Quantcast
Channel: Sysinternals Forums
Viewing all articles
Browse latest Browse all 10386

Autoruns : Autorunsc 11.61 CSV output missing PRESHA headers

$
0
0
Author: BSOD2600
Subject: Autorunsc 11.61 CSV output missing PRESHA headers
Posted: 21 June 2013 at 10:14pm

It appears the CSV headers for autorunsc are misaligned with the data outputted.  Looks like the PESHA1 and PESHA256 field headers are missing. Plus it's labeling the PESHA1 hash as SHA256.

Examples.

Normal run (trimmed):

D:\Scripts\HarvestAutoruns>autorunsc -a -f -v
?
Sysinternals Autoruns v11.61 - Autostart program viewer
Copyright (C) 2002-2013 Mark Russinovich and Bryce Cogswell
Sysinternals - www.sysinternals.com


HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
   Entry last modified: 6/12/2013 5:12 AM
   autocheck autochk *
     autocheck autochk *
     Auto Check Utility
     (Verified) Microsoft Windows
     6.1.7601.17514
     c:\windows\system32\autochk.exe
     11/20/2010 2:28 AM
     MD5:      3b536a8bec3b4f23ffdfd78b11a2ab93
     SHA1:     a017204d7e47bc183d81dcabf047dea32b120343
     PESHA1:   848E6BC7B8266497B64ADD8304AA839D5962BF61
     PESHA256: 7384E6AE5F06DF4BE58F27A2337CFF327B1361028AC39E6D3D475FB392814F0D
     SHA256:   7bc847ce6c2d29c334f0d1600bbbde3933ff45f6bee5186f442e6270a3f9ec4e


Now export to CSV

D:\Scripts\HarvestAutoruns>autorunsc -a -f -v -c > foo.csv

Sysinternals Autoruns v11.61 - Autostart program viewer
Copyright (C) 2002-2013 Mark Russinovich and Bryce Cogswell
Sysinternals - www.sysinternals.com


foo.csv contains the following (trimmed):

Time,Entry Location,Entry,Enabled,Category,Description,Publisher,Image Path,Launch String,MD5,SHA-1,SHA-256
11/20/2010 2:28 AM,"HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute","autocheck autochk *",enabled,"Boot Execute","Auto Check Utility","(Verified) Microsoft Windows","c:\windows\system32\autochk.exe","autocheck autochk *",3b536a8bec3b4f23ffdfd78b11a2ab93,a017204d7e47bc183d81dcabf047dea32b120343,848E6BC7B8266497B64ADD8304AA839D5962BF61,7384E6AE5F06DF4BE58F27A2337CFF327B1361028AC39E6D3D475FB392814F0D,7bc847ce6c2d29c334f0d1600bbbde3933ff45f6bee5186f442e6270a3f9ec4e




Import into Excel and transpose to get this:

Time 11/20/2010 2:28
Entry Location HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
Entry autocheck autochk *
Enabled enabled
Category Boot Execute
Description Auto Check Utility
Publisher (Verified) Microsoft Windows
Image Path c:\windows\system32\autochk.exe
Launch String autocheck autochk *
MD5 3b536a8bec3b4f23ffdfd78b11a2ab93
SHA-1 a017204d7e47bc183d81dcabf047dea32b120343
SHA-256 848E6BC7B8266497B64ADD8304AA839D5962BF61

7384E6AE5F06DF4BE58F27A2337CFF327B1361028AC39E6D3D475FB392814F0D

7bc847ce6c2d29c334f0d1600bbbde3933ff45f6bee5186f442e6270a3f9ec4e


No PESHA1 and PESHA256 fields. 

Viewing all articles
Browse latest Browse all 10386

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>