Registry Entry "RunStuffHasBeenRun" - What Is It?

[SmithUnwesson]

Hello 7,

I've found this registry entry in the following location:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\RunStuffHasBeenRun]

Can anyone give me a definitive answer as to what this is? I've searched online, but haven't found anything useful/believable.

Thanks in advance for your assistance!
Tim

 

[N0b0dy]

Hi

I think you're either still infected and/or there has been damage done by the malware you had on the system. Run Malewarebytes and check it

 

[gigagiggles]

I have the same entry in mine with an empty data set. I won't panic to n0b0dy's unwarranted alarm. Daily security scans along with MalwareByte's periodic scans would have brought on the sirens, unless it is a zero-day (brand new and introduced today) exploit.

 

[Jacee]

Lot of mentions on this Google page Google

 

[SmithUnwesson]

Thanks for all of your replies. As I said in the original post, I've searched online already. I'm not one to just jump into a forum and ask for answers, I like to do my homework first.

I currently have a full internet security suite as well as very strict rules set up through Local Security Policy. I have dealt with MalwareByte's in the past, and to be honest I was very unimpressed.

Ironically, when searching for this registry entry through Google/Bing, all I found were several spam messages about scanning with MalwareByte's...

I posted this in the hopes that someone would have some useful insight as to what this actually is. I have no desire to install more software to scan my computer.

If anyone has ever seen/heard/read about this before, I would greatly appreciate your input. Thanks in advance.

Tim

 

[cluberti]

It apparently denotes if this is the first time a user is running Explorer - I've seen it many times on Vista and Windows 7 machines, but never on XP. My guess is it's part of shell first run on Vista and higher, an educated guess, but with no real supporting evidence. I've thought about setting procmon to run a boot trace, create a new admin user, and then reboot and watch for the existence of, or creation or modification on, that registry location, but I've never bothered. Might be a good idea though if you're really curious.

 

[SmithUnwesson]

That is a great idea... I've used procmon for running a boot trace, but I hadn't considered creating a new admin user before hand. I found this registry entry a couple of weeks ago, and I have reinstalled Win7 Ultimate twice since (for testing and other reasons). Even after wiping my disk once also.... My only guess was that it was coming from malware loaded in my custom build OEM SLP that I made from my original Dell recovery CD. This would be great if it is just a common key. Strange that it is so hard to find valid data online about it though

I will try the boot trace as soon as I get a chance and post the results.

TY cluberti