startprog

NAME

SYNOPSIS

WA2LWinTools/bin/command [ startprog_options | command_options ]

startprog_options ::= [ -h ][ -i ][ -u ][ -V ]

Hint: the startprog_options can be individually enabled/disabled/changed using the lib/command.opt file.
See: startprog.opt(4) for more information.

AVAILABILITY

DESCRIPTION

This to provide/show an *.exe file to the end user independent of the command implementation.

For each command to be started (normally located in lib/), create a copy of the lib/startprog.exe command file with the desired command name in the bin/ (or occasionally in lib/) directory of WA2L/WinTools and set a custom icon and description (using lib/rcedit).

OPTIONS

command_options

command line options to be passed to the target command.

startprog_options

This options enable some functions that are used to handle the started command.

-h

display usage.

-i

create shortcut in 'Send To' menu or 'Startup' menu depending on the SHORTCUTLOC setting in the command.opt file.

-u

remove shortcut from 'Send To' menu or 'Startup' menu depending on the SHORTCUTLOC setting in the command.opt file.

-V

print command version and author based on the settings VERSION and AUTHOR in the command.opt file.

The startprog_options can be individually enabled/disabled/changed using the command.opt file to avoid clashes with options provided by the command. See: startprog.opt(4) for more information.

ENVIRONMENT

See also: startprog.opt(4) for more information where the (environment) variables can be used.

%APPDATA%

path to user application data.
Example: APPDATA=C:\Users\JohnDoe\AppData\Roaming

%LOCALAPPDATA%

path to local user application data.
Example: LOCALAPPDATA=C:\Users\JohnDoe\AppData\Local

%COMPUTERNAME%

host name.
Example: COMPUTERNAME=acme-007

%ProgramFiles%

path to 32Bit software installed in Windows™.
Example: ProgramFiles=C:\Program Files (x86)

%ProgramFiles(x86)%

path to 64Bit software installed in Windows™.
ProgramFiles(x86)=C:\Program Files (x86)

%ComSpec%

full path including executable to the cmd.exe command.
Example: ComSpec=C:\WINDOWS\system32\cmd.exe

%windir%

directory of the Windows™ operating system installation.
Example: windir=C:\WINDOWS

%TEMP%

temporary directory.
Example: TEMP=C:\Users\JohnDoe\AppData\Local\Temp

%TMP%

temporary directory.
Example: TEMP=C:\Users\JohnDoe\AppData\Local\Temp

%USERDOMAIN%

domain name.
Example: USERDOMAIN=ACME

%USERNAME%

user name.
Example USERNAME=JohnDoe

%USERPROFILE%

path to user profile.
USERPROFILE=C:\Users\JohnDoe

The following variables are computed by the startprog command to be used in the option file command.opt :

%INSTALLDIR%

installation base directory of the WA2L/WinTools package.

%INSTALLDRIVE%

installation drive letter (without colon) of the WA2L/WinTools package.

%ARCHITECTURE%

Operating system type: 32 for a 32-bit and 64 for a 64-bit operating system.

The following environment variables are added to the environment by the startprog command and are therefore available within the started commands:

%WA2L_START_FROM_TTY%

this variable is set to True when the startprog command was started from a command window (aka. tty), when started thru a double click directly or via 'Send To' menu the variable is set to False.

This environment variable then can be used in started *.cmd or *.bat files to react accordingly based on the start situation.

%WA2L_INSTALLDIR%

installation base directory of the WA2L/WinTools package.

EXIT STATUS

x

return status of started type SYSTEM command.

2

shortcut on 'Desktop', in 'Send To' or 'Startup' menu could not be removed when using -u from the startprog_options.

4

usage message displayed when using -h from the startprog_options.

5

version message displayed when using -V from the startprog_options.

FILES

bin/command.exe

command variant of lib/startprog.exe to be used to start the target command thru an *.exe file.

lib/command.opt

option file of target command to be read by bin/command.exe . See: startprog.opt(4) for more information.

lib/startprog.exe

command to create a copy from in bin/.

%APPDATA%/Microsoft/Windows/SendTo/

directory that holds all shortcuts from the 'Send To' menu in Microsoft Windows™ Explorer.

%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/

directory holding all shortcuts to programs that are started automatically when you log in to Microsoft Windows™.

%USERPROFILE%/Desktop/

directory representing the user's desktop.

var/db/counter/command

statistics file for the called command. The var/db/counter/command file is a binary file that contains the time stamps of each command start.

If the var/db/counter/ directory does not exist no command start statistics are recorded.

To print a statistics table of all conducted command starts, use the progstats(1) command. To print a list of time stamps for a command, use the lib/timestampslist command.

To record time stamps to a var/db/counter/command file from a script that is not started thru startprog use the lib/timestampsrecord command.

EXAMPLES

SEE ALSO

NOTES

BUGS

VIRUS SCAN

Introduction

Therefore startprog.exe command needs to save/restore/modify some settings ahead of program start. Many of this tasks are made hidden from the user to give a better experience.

Because of this it is no surprise that some virus scanners rate this (falsely) as a threat.

Virus Scan

This service enables to scan a file with more than 70 (09.03.2024) virus scanners to allow a more comprehensive judgement if a file alerted by a system wide installed virus scanner is really infected or if the discovery is more likely a false-positive (=false alarm).

See vscan.rpt(4) for the current virus scan reports of the executables in the WA2L/WinTools package and instverify(3) for additional information.

