Windows XP

by **Reason7194** on Thu May 05, 2011 12:38 pm ([msg=57022]see Windows XP[/msg])

Hello everyone, I have been exploring Windows XP since most of my clients use XP. After entering ' control userpasswords2 ' into the cmd, and selecting a user, I don't understand what the area's "Logon Script: , and Profile Path: " mean. What is their purpose?

by **Goatboy** on Thu May 05, 2011 2:02 pm ([msg=57024]see Re: Windows XP[/msg])

Login scripts are, to be repetitious, scripts that are executed after a user logs in. Some can be found in the Start menu under Startup, and others are defined by registry keys. The Profile Path is basically where the user's profile is (pictures, docs, etc.). This is C:\Documents and Settings\<user> under XP, and C:\Users\<user> under Vista/7.

O thank you Goatboy.

For Registry files, deleting the wrong file when looking for a virus can be devestating. Is there another way of 'knowing' that there is a registry file that should not be there? Other than from knowing from sheer experience and remember what is usually there and what isn't.

by **Goatboy** on Thu May 05, 2011 4:03 pm ([msg=57032]see Re: Windows XP[/msg])

CCleaner does a good job of showing what startups are in your system.

O wow yes it does. I have been an avid preacher of ccleaner and I have never known about that :roll:

But still my question remains, does a person just have to know what is usually there in the registry files to tell if a virus put itself there along with the other reg files?

How should I differenciate a malware reg file, and a normal/needed reg file?

by **Goatboy** on Thu May 05, 2011 4:30 pm ([msg=57039]see Re: Windows XP[/msg])

Experience, mostly. Some scanners know the signatures of common malware and can look for that (blacklist). Others look for things outside of a list of known good values (whitelist). As for finding them manually, I'm not sure. I also wouldn't recommend it in all but the most extreme cases.

by **mShred** on Thu May 05, 2011 11:57 pm ([msg=57070]see Re: Windows XP[/msg])

Also "msconfig" will tell you your startup programs from both the startup folder and the registry.
And the best thing to do would be to save a copy of a good registry then compare a virus infected one to it, or restore it to that. Probably the latter because comparing could take a while.

by **Goatboy** on Fri May 06, 2011 2:10 am ([msg=57072]see Re: Windows XP[/msg])

mShred wrote:Probably the latter because comparing could take a while.

diff under linux. 'nuff said.

Ah ok. The last computer I dealt with I edited the registry manually. Deleting a reg file caused so much anxiety..

Thanks everyone.

Topic Solved