another day another problem. today! REGEDIT run entries disappearing..

jonnyhotchkiss · 09 Apr 2014

Hi guys, something strange (gpedit? malicious entity lurking well hidden somewhere) is messing with my

[HKLM]Windows\CurrentVersion\Run content:

Autoruns, msconfig,WhatsInStartup, AdvancedUninstallerPro all report the same content, but, when navigating to the key, the only entry is the one for nusb3mon.exe (installed as advised, not sure what, if anything, it does). At first I thought all entries were being suppressed, but everything else appears to be starting (despite not being visible in regedit?)

KEYs are visible in most* programs

and when searching the Reg, they're there (all modified at 2:15 this morning... hmmm)

but when accessing the reg, they're not visible?

Normally, I'd uninstall and reinstall Synaptics (which is the only one which isn't starting), but the issue's affecting several registry keys...

I started documenting the issue, and captured the moment the entries miraculously re-appeared. I tried re-tracing my steps on reboot, after confirming the issue was still there (invisible keys, run entries not running) but can't seem to get the keys to materialise (even after importing the .reg export I made when the keys were momentarily visible, and even that's not working! makes me think there may be a policy in place preventing (machine) Run entries...

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="%ProgramFiles%\\Synaptics\\SynTP\\SynTPEnh.exe"
"RtHDVBg"="C:\\Program Files\\Realtek\\Audio\\HDA\\RAVBg64.exe /MAXX3 "
"HotKeysCmds"="C:\\Windows\\system32\\hkcmd.exe"
"FreeFallProtection"="C:\\Program Files (x86)\\STMicroelectronics\\AccelerometerP11\\FF_Protection.exe"
"RTHDVCPL"=":C:\\Program Files\\Realtek\\Audio\\HDA\\RtkNGUI64.exe -s"
"IgfxTray"=":C:\\Windows\\system32\\igfxtray.exe"

compared to now, when I export, just in case the entries are there (like everyone else says!) but are... invisible.. NOPE.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="\"C:\\Program Files (x86)\\Renesas Electronics\\USB 3.0 Host Controller Driver\\Application\\nusb3mon.exe\""

So... where to start?!

(No, I don't know what was done at 2:15)

Currently manually writing Reg.Strings

jonnyhotchkiss · 09 Apr 2014

Ok, re the visibility, forgot that I'm running 32 and 64 bit apps...

I think that most(/all?!) of the programs that jump to the relevent entry in the Registry Editor were launching regedit.exe*32: 32-bit mode (even regjump!)

By manually launching (Run) regedit.exe and getting to HKLM...Windows\CurrentVersion\Run I see my entries. Think I'll try an absolute path for synaptics (it's the only one failing, and the only one using an environment variable {%programfiles%} ....)

regedit.exe @ HKLM......Run (NOT regedit.exe*32!)