Virus Detections

  Microsoft  Program:Win32/Wacapew.C!ml
  Microsoft  Trojan:Win32/Wacatac.B!ml

However, in this examples the local Microsoft™ Defender did not alert it.

For a description of the two detections, see:

[1]

Microsoft™ Homepage, Program:Win32/Wacapew.C!ml, 21.04.2025, URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Program:Win32/Wacapew.C!ml

[2]

Microsoft™ Homepage, Trojan:Win32/Wacatac.B!ml, 05.03.2026, URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Wacatac.B!ml

[3]

Medium, Trojan:Script/Wacatac.B!ml - When Microsoft Defender Cries Wolf (Usually), 27.04.2025, URL: https://medium.com/@smith_brendan/trojan-script-wacatac-b-ml-when-microsoft-defender-cries-wolf-usually-6fb25816eee6

For a virus scan report of the executables in the WA2L/WinTools package see vscan.rpt(4), to display the scan results of a single file, the instverify(3) command (example: instverify -s DirInfo.exe) can be used.

Source Code

Launcher Identification

  cdbin
  property -d *.exe | csvgrep "OriginalFilename;startprog.exe" | print_list

  FILE                                                  PROPERTY          VALUE
  ----------------------------------------------------  ----------------  -------------
  H:\bin\WA2LWinTools\bin\1by1.exe                      OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\7-Zip.exe                     OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\7Zip.exe                      OriginalFilename  startprog.exe
  :
  :
  H:\bin\WA2LWinTools\bin\WinToolsDownload.exe          OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\WinToolsRevision.exe          OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\WinToolsRevisionNotifier.exe  OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\WinToolsWebDownload.exe       OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\WScheduler.exe                OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\wtreset.exe                   OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\wtshell.exe                   OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\XMLEdit.exe                   OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\Yellowpile.exe                OriginalFilename  startprog.exe
  H:\bin\WA2LWinTools\bin\ZoomIt.exe                    OriginalFilename  startprog.exe
  (189)

Virustotal Analysis Examples

bin/CitesDownload.exe:

VT link

https://www.virustotal.com/gui/file/8acdf6def8f7da532b9d5e67df813aad527f99c98e3cc5ac86489742c84bdd47/details

Detections

1/71 security vendor flagged this file as malicious

Code insights

The analyzed binary is a legitimate program launcher and environment manager, part of the 'WA2L/WinTools' utility suite. Its primary functions include parsing configuration files (.opt), setting environment variables (e.g., WA2L_INSTALLDIR, PATH), and launching subprocesses via CreateProcessA or ShellExecuteExA. It contains specific logic for managing application shortcuts in standard Windows locations such as the Desktop, Startup folder, and SendTo menu using an external helper utility 'xxmklink.exe'. While it possesses capabilities often seen in malware, such as hiding its console window (ShowWindow) and establishing persistence via the Startup folder, these are implemented here as standard features for a portable application manager and installer. No malicious C2 communication, credential theft, or unauthorized data exfiltration behaviors were observed.

Security vendors' analysis

Microsoft Program:Win32/Wacapew.C!ml

History

Creation Time 2026-03-26 21:21:22 UTC
First Submission 2026-03-26 22:33:03 UTC
Last Submission 2026-03-26 22:33:03 UTC
Last Analysis 2026-03-26 22:33:03 UT

Names

gldpi.exe
CitesDownload.exe
startprog
startprog.exe

Signature verification

File is not signed

File Version Information

File Version Information
Copyright (c) Christian Walther
Product WA2L/WinTools:CitesDownload
Description download new version of lib/cites.js file
Original Name startprog.exe
Internal Name startprog
File Version 4.0.20

bin/DirInfo.exe:

VT link

https://www.virustotal.com/gui/file/93b72607418598af9572de59de79c5daa0bca869b418718d51a95ea48c8aada7/detection

Detections

1/71 security vendor flagged this file as malicious

Code insights

The sample is a legitimate utility identified as the 'Program Launcher and Environment Manager' from the WA2L/WinTools suite. Its primary function is to manage execution environments and launch other processes based on configuration files (.opt/.cfg). It performs standard administrative tasks such as expanding environment variables (e.g., %APPDATA%, %USERPROFILE%), modifying the PATH variable, and creating or deleting system shortcuts (Desktop, Startup, SendTo) by querying the 'User Shell Folders' registry key. While it uses ShowWindow(SW_HIDE) to hide its console and CreateProcessA to launch sub-processes, these behaviors are consistent with its purpose as a background launcher and environment manager. No malicious patterns or unauthorized persistence mechanisms were observed.

Security vendors' analysis

Microsoft Trojan:Win32/Wacatac.B!ml

History

Creation Time 2026-03-26 21:21:22 UTC
First Submission 2026-03-26 22:37:12 UTC
Last Submission 2026-03-26 22:37:12 UTC
Last Analysis 2026-03-26 22:37:12 UTC

Names

DirInfo.exe
ietd9.exe
startprog
startprog.exe

Signature verification

File is not signed

File Version Information

Copyright (c) Christian Walther
Product WA2L/WinTools:DirInfo
Description add/edit/view directory information file(s)
Original Name startprog.exe
Internal Name startprog
File Version 4.0.20

AUTHOR

COPYRIGHT

This is free software; see WA2LWinTools/man/COPYING for copying conditions. There is ABSOLUTELY NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.