Autoruns v14.09, ProcMon v3.89, Sysmon v13.33 and ZoomIt v5.10

I just incidently discovered a new BUG for Autorun :

I have defined a personal scheduled task, that action is "wscript C:\...\MyScript.vbs", ie. run a "home made" script.

In "old" versions of Autorun (ie Autorun 13.98), the "Image path" of this task was "C:\...\MyScript.vbs"

And it was this vbs script that was passed to VirusTotal for scanning. And the "publisher" column was empty. All of this was OK.

But with the latest version of Autorun (ie. 14.09 and maybe some of the previous ones), for this same task,

- "Image path" is now "C:\WINDOWS\system32\wscript.exe",

- and "Publisher" is now "Microsoft corporation"....

As a result,

- the script is no more controlled by VirusTotal,

- and the entry is not even displayed as soon as Hide Microsoft entries" a/o "Hide Windows entries" option is selected

I don't know if the same kind of problem may occur in other "autorun categories".

@Alex_Mihaiuc 

Yes, as I mentioned in my post: 'Now with 14.09 the same command fails with the message "Failed to load scanned data". '

I also found that 14.07 fails with the same message.

Jimmy2375: current working on stability for the next version!

click-click: it's not forgotten, a fix is incoming.

gyahne: do you also notice this behavior when generating the .ARN with v14.09? That version addresses such regressions introduced with previous v14 point releases.

For year I have used autoruns.exe in a monthly .BAT to generate an .ARN file using the command "Autoruns64.exe -A myfilename.arn"

The version I had been running successfully recently was 13.1

Now with 14.09 the same command fails with the message "Failed to load scanned data". Sounds like others have run into this also.

What is the status of fixing this?

Alex_Mihaiuc 

So what's the deal with the problems I mentioned above?

Remember this which was back in February?

Thanks, @click-click - on it!

Hi,

Thanks for the ZoomIt update! However, I do experience one issue with Type in drawing mode: I cannot change the font size to something else than 16.

EDIT: Actually it's simple ... just Ctrl+Mouse wheel to set the font size when using the Type feature!

If I go to ZoomIt systray icon -> right-click -> Option -> Type tab -> Set Font button, I see only 16:

And if I manually input another number, I do have this error:

It would help me a lot if that could be corrected.

Thanks!

The latest version feels less stable

Whether the startup items found by Autoruns can be sorted by column

Analyze offline system

Version 14.x began to have errors. The one below without errors is 13.98

After autoruns is used to analyze the offline system in WinPE system, Windows will report an error and fail to start again after restarting the computer

Thanks, click-click - on it!

Thank you for sharing