Find and remove Malware with Sysinternals Tools - Part 2: Autoruns

In the second part of this series, I will show you how to use the Autoruns tool to find malware that starts during the startup phase.

In Part 1 of this series, we learned how to use Process Explorer to find suspicious processes that are active malware in the system. In this section, we will show you how to use the Autoruns tool to find malware that starts during the startup phase.

Overview of Autoruns

The next tool we will look at is Autoruns, which will show you what programs are set up to run during system boot and login process. The configuration for this tool is very flexible, allowing you to not only display programs in the startup, registry, Run and RunOnce folders, but also many other programs, such as Winlogon directives, objects. browser, toolbar, autostart service, etc. And it will display them in the order processed by Windows. You can disable startup programs directly from within Autoruns. The current version of this tool is 10.07 and it can run on Windows XP / Server 2003 as well as newer versions. You can download the tool here.

The command line version is autorunsc also available in this download. Both are downloaded as executable files in a compressed file, along with a help file (autoruns.chm). As you can see in Figure 1, this tool is much more comprehensive than the Windows tool called MSConfig.

Find and remove Malware with Sysinternals Tools - Part 2: Autoruns Picture 1
Figure 1

At first glance, you can see the interface has 18 different tabs above. The first tab labeled 'Everything' will show you all the types of programs and services configured to run at startup. Surely you will be surprised with the amount you see here. Unlike MSConfig, Autoruns does not require administrator rights.

Other tabs allow you to see information categorized by category, including:

Logon
Explorer (context menus, expand, .)
Internet Explorer (toolbar, browser object)
Scheduled Tasks (the process of running in the background through activating events)
Services (default Windows items are hidden)
Drivers
Print Monitors
LSA Providers
Network Providers
Sidebar Gadgets
Codecs
Boot Execute
Image Hijacks
AppInit
KnownDLLs
Winlogon
Winsock Providers

Most of the above items are quite familiar to us, but you will probably feel strange for AppInit. The value of AppInit_DLLs is used when certain programs load the DLL window manager (User32.dll). Since all programs that use the graphical interface (not the command line) in Windows load the DLL listed in this value, AppInit_DLLs are often the target of malware attacks.

Another tab you might encounter is Image Hijacks. This tab involves using Image File Execution options in the Windows registry to redirect the loading process by mapping the executable name and then loading a completely different process.

What can be done with Autoruns

Note that all the entries you see in Autoruns are not necessary programs, but they are programs that are configured to run automatically. To determine if an item is running, you can right-click it and select Process Explorer. Assuming you have Process Explorer installed, open this program so you can see the process properties dialog here. Note that if Process Explorer is running with administrator rights, while you are running Autoruns with standard user rights, this action will fail because Autoruns cannot communicate with Process Explorer.

One of the favorite features here is the 'Jump to' option. If the right click on an entry, you can select 'Jump to' as shown in Figure 2 and the registry editor will display the location of the item.

Find and remove Malware with Sysinternals Tools - Part 2: Autoruns Picture 2
Figure 2

There will definitely be some entries that you do not recognize the name, description, and manufacturer information. You can use the 'Search online' option to perform a search online. This is a way to help you detect whether startup items are related to malicious software.

Another extremely useful feature is found in the File menu. Here you will see an option called 'Compare .'. Using this option requires some caution and you need to use the File | option Save to save an Autoruns file (.ARN extension) before starting to solve the problem. If you do that, you can use the Compare option to mark new entries on the Autoruns list to narrow down the suspicions about malware.

For ease of management, you can select Hide entries that are identified as Microsoft software (the section is in the Options menu). This is not a good idea, though, because malware writers are very easy to label fake software for their software as created by Microsoft. To do so with a specific entry, select Verify from the Entry menu (or press CTRL + V). In addition, you also have the option of Code Signatures Verify in the Options menu.

Another advantage of Autoruns when compared with MSConfig is that it will show you the autostart entries by user. More and more malware is currently exploiting standard user accounts by writing to HKEY_CURRENT_USER. With Autoruns, you can choose the username of the account you want to view from the User menu. This will allow you to find malware in the registry in other user accounts.

Autoruns can even analyze offline systems, support operations for detecting rootkits. You will see this option in the File menu. What you need to do is enter the system root directory which is offline as well as the user profile you want to check. Note that Autorunsc (the command line version of Autoruns) can be used with Sysinternals, psexec tools, to view autostart entries on the remote computer.

Remove Autoruns entries

Another problem is that you need to know some options to remove items found in Autoruns. There are two ways to do that within Autoruns:

Select the item in the list and click the Delete button in the taskbar, or press the Delete key on the keyboard. This does not delete the linked files and it does not stop the process if it is running. It only changes the value of the registry, the value that instructs Windows to automatically launch it.
You can also temporarily remove an item from startup by canceling the check box next to it. When you do this, the program will be removed from the Run key in the registry and stored in the small key 'AutorunsDisabled' so you can reactivate it by checking the checkbox.

Note that in some cases, you may have to restart the process, log out and log back in, or even restart the computer for the changes to take effect.

Conclude

In this second article we will cover only Autoruns, in the next part of this article series, I will show you how to use Process Monitor to track malware actions and how to remove malware from the system. when it is detected as well as what to do if the Sysinternals tool does not help.

Marvin Fry

Update 26 May 2019

You should read it

May be interested

How to Clean a Computer of Malware
this wikihow teaches you how to find and remove malware from your windows or mac computer. typically speaking, an antivirus scan will be enough to remove most major threats to your computer. if you're having trouble with your malware...
5 types of malware on Android
malware or malware can affect mobile devices as well as computers. a little bit of knowledge and proper precautions can protect you from threats like ransomware and sextortion scam.
Some simple tricks to deal with Malware
malware seems to become more and more intelligent and causes more incalculable consequences than before. installing malware detection tools (malwarebytes, hijackthis, combofix ...) on the computer is not a redundant task. but in some cases, for many reasons (blocked by malware itself) these tools are
Remove root malware (malware) on Windows 10 computers
if pop-up windows are displayed on your windows 10 computer screen or your computer is redirected to advertising windows, it is likely that your computer has adware or chapters. unexpected process of attack.
Warning: 5 million Samsung, OPPO, Vivo smartphones ... are infected with malware and this is how to check and remove
a large-scale malware distribution campaign has just been discovered and it is affecting nearly 5 million smartphones of major brands worldwide including honor, huawei, xiaomi, oppo, vivo, samsung and gionee.
What is FormBook Malware? How to remove?
if you manage sensitive data, you should be concerned about the formbook malware. once on a network or pc, this information-stealing malware can cause irreparable damage to your company.
What is Safe Malware? Why is it so dangerous?
remote access trojan (rat) is a type of malware that allows hackers to monitor and control the victim's computer or network.
What is crapware? How to remove Crapware software from the system
the most annoying thing that people hate on newly purchased computers is crapware. crapware is unnecessary software preloaded in newly purchased systems, slowing down pcs, causing system instability, creating crashes and consuming precious memory.
Completely remove URL Mal Virus - http://107.170.47.181
url: mal is one of the most dangerous dns related to advertising platform. it has the address is http://107.170.47.181. url: mal is created by free software from unwanted programs (pup). url: mal appears on your computer, then your computer will appear a series of ads. its purpose is to trick users into clicking on links to make a profit.
How to use Malwarebytes Anti-Malware to scan and remove malware
malwarebytes anti-malware is one of the leading antivirus and computer protection software available today. with the ability to detect and remove malware, trojans, ransomware, adware, and other security threats, malwarebytes helps keep your personal data safe.