autoruns, catching malware hiding in startup items

malware has one weakness: it has to survive a reboot

here's the thing nobody tells you about malware. it doesn't matter how sneaky it is when it first lands on your machine. if it wants to stick around, it has to register itself somewhere that runs automatically. a run key, a scheduled task, a service, a wmi subscription, a startup folder shortcut. windows has roughly a thousand places something can hide to auto-launch, and that's actually good news for you, because it means every single piece of persistent malware leaves a footprint in one of those spots. you just need a way to see all of them at once instead of checking fifty registry keys by hand.

enter autoruns

autoruns is a free sysinternals tool that enumerates every autostart location on a windows system in one shot. the command line version, autorunsc, is what you want for actual investigation work because it dumps clean structured output you can filter, instead of a gui you have to squint at.

autorunsc.exe -a * -h -c -nobanner > autoruns.csv

let's break that down piece by piece.

-a * tells autoruns to check every category of autostart location it knows about. not just run keys, everything: services, drivers, scheduled tasks, browser helper objects, wmi, codecs, print monitors, the works.

-h adds file hashes to the output. this matters because a hash lets you check a binary against known-good or known-bad lists later without re-scanning.

-c formats the output as csv instead of a plain text dump, which is the difference between "readable spreadsheet" and "wall of text you have to grep through."

-nobanner just suppresses the sysinternals license banner so it doesn't junk up your csv file.

run that and you get a full inventory of every single thing configured to launch on this system, including the legitimate stuff. and that's the catch: a clean windows install already has hundreds of autostart entries. drivers, antivirus components, cloud sync clients, printer software. your one malicious entry is sitting in a haystack of normal boot noise.

filtering out the noise

this is where the second command earns its keep. almost everything legitimate on a windows box is digitally signed by microsoft or another verified publisher. malware usually isn't, because getting a real code signing certificate costs money and leaves a paper trail attackers don't want. so the fastest way to shrink that haystack is to filter out anything signed by microsoft and anything with a verified signature, then look at what's left.

Import-Csv autoruns.csv | ? { $_.Signer -notmatch 'Microsoft|Verified' -and $_.'Image Path' -like '*Temp*' }

this line pulls the csv into powershell, then keeps only rows where the signer field doesn't say microsoft or verified, and where the image path includes the word temp. that second condition is doing a lot of work. legitimate software installs into program files, system32, or a vendor folder. it does not normally live in a temp directory and then register itself to auto-launch. an entry that's unsigned, sitting in appdata\local\temp, and named something like svch0st.exe or svchost.exe with a slightly wrong path, is exactly the kind of thing that survives a casual glance but falls apart under this filter.

why the svchost disguise matters

svchost.exe is a real and extremely common windows process, which is exactly why malware authors love naming their payload after it or something close to it. a real svchost always lives in c:\windows\system32 and is signed by microsoft. if you see "svchost.exe" running from c:\users\yourname\appdata\local\temp, that's not svchost, that's something wearing its name as a costume. autoruns paired with a path and signature filter cuts through that costume in seconds instead of requiring you to memorize what every process should look like.

how you use this on your own machine

you don't need to be running an incident response team to get value out of this. download sysinternals suite, run autorunsc on your own laptop or a system you administer, and generate that csv. run the filter. if it comes back empty, great, that's a good sign. if something shows up, don't panic and don't delete it yet. note the file path and hash, then check that hash against virustotal before you touch anything, since some legitimate but oddly-signed software will trip a naive filter like this. treat the filter as a lead generator, not a verdict.

the takeaway

persistence is malware's one unavoidable requirement, and that requirement is also its biggest weakness. it has to register somewhere, and autoruns already knows every one of those somewheres. you don't need to be a forensics expert to run this scan, you just need to know how to cut the signal out of the noise. run it on your own systems every so often, keep an eye out for unsigned binaries hiding in temp folders wearing familiar names, and you'll catch the stuff that quietly slips