Solved Unable to run sysinternals programs like autoruns.exe

x BlueRobot · Dec 2, 2023

zebal said:
Maybe I should regenerate trace file with longer wait time until autoruns opens?

That would be a good idea, leave the trace running until Autoruns starts, but you mentioned that it started without any issues?

It might be useful to provide your SxS subkey as a hive file using the following command from command prompt:

Rich (BB code):

reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide %userprofile%\Desktop\SxS.hiv

You should have a file called SxS.hiv saved to your desktop. Please zip up the file and then attach it to your next post, along with the SxS trace file.

zebal · Dec 2, 2023

x BlueRobot said:
but you mentioned that it started without any issues?

It started but after 5 minutes and during those 5 minutes explorer was frozen, the error was logged anyway in event viewer about SxS from initial post.

I'm attaching both files, within zip file you asked.

x BlueRobot · Dec 2, 2023

Unfortunately, it looks like the .hiv file didn't get exported correctly (no file signature), could you please run the following command instead?

Code:

reg save HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide %userprofile%\Desktop\SxS.hiv

The SxSTrace still looks to be okay too?

zebal · Dec 2, 2023

x BlueRobot said:
Unfortunately, it looks like the .hiv file didn't get exported correctly (no file signature), could you please run the following command instead?

Possibly because didn't run it in admin cmd, I've run the second command in admin cmd, it's in attached zip file.

x BlueRobot said:
The SxSTrace still looks to be okay too?

Yes it's looks clean, except line which says:

INFO: Manifest Definition Identity is (null).

But I assume that's OK because same is reported for other executables.

zebal · Dec 2, 2023

I've read a way to fix this kind of issue is to uninstall programs that were installed prior the problem, funny thing is I don't recall installing anything prior the problem because windows is fresh installed.

But I have 2 drivers for devices, drivers for which are not for Windows 11, however removing those drivers didn't make any difference but I recall one of them required DirectPlay to be installed via optional features to install driver, I also uninstalled a program installed recently, it's PowerToys, but other than this I have no other programs installed atm.
VSCode, password safe and Gpg4win but these can't be culprit because I'm using them for long time and know they don't cause issues.

I have just checked and see that DirectPlay is disabled but was enabled during driver installment, could that be the problem?

johnlgalt · Dec 2, 2023

Did you install autoruns? Or are you just running it after extracting from a .ZIP?

zebal · Dec 2, 2023

johnlgalt said:
Did you install autoruns? Or are you just running it after extracting from a .ZIP?

Extracted from zip, didn't know it can be installed, but I now also noticed some other programs respond slowly until they open too, ex. PowerToys installer because was reinstalling it didn't open for 4-5 minutes however there was no SxS error in event viewer created like with autoruns.

I also tried extracting sysinternal zip to another location on disk and running that but it's same.

johnlgalt · Dec 2, 2023

You can't which is why I was asking, instead of just coming out can saying "Uh, you can't install that" lol.

Have you tried downloading a fresh copy from the SI website and extracting it to a different folder and see if it works? It might be a simple file or settings corruption issue.

zebal said:
I also tried extracting it to another location on disk and running that but it's same.

Was this a fresh download too, or the one you already had downloaded?

zebal · Dec 2, 2023

johnlgalt said:
Have you tried downloading a fresh copy from the SI website and extracting it to a different folder and see if it works?

yes thanks, tried that already, new zip downloaded to another disk and ran from there, no change.

johnlgalt · Dec 2, 2023

Lemme see something really quickly.

Can you run the live version from https://live.sysinternals.com/autoruns.exe and see if it works?

zebal · Dec 2, 2023

johnlgalt said:
Can you run the live version from https://live.sysinternals.com/autoruns.exe and see if it works?

Thanks but no change, it immediately recorded same error in event viewer

johnlgalt · Dec 2, 2023

According to Clean Up the WinSxS Folder it also recommends running disk cleanup to clear out temp files and such (along with the DISM commands Ghot posted earlier).

And this page said the OP solved it by re-installing Windows. Redirecting

While that can be arduous, in the best of cases, one thing you could try doing is an in-place upgrade.

