įor tracking down such malicious code, “ AutoRuns” utility can be very useful. Let’s look at the screenshot given below, it can be seen clearly that this piece of malware under consideration depends on windows autorun features and uses the registry entry of windows to get into the system. They automatically load their software through browser helper objects (a DLL module), services, scheduled tasks or drivers. But on the other hand, malicious entities also use this feature to get into the user’s system by adding the malicious run keys in the registry. It is often required for other programs, such as protection applications, and these programs must often begin as soon as possible. This is beneficial since it allows users to choose which applications they want to launch at startup. While some programs are set to run automatically by default, any program can be made to start automatically by entering its location in the startup folder or adding a value into the run key in the windows registry. When a system is booted, the Windows operating system automatically runs certain programs using its “ autoRun” feature. AutoRuns utility for windows operating systems can be downloaded from here. We can use this behavior to detect malware by inspecting only the programs that start at the Windows bootup, and that can speed up the identifying process. This is the reason why most of the Windows related malware are designed in such a way as they rely on Windows startup processes to live. They need to automatically start when your computer boots up, so they use Windows features that ensure automated execution during the startup.

Whether it’s a piece of bogus security software hounding us to buy it, or a bot waiting for commands, they all need a way to survive a power cycle. Malware is any software that is created with the intent of causing harm to a device, server, client, or an entire network.

Autoruns