  • Local time:06:45 AM

Posted 23 September 2017 - 12:15 PM

Dell XPS 8700, Windows 10 Professional 64 bit, version 1703, fully updated.  Avast Premier, Malwarebytes Premium, WinPatrol

 

WinPatrol reported a new automatic startup entry, as follows:

 

C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q C:\Users\John\AppData\Local\Microsoft\OneDrive\17.3.6966.0824_1\amd64

 

I passed it, but am now wondering if I should have rejected it.  This looks like removing a specific folder at startup, every time?  I'm not clever enough to understand this.  Or is this preventing something from accumulating senselessly?

 

At least I'd like to understand what's going on here.

 

EDIT: FWIW there is no folder C:\Users\John\AppData\Local\Microsoft\OneDrive\17.3.6966.(anything) -  not on this computer, nor on my laptop.

There is an empty folder C:\Users\John\AppData\Local\Microsoft\OneDrive\17.3.6390.0509, dated back in April

and a very full one C:\Users\John\AppData\Local\Microsoft\OneDrive\17.3.6998.0830, dated yesterday, with a subfolder amd64


Edited by saluqi, 23 September 2017 - 12:45 PM.


BC AdBot (Login to Remove)

 


#2 zainmax

zainmax

  • Banned
  • 344 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:45 PM

Posted 23 September 2017 - 01:08 PM

This is not a problem and can be there if it does not interfere with You or yours computer's work. This is a Microsoft program/app, but you do not need to add it, if You do not want, it is not necessary or mandatory.
Tip: Add only the necessary things to the auto-start and nothing else.


#3 saluqi

saluqi
  • Topic Starter

  • Members
  • 581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:southern San Joaquin Valley, Calfornia
  • Local time:06:45 AM

Posted 23 September 2017 - 09:50 PM

If I fully understood the implications I would not be asking the question.  My days as an active software developer ended a dozen years ago and I do not pretend to understand all the intricacies of modern versions of Windows.  Anyway, in those  days I was working mostly with higher-order compiled xBase languages (Clipper, etc.) and not with the internals of Windows.  Two quite different worlds.  OK, in those long-gone days I could at a pinch write native assembler code, and in pre-1980 mainframe antiquity learned JCL, Fortran (non-spaghetti), PL/1 and half a dozen mainframe database languages - but that was all long ago and in a different universe from today's programming tools and skills.

 

I do not quite understand the usefulness of having a command-line entry, to be executed at every startup, specifying the removal of a folder which (as nearly as I can determine) does not exist.  OK, I would not expect to find it on the desktop, because it would have been removed at startup (though if I understand the command correctly, the parent folder \OneDrive\17.3.6966.0824_1 would still remain . . .).  I also do not find it on the laptop, which has no such startup command-line entry, but does have the same pattern of an older \OneDrive\ subfolder which is empty, and another new one full of stuff including a subfolder amd64.  FWIW those two folders on the laptop are \OneDrive\17.3.6517.0809_1 (empty, dated 2/14/2017) and \OneDrive\17.3.6998.0830 (full, dated 09/20/2017).  Note that last is the same folder name as on the desktop.

 

Maybe this dialogue belongs in some other forum.  I really have no particular reason to think this little curiosity represents a malware attack.  It is just something I don't understand - and things I don't understand tend to make me uneasy.



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,287 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:45 AM

Posted 24 September 2017 - 08:22 AM

WinPatrol alerts you to changes in programs that run at startup...those which are newly added or removed. The alert does not necessarily mean the startup is or was bad.

Almost all applications you install want to add a command to startup when Windows loads. If you allow them all to do this, the result can impact system performance. The reason for this is that all of these programs use a portion of the system memory and resources which leaves a smaller percentage for other programs once they are opened. These programs then compete for and use available system resources resulting in poor performance and a slow system. Many of these programs are not needed and disabling them can save resources and improve overall performance. When needed, they can be accessed via Start > Programs or an icon on the desktop. Some programs adding themselves to the startup will create a registry key so that it loads each time Windows boots. Others may be added so they run only one time so it all depends on what registry key is used.Windows Command Process (cmd.exe) Startup files (all users)/(user) run & run once examples

Related discussion topics:
Strange Onedrive program running on startup
Windows 10: Uknown Startup entry
Naming Files, Paths, and Namespaces
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users