Repair Install Windows 11 with an In-place Upgrade Tutorial

This tutorial will show you how to do a repair install of Windows 11 by performing an in-place upgrade without losing anything. If you need to repair or create a new recovery partition or having problems with the Windows 11 operating system on your PC, and the usual solutions will not fix it...

www.elevenforum.com

johnlgalt · Dec 2, 2023

Which leads me to another thought:

You have an idea when this issue manifested? If so, check your WU History to see if there was a Windows update installed right around that time, also - maybe simply uninstalling that update may fix it?

zebal · Dec 2, 2023

johnlgalt said:
According to Clean Up the WinSxS Folder it also recommends running disk cleanup to clear out temp files and such

I just cleared everything and it didn't help.

johnlgalt said:
check your WU History to see if there was a Windows update installed right around that time, also - maybe simply uninstalling that update may fix it?

I just checked and it says "no update found", there are some updates but those it seems can't be uninstalled.

johnlgalt said:
And this page said the OP solved it by re-installing Windows

Oh yes, I will reinstall it tomorrow perhaps, because there will be no other option sadly.
But I have restore point also created when everything was fine, and will try that too tomorrow and will report back, it's late here right now.

Thanks you all for help for now!

johnlgalt · Dec 2, 2023

NP, good luck with this!

x BlueRobot · Dec 2, 2023

zebal said:
Possibly because didn't run it in admin cmd, I've run the second command in admin cmd, it's in attached zip file.

The reg export command seems to export the file in a format which allows it to be imported through regedit. It doesn't include the regf file signature like reg save does which means that the registry editor won't be able to read the file.

The Winners keys for the mentioned components appear to be okay too. Could you please provide your COMPONENTS hive too?

Code:

%systemroot%\System32\config\COMPONENTS

I'm just wondering if it is worthwhile getting a Process Monitor trace while you try and run Autoruns? However, will Process Monitor encounter the same issues? Nevertheless, here are the instructions if it does work:

Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Try running Autoruns just like you have in the past.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square icon on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up and provide the link to the LogFile.PML file. Examples of services to upload to are Dropbox or OneDrive or WeTransfer.

zebal · Dec 2, 2023

Attached is components hive, however it's too big for forums so I uploaded it to mega:

12.82 MB file on MEGA

mega.nz

x BlueRobot said:
I'm just wondering if it is worthwhile getting a Process Monitor trace while you try and run Autoruns? However, will Process Monitor encounter the same issues?

Yes all sysinternals programs are affected, but I've run procmon, had to wait 5 min, however generated file is 1GB and I don't have very fast upload speed, and it doesn't show anything useful at first glance.

I'll try to make it smaller and share tomorrow, need to go now, looking forward from you!

TraderGary · Dec 2, 2023

The entire Sysinternals Suite is available in the Microsoft Windows Store. The complete Suite installs in a Sysinternals Suite folder in All Apps. The Windows Store always keeps the entire suite up to date without your ever having to think about it. It's completely problem free this way. I like to keep Process Explorer, Autoruns, and Process Monitor on my Windows 11 Start Menu.

I've been methodically going through the Kindle version of "Troubleshooting with the Windows Sysinternals Tools" by Mark E. Russinovich on my other laptop as I work through the examples on my main computer. The book is highly recommended. What fun and I've learned so much.

johnlgalt · Dec 2, 2023

Individually or live or suite - he can't run them.

dacrone · Dec 2, 2023

Ghot said:
It's wasn't really a conscious thought. I download the zip file... extract it and run Autoruns64.exe
I don't really even "see" the others.

Now in another situation... VLC Media Player... I remove over half the files in that installation folder.
Because they're evil I tell you! Evil!

These are the only things I leave in the VLC folder...

View attachment 79789

This is the EVIL that I remove from VLC...

View attachment 79790

If you use dark mode, switch to kmplayer. Trust me, tried em all and it’s so much easier on the eyes.
*oh, and ZERO delay accessing shared media across the lan… VLC always gave me a 5-8 sec delay when launching 4k media