search for: autorunsc

...f scanning an offline windows install for images configured to start automatically (very useful for tracking down malware). How likely is it that it could be made to run under wine on Ubuntu? I've got to the point where I have my NTFS partition mounted, I then issue the command: --- $ wine ./autorunsc -z /mnt/ntfs_mount/WINDOWS /mnt/ntfs_mount/Documents\ and\ Settings/ --- ...this happens: --- Sysinternals Autoruns v10.01 - Autostart program viewer Copyright (C) 2002-2010 Mark Russinovich and Bryce Cogswell Sysinternals - www.sysinternals.com Autoruns requires Administrator privilege to analy...

Gert van den Berg wrote: > A drivers houldn't be needed for registry files copied from another PC and not actively loaded? Only kernel can load registry. And obviously if you trying to load registry that overrides your system registry one need some drivers to work around that. Of course you can open registry hive as a simple file and try to parse it. However this isn't trivial and

I thought that accessing an "Offline" registry file is like parsing a copy of a registry file that is not in use or, like you said, actively loaded by the oprating system. Registry files in Windows are normally located under "C:\WINDOWS\system32\Config" for system hives and "C:\Documents And Settings\Username" for user hives. I open these files in