Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.



Windows 7: Registry Entry "RunStuffHasBeenRun" - What Is It?

03 Jan 2012   #1

Windows 7 Ultimate 64bit
 
 
Registry Entry "RunStuffHasBeenRun" - What Is It?

Hello 7,

I've found this registry entry in the following location:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\RunStuffHasBeenRu n]

Can anyone give me a definitive answer as to what this is? I've searched online, but haven't found anything useful/believable.

Thanks in advance for your assistance!
Tim

My System SpecsSystem Spec
.

03 Jan 2012   #2

Windows 7 Ultimate SP1 x64
 
 

Hi

I think you're either still infected and/or there has been damage done by the malware you had on the system. Run Malewarebytes and check it
My System SpecsSystem Spec
04 Jan 2012   #3

Windows 7 Home Premium x64
 
 

I have the same entry in mine with an empty data set. I won't panic to n0b0dy's unwarranted alarm. Daily security scans along with MalwareByte's periodic scans would have brought on the sirens, unless it is a zero-day (brand new and introduced today) exploit.
My System SpecsSystem Spec
.


04 Jan 2012   #4
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Lot of mentions on this Google page Google
My System SpecsSystem Spec
05 Jan 2012   #5

Windows 7 Ultimate 64bit
 
 

Thanks for all of your replies. As I said in the original post, I've searched online already. I'm not one to just jump into a forum and ask for answers, I like to do my homework first.

I currently have a full internet security suite as well as very strict rules set up through Local Security Policy. I have dealt with MalwareByte's in the past, and to be honest I was very unimpressed.

Ironically, when searching for this registry entry through Google/Bing, all I found were several spam messages about scanning with MalwareByte's...

I posted this in the hopes that someone would have some useful insight as to what this actually is. I have no desire to install more software to scan my computer.

If anyone has ever seen/heard/read about this before, I would greatly appreciate your input. Thanks in advance.

Tim
My System SpecsSystem Spec
05 Jan 2012   #6

Windows Server 2008 R2
 
 

It apparently denotes if this is the first time a user is running Explorer - I've seen it many times on Vista and Windows 7 machines, but never on XP. My guess is it's part of shell first run on Vista and higher, an educated guess, but with no real supporting evidence. I've thought about setting procmon to run a boot trace, create a new admin user, and then reboot and watch for the existence of, or creation or modification on, that registry location, but I've never bothered. Might be a good idea though if you're really curious.
My System SpecsSystem Spec
06 Jan 2012   #7

Windows 7 Ultimate 64bit
 
 

That is a great idea... I've used procmon for running a boot trace, but I hadn't considered creating a new admin user before hand. I found this registry entry a couple of weeks ago, and I have reinstalled Windows 7 Ultimate twice since (for testing and other reasons). Even after wiping my disk once also.... My only guess was that it was coming from malware loaded in my custom build OEM SLP that I made from my original Dell recovery CD. This would be great if it is just a common key. Strange that it is so hard to find valid data online about it though

I will try the boot trace as soon as I get a chance and post the results.

TY cluberti
My System SpecsSystem Spec
Reply

 Registry Entry "RunStuffHasBeenRun" - What Is It?





Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 03:21 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33