Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Registry Entry "RunStuffHasBeenRun" - What Is It?

03 Jan 2012   #1

Windows 7 Ultimate 64bit
Registry Entry "RunStuffHasBeenRun" - What Is It?

Hello 7,

I've found this registry entry in the following location:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\RunStuffHasBeenRu n]

Can anyone give me a definitive answer as to what this is? I've searched online, but haven't found anything useful/believable.

Thanks in advance for your assistance!

My System SpecsSystem Spec
03 Jan 2012   #2

Windows 7 Ultimate SP1 x64

Hi :)

I think you're either still infected and/or there has been damage done by the malware you had on the system. Run Malewarebytes and check it :)
My System SpecsSystem Spec
04 Jan 2012   #3

Windows 7 Home Premium x64

I have the same entry in mine with an empty data set. I won't panic to n0b0dy's unwarranted alarm. Daily security scans along with MalwareByte's periodic scans would have brought on the sirens, unless it is a zero-day (brand new and introduced today) exploit.
My System SpecsSystem Spec

04 Jan 2012   #4
Microsoft MVP

Windows 7 Ultimate 32bit SP1

Lot of mentions on this Google page Google
My System SpecsSystem Spec
05 Jan 2012   #5

Windows 7 Ultimate 64bit

Thanks for all of your replies. As I said in the original post, I've searched online already. I'm not one to just jump into a forum and ask for answers, I like to do my homework first.

I currently have a full internet security suite as well as very strict rules set up through Local Security Policy. I have dealt with MalwareByte's in the past, and to be honest I was very unimpressed.

Ironically, when searching for this registry entry through Google/Bing, all I found were several spam messages about scanning with MalwareByte's...

I posted this in the hopes that someone would have some useful insight as to what this actually is. I have no desire to install more software to scan my computer.

If anyone has ever seen/heard/read about this before, I would greatly appreciate your input. Thanks in advance.

My System SpecsSystem Spec
05 Jan 2012   #6

Windows 10 Pro x64

It apparently denotes if this is the first time a user is running Explorer - I've seen it many times on Vista and Windows 7 machines, but never on XP. My guess is it's part of shell first run on Vista and higher, an educated guess, but with no real supporting evidence. I've thought about setting procmon to run a boot trace, create a new admin user, and then reboot and watch for the existence of, or creation or modification on, that registry location, but I've never bothered. Might be a good idea though if you're really curious.
My System SpecsSystem Spec
06 Jan 2012   #7

Windows 7 Ultimate 64bit

That is a great idea... I've used procmon for running a boot trace, but I hadn't considered creating a new admin user before hand. I found this registry entry a couple of weeks ago, and I have reinstalled Win7 Ultimate twice since (for testing and other reasons). Even after wiping my disk once also.... My only guess was that it was coming from malware loaded in my custom build OEM SLP that I made from my original Dell recovery CD. This would be great if it is just a common key. Strange that it is so hard to find valid data online about it though

I will try the boot trace as soon as I get a chance and post the results.

TY cluberti
My System SpecsSystem Spec

 Registry Entry "RunStuffHasBeenRun" - What Is It?

Thread Tools

Similar help and support threads
Thread Forum
"Procedure entry point OpenSemaphoreW...api-ms-win-core-synch-l1-2-0"
When I open up programs like FL Studio or LightShot, I get this error message. I tried cleaning out the registry, doing a SFC scan but no avail.
How to undelete files "in place"? Recover NTFS entry on orig.partitio
Normally if a user accidentially deletes a file and want to recover it then he can take the following steps: Load one of the many "undelete" tools (like Recuva) and let it detect,analyze and copy the file to another partition. Now assume that the partition where the deleted files is stored has...
General Discussion
"win boot conf data file does not contain a valid OS entry" oxc0000098
Ok, so I had the "file recovery virus." I was using malwarebytes and Another malware removal program (can't remember that name) to get rid of it. I remember one of them listed a file name with "boot" in it as infected so I deleted it as suggested. Well now I can't boot windows 7 64 bit on my HP...
Installation & Setup
"Entry Point Not Found" Error While Attempting To Play A Game
Hello, I receive this error when I try to play the game, "Bit.Trip Runner": I've googled for hours and I've tried every suggestion, nothing is working for me. I've re-downloaded, uninstalled and re-installed Visual Point C++ 2010 SEVERAL times. Cleaned my...
"The resource loader cache doesn't have loaded MUI Entry"
Whenever I insert my Windows 7 setup disk, and boot from it, and I choose Repair your Windows, the following error message appears, and of course I can't use the recovery tools: "The resource loader cache doesn't have loaded MUI Entry" What's the cause of this? I have Windows 7 Ultimate and...
Installation & Setup

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 13:01.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App