From Newsgroup: alt.comp.os.windows-11

I've installed Teamviewer V15.70.5 on my Mum's Win 11 PC so I can access
it and help her with any computer problems (she's 89). I've set it to
grant access to myself so she doesn't have to authorise her PC to accept
my connection to it.

That works perfectly. But she said that sometimes when she boots up her
PC it displays the console window - this screen (redacted!)

https://i.postimg.cc/W3Vs1vVM/Image1.png

I can't find any thing in HKCU/Software/Microsoft/Windows/Current
Version/Run or HKLM/(same pathname) Registry keys, or in Settings | Apps
or Win+R shell:startup [the Startup folder], or Task Manager | Startup
which starts anything. I presume the tray icon (which I *do* want!) is installed and started as a service.

Are there any other ways in which programs can install themselves so the auto-start at boot, either for all users (system-wide) or for a specific
user? It's weird that the behaviour is intermittent and the console
screen doesn't appear at every boot or at every restart after the PC has
been previously put to sleep.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

On 13/10/2025 18:55, NY wrote:

A couple of things I forgot to mention in my earlier posting...

I've installed Teamviewer V15.70.5 on my Mum's Win 11 PC so I can access
it and help her with any computer problems (she's 89). I've set it to
grant access to myself so she doesn't have to authorise her PC to accept
my connection to it.

That works perfectly. But she said that sometimes when she boots up her
PC it displays the console window - this screen (redacted!)

https://i.postimg.cc/W3Vs1vVM/Image1.png

I can't find any thing in HKCU/Software/Microsoft/Windows/Current Version/Run or HKLM/(same pathname) Registry keys, or in Settings | Apps

and then Startup (sorry, forgot that step!)

or Win+R shell:startup [the Startup folder], or Task Manager | Startup
which starts anything. I presume the tray icon (which I *do* want!) is installed and started as a service.

Are there any other ways in which programs can install themselves so the auto-start at boot, either for all users (system-wide) or for a specific user? It's weird that the behaviour is intermittent and the console
screen doesn't appear at every boot or at every restart after the PC has been previously put to sleep.

I can't find anything in Teamviewer's settings (right click on its
system tray icon | Options) which govern auto-display of the console at
system bootup.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

On Mon, 10/13/2025 1:59 PM, NY wrote:

On 13/10/2025 18:55, NY wrote:

A couple of things I forgot to mention in my earlier posting...

I've installed Teamviewer V15.70.5 on my Mum's Win 11 PC so I can access it and help her with any computer problems (she's 89). I've set it to grant access to myself so she doesn't have to authorise her PC to accept my connection to it.

That works perfectly. But she said that sometimes when she boots up her PC it displays the console window - this screen (redacted!)

https://i.postimg.cc/W3Vs1vVM/Image1.png

I can't find any thing in HKCU/Software/Microsoft/Windows/Current Version/Run or HKLM/(same pathname) Registry keys, or in Settings | Apps

and then Startup (sorry, forgot that step!)

or Win+R shell:startup [the Startup folder], or Task Manager | Startup which starts anything. I presume the tray icon (which I *do* want!) is installed and started as a service.

Are there any other ways in which programs can install themselves so the auto-start at boot, either for all users (system-wide) or for a specific user? It's weird that the behaviour is intermittent and the console screen doesn't appear at every boot or at every restart after the PC has been previously put to sleep.

I can't find anything in Teamviewer's settings (right click on its system tray icon | Options) which govern auto-display of the console at system bootup.

https://community.teamviewer.com/English/discussion/131058/teamviewer-keeps-opening-at-startup/p1?tab=all&omit_analytics_page_load[0]=true&omit_analytics_page_load[1]=true

Jul 20, 2023 Updated Oct 12, 2025 by Ying_Q # This has been going on for at least five years, maybe more.

https://superuser.com/questions/447379/starting-teamviewer-minimized-windows

"I had this problem after upgrading from TeamViewer 8 to 9, then again from
TeamViewer 9 to 10. It seems the issue can be resolved by completely
uninstalling TeamViewer and reinstalling it."

Summary: So while the application from Germany, has two tick boxes for
controlling the behavior, the controls do not work reliably.
And that's the only suggestion I've seen so far, of a work-around.
Then, every time it does a version upgrade, you would presumably
be going through the same effort to correct it.

Paul


--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

NY <me@privacy.net> wrote:

I've installed Teamviewer V15.70.5 on my Mum's Win 11 PC so I can access
it and help her with any computer problems (she's 89). I've set it to
grant access to myself so she doesn't have to authorise her PC to accept
my connection to it.

That works perfectly. But she said that sometimes when she boots up her
PC it displays the console window - this screen (redacted!)

https://i.postimg.cc/W3Vs1vVM/Image1.png

I can't find any thing in HKCU/Software/Microsoft/Windows/Current Version/Run or HKLM/(same pathname) Registry keys, or in Settings | Apps
or Win+R shell:startup [the Startup folder], or Task Manager | Startup
which starts anything. I presume the tray icon (which I *do* want!) is installed and started as a service.

Are there any other ways in which programs can install themselves so the auto-start at boot, either for all users (system-wide) or for a specific user? It's weird that the behaviour is intermittent and the console
screen doesn't appear at every boot or at every restart after the PC has been previously put to sleep.

There are a LOT of locations in folders and registry that will load
programs on Windows startup, or after login. A better tool to get a
list of startup programs at all sources for them is SysInternals'
AutoRuns.

https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

For example, there are Winlogon Events to load programs on startup which
you only find in the registry.

There is another startup source that is a rootkit deliberately created
by Microsoft when using UEFI for BIOS. It has been used by some
corporate inventorying software for checking what is running or
installed on their workstations. Can be used by malware, too. My
canned response about the rootkit is long, so I'll post it as a reply to
this article.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

VanguardLH <V@nguard.LH> wrote:

There is another startup source that is a rootkit deliberately created
by Microsoft when using UEFI for BIOS. ...

A "feature" of UEFI (with Microsoft's involvement) is a program can be specified in the UEFI to run on Windows startup. Despite regulating any startup programs, or scanning for malware, there could sit a call to a
program in the UEFI. It could, for example, be used for starting
execution of tracking software (how the computer is used), or for
software inventorying on workstations. I've only seen it used by
companies that wanted to add usage tracking, location, anti-theft, or inventorying to their workstations. However, it could also be used by
malware, and I don't know if any AVs check for a program load specified
in the UEFI. As I recall, some mobos (Lenovo, Gigabyte, ASUS) use this
trick to run services or diagnostics on Windows startup. The AV should
catch malware for whatever the UEFI program load specifies; that is, the
.exe in UEFI usually calls some other program that runs under Windows.

It is a "feature" only with UEFI. When Windows loads, it has a program (C:\Windows\system32\wpbbin.exe) that runs to determine if the UEFI
specified a start program. The UEFI start program is in one of the ACPI
tables in the BIOS. One trick is to rename the loader program in
Windows called the UEFI Bootkit dubbed BlackLotus.

You can Nirsoft's Firmware Tables View to see the ACPI tables in UEFI.
Look for the "Windows Platform Binary Table" (WPBT). Nirsoft will show
the ACPI table, if it is defined, but won't let you delete it. When I
found out about this, Nirsoft didn't show a WPBT table, but then I have
many options disabled in the BIOS. I also don't have the wpbbin.exe
program (that checks the UEFI for an .exe file to load) in my Windows installation.

Although pundits attempt to tout UEFI, Secure Boot, and other later
security measures as protecting users, there are UEFI Bootkits that
bypass all those measures, even Secure Boot, like BlackLotus.

https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/

Those are different beasts than the UEFI program load specified in an
ACPI table that Windows checks if it is defined, and if found will run
the UEFI-specified program. I'm noting the UEFI program load on Windows
launch because refurbs often are company workstations that were leased,
and then disposed of. Companies may employ tracking, location, or
software inventorying that the Windows-loaded UEFI-specified program
will start. You won't find that method listed in, say, SysInternals'
Autoruns. Windows loads, checks the UEFI for the bootkit/rootkit
program, and runs that program under Windows. Since Secure Boot okays
the load of Windows, and since it is a program under Windows that loads
the .exe in the UEFI, Secure Boot won't catch this tactic.

https://eclypsium.com/blog/everyone-gets-a-rootkit/

There are tools to nullify the .exe in the WPBT ACPI table in UEFI by
deleting it from memory before Windows reads the ACPI tables, like:

https://github.com/Jamesits/dropWPBT#from-windows

This removes the WPBT table from system memory, so you have it run as a
startup program (that loads with Windows startup, not until whenever you
log into your Windows account).

For your own computer, you don't want WPBT employed. WPBT started with
Windows 8. Probably the easiest way to disable WPBT is to rename,
delete, or move the wpbbin.exe if it exists on your system. An update
could replace it, so you might want to use Task Scheduler to run a
delete command on every Windows startup. The Github article talks about different methods of disabling WPBT, but they're rather complicated instructions.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

On Mon, 13 Oct 2025 18:55:16 +0100, NY wrote:

I've installed Teamviewer V15.70.5 on my Mum's Win 11 PC so I can access
it and help her with any computer problems (she's 89). I've set it to
grant access to myself so she doesn't have to authorise her PC to accept
my connection to it.

That works perfectly. But she said that sometimes when she boots up her
PC it displays the console window - this screen (redacted!)

https://i.postimg.cc/W3Vs1vVM/Image1.png

You shouldn't have installed it. She only needs QuickSupport which is
portable. Download it here:

<https://www.teamviewer.com/en/download/portal/windows/>

It's a portable EXE. AFAIK nothing gets installed. She just has to
doubleclick on the EXE to start it, give you the ID and pass and then
you can take over with TV.

I've used TV for a long time and then came across this gem:

RustDesk
<https://rustdesk.com/>

It works in the same way: doubleclick the portable EXE, share ID and
password and you're in. It advises to install RustDesk on the remote
device because of UAC, but in case of a pop-up you can always tell the
remote user to allow it.
--
s|b
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

On Tue, 14 Oct 2025 14:14:35 +0200, "s|b" <me@privacy.invalid> wrote:

On Mon, 13 Oct 2025 18:55:16 +0100, NY wrote:

I've installed Teamviewer V15.70.5 on my Mum's Win 11 PC so I can access
it and help her with any computer problems (she's 89). I've set it to
grant access to myself so she doesn't have to authorise her PC to accept
my connection to it.

That works perfectly. But she said that sometimes when she boots up her
PC it displays the console window - this screen (redacted!)

https://i.postimg.cc/W3Vs1vVM/Image1.png

You shouldn't have installed it. She only needs QuickSupport which is >portable. Download it here:

<https://www.teamviewer.com/en/download/portal/windows/>

It's a portable EXE. AFAIK nothing gets installed. She just has to >doubleclick on the EXE to start it, give you the ID and pass and then
you can take over with TV.

For a number of years, I provided remote support to an elderly couple.
She had a laptop, he had a desktop, so I created two port forwarding
rules on their router, etc.

One of the big requirements was that I needed to be able to remote in
whenever I wanted to, not when they were sitting there and clicking on
an exe in order to give me an id/pass combo. I did most of my work after midnight, long after they were soundly sleeping in bed.

--- Synchronet 3.21a-Linux NewsLink 1.2