On earlier Windows version such as 95 and 98, there are only a few areas where it controls a program to auto startup when Windows is booted up. There are so many now startup methods on Windows 7 and is better to rely on a tool such as Autoruns by Sysinternals. One of the auto startup method that is still being used until today is the Software\Microsoft\Windows\CurrentVersion\Run path in Windows registry located at both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. I am very familiar with this auto startup registry path because I already memorized it more than 10 years ago when I’ve helped many friends clean viruses and trojans such as NetBus and Back Orifice from their computer. Basically any values added to that Run key will be started when Windows is booted up.

Now if you look at the next registry key after the Run key, you would find a RunOnce key. The Run and RunOnce does the same thing which is running the program when Windows is booted up but with one difference which is RunOnce only run the program once and it won’t run again at the next reboot. Usually the RunOnce key is being used to delete files that are being used by system services or locked by Explorer.


Adding a program to RunOnce is very simple. All you need to do is create a new String Value and set the full path to the program that you want to run for the value. If you don’t know how to manually edit the Windows registry or don’t want to take the risk, you can easily do so by using the free and portable tool called RunItOnce.

Simply run the RunItOnce tool and it will open a Window asking you to select the program to run once on next boot. After selecting the program, you can see that it is instantly added to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. The only limitation on this tool is you can only add and cannot edit or delete the RunOnce keys. To edit or delete the RunOnce keys, you have to do it manually using the Windows Registry.

There are a few rules to remember when using the RunOnce key. First you will need to run RunItOnce as administrator or else it wouldn’t be able to make changes on the Windows registry and giving you the error “RunItOnce Failed for: ProgramName”. Secondly, the RunOnce keys are only ran after the user successfully logs in to Windows and before the Windows Shell is fully functional and other programs will be starting up. Finally, these keys are ignored when the computer is started in Safe Mode.

RunItOnce is a simple yet useful little tool to make our advanced computing life easier.

[ Download RunItOnce ]

Emsisoft Anti-Malware may not be as popular as AVG, Avira or Avast but it is well known for its superb detection taking the lead in a couple of independent tests. The first thing I like about Emsisoft is that their company is not too big which made it possible for me to speak to Christian Mairoll, the CEO of Emsisoft a couple of times over Skype. Christian is definitely a very friendly and professional person. I got to know about the major update on Emsisoft Anti-Malware few weeks back and this version claims to have taken more than one year in development to completely rewrite for multi-core optimizations which makes it faster, safer and more resource-saving than ever.

I was excited to review the new Emsisoft Anti-Malware 6.0 and finally I had the time to do it today. The current (6.0.0.46) setup installer file size is at 106MB while when I benchmark the performance was an older build at 96.5MB. The design remains familiar while there are dozens of technical improvements.


Launching Emsisoft Anti-Malware 6.0 will bring you to the Security Status window showing you the status of File Guard, Behavior Blocker and Surf Protection. It also tells you the last time you performed a malware scan and also an update.

Next at the menu is Scan PC where you can select four different type of scan profiles. Quick Scan is for scanning all active running programs which took merely 19 seconds on my test system. Smart Scan does the same as quick scan but includes programs and Windows files. The Deep Scan is the slowest because it thoroughly scans all files on all hard drives. Finally the last scan profile is Custom where you can select what type of objects to scan and also the settings. At the bottom you can add files to whitelist to prevent Emsisoft Anti-Malware from scanning the file and also action to automatically perform when scan has been completed.

The Quarantine window simply lists all the files that Emsisoft Anti-Malware has been quarantined so you can easily submit file to Emsisoft for analysis, re-scan again on newer virus definitions, manually add, restore or delete the quarantined files.

Logging is an important tool for tracing procedures but normally it is not easy to go through logs as they contain too much information. Emsisoft Anti-Malware made it clear and simple by dividing into 3 different log windows (Guard, Quarantine and Update).

The Guard window allows easy fine tuning or removal of behavior rules. The Behavior Blocker is enabled by default and watches 19 different types of activities such as possible backdoor, spyware, hijacker, worm, dialer, keylogger, trojan, injection, patching, invisible installation, rootkit, mouse and keyboard simulation, modifying of HOSTS file and etc.

Finally, the Configuration area allows you to configure the antivirus’ global options such as the Guard Settings, Scheduled Scans, Updates, Automatic Update, Logging, Permission and License. From the License tab, you can opt to switch to Freeware mode where the real-time protection is disabled and you can only use Emsisoft Anti-Malware 6.0 for scanning and cleaning.

Since the real-time guard is disabled for freeware mode, logically Emsisoft Anti-Malware 6.0 shouldn’t have any process running in background. I noticed that the a2service.exe process is still running even on freeware mode which may take up unnecessary memory usage. To disable the a2service.exe, click on the Windows Start button, type services.msc and hit enter. Look for Emsisoft Anti-Malware 6.0 – Service on the list and double click on it. At the Startup type drop down menu, select Manual and click Apply. This will prevent a2service.exe process from automatically starting whenever Windows is booted up.

Do note that manually running Emsisoft Anti-Malware 6.0 will trigger a2service.exe process and it remains active until you restart your computer. To manually terminate the a2service.exe process, either click the Stop button from the Services window, or run command prompt as administrator and type the command net stop a2AntiMalware. If UAC is enabled and you do not run command prompt as administrator, you will get “System error 5 has occurred. Access is denied” error.

Comparing Emsisoft Anti-Malware v5 with v6, most of the benchmark numbers has improved tremendously. Only the time taken to boot up Windows and file compression has increased a bit.

Numbers bolded in blue means improved while red is worsen

Emsisoft Anti-Malware 6.0.0.46 also passed the most recent single product flash test performed by Malware Research Group detecting a perfect 50 out of 50 samples. False alerts has also been significantly reduced because of its internal analysis system. Emsisoft has recently revealed a creative referral rewards program where you can easily get a 1 month or 6 months extension of your license for free.

Emsisoft is definitely heading the right direction with improved performance while maintaining its top notch detection. Christian Mairoll has generously sponsored 30 Emsisoft Anti-Malware 6.0 license valid for 1 year to be given away here. Visit our giveaway page to join the raffle.

[ Download Emsisoft Anti-Malware 6.0 ]

When you get online or in a network, network packets are being used to transfer data around. We don’t normally get to see them because they work secretly in background. In order to investigate the packets, we have to use packet sniffing tools and one of the most popular free software for that is WireShark. Seems like Nir Sofer, the author of Nirsoft.net has been playing around with network packets lately because most of his new release tools has got to do with packet sniffing. One of his latest new release is called HTTPNetworkSniffer which captures all HTTP requests/responses sent between the Web browser and the Web server and displays them in a simple table. Basically this is an alternative to URL Snooper.

Tools such as HTTPNetworkSniffer are very useful when you want to find out the direct link to download a software when it uses web installer. One example is when you want to download and install AVG Anti-Virus Free 2012, you will have to first download a 3.7MB web installer, and the web installer will then download the latest necessary files to install on your computer. The web installer doesn’t show you where it is downloading from and HTTPNetworkSniffer solves this problem.


As usual, what I like most about Nir Sofer tools are they are portable. HTTPNetworkSniffer is only a single 108KB file (HTTPNetworkSniffer.exe). Running it will first prompt you to select the sniffing engine driver. Unlike URL Snooper that only works with WinPcap, HTTPNetworkSniffer can support Raw sockets which you don’t need to install any third party driver for sniffing but required to run as administrator when UAC is enabled, WinPcap and Network Monitor Driver by Microsoft. Clicking the play icon at the menubar will start capturing the packets.

HTTPNetworkSniffer shows a lot of information such as host name, method (POST, GET), path, user agent, response code & string, content type, referrer, content & transfer encoding, server, content length, connection, cache control, cookie, client & server address, and request time. That is A LOT of useful information that is being shown compared to URL Snooper. What I find missing from HTTPNetworkSniffer is the option to remove duplicates and also filtering so that it is easier for me to search the path that I am looking for. An option to copy the “full path” (host name + path) would also be very useful.

Do note that HTTPNetworkSniffer only works on non-encrypted sessions. Meaning if the files are hosted at HTTPS, the packets are SSL encrypted and there is no way for HTTPNetworkSniffer to decode it. That is the whole point of SSL encryption to provide security for data sent to and from a web site.

[ Download HTTPNetworkSniffer ]