Quite simply, it is a very powerful tool that everyone can benefit from learning how to use. The user can then decide to disable/delete applications, save a log of the Autoruns on the system and then compare it later when a malware infection or something else has gone wrong. Autoruns scans through a very comprehensive index of these locations and reports back its findings to the user. There are countless applications and extensions out in the wild for all kinds of programs that can be run in this way or a multitude of other ways in Windows. Similarly, registry entries under the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run will be run automatically at start-up too. Any application in that folder (or shortcut) will automatically execute on boot. For example, there is a Startup folder in Windows which you can find in the Start Menu. So where does this information come from? The truth is there are so many locations in the Windows registry and in the file system which can be used to execute a program. Everything here can be disabled (except Winsock) or deleted completely.
When you first run Autoruns, it will have the "Everything" tab opened automatically and you will see it start to get populated with all kinds of "autoruns". For most Windows XP Admin accounts on personal computers, you won't need to do this, but you will in most cases if running Windows Vista or 7. To do this, right click on autoruns.exe and click Run as Administrator (or Run As in Windows XP, choose an account with full Admin rights).
Autoruns needs to be run with Administrative privileges to make necessary changes.
It can also be used to reduce the number of auto-start programs to increase system performance. It covers the most common areas for malware to hide from detection, and so can be a powerful manual malware attacking tool.
0 kommentar(er)
