Re: PSA: You may be surprised what's in your HKCU:Run registry key

On Wed, 22 Oct 2025 10:51:41 -0700, Marion <[email protected]> wrote:

>PSA: You may be surprised at what is in your HKCU:Run registry key
>
> C:\> reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
>      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
>       DS Clock REG_SZ "C:\app\hardware\clock\dsclock\DSClock.exe"
>       Startup Sentinel REG_SZ C:\app\os\startup\startupsentinel\sus.exe /minimized
>
>I am currently thoroughly testing every known freeware no-registration no
>ad proxy on the planet for Windows (e.g., widecap, freecap proxifier,
>psiphon, proxycap, socksescort, shadowsocks, sockscap64, nekoray,
>ultrasurf, freegate, kproxy, safeip, penguinproxy, etc.).
>
>Some of those are dangerous as they make you the exit node and some use
>Electron and/or Squirrel which often adds a bunch of junk that isn't
>removed using the default Windows Win+I > Apps > {name} > Uninstall.
>
>AdvancedUninstaller finds most (all?) of those, but what I'm suggesting
>here is to periodically check your Run key to see what starts upon boot.
>
>Sometimes, if you're not looking, you'll be surprised at what you find.
>
>An example is PenguinProxy just put this into my registry sans permission:
> Type: HKCU:Run
> Name: com.squirrel.PenguinProxy.PenguinProxy
> Command: %localappdata%\PenguinProxy\app-0.3.1\PenguinProxy.exe

Thanks for the reminder.  I've been wanting to do this for some time,
but kept forgetting.  Then I have to restart the system and see the
various <stuff I don't want> loading up and think, "I really need to
see to this problem."  Then I get sidetracked and forget again....
sucks to be me....

I cleared out four problems just now by taking the time to go in and
fix this.  Thanks again!

-- 
//Steve//

Steve Silverwood, KB6OJS
[email protected]
Corona, CA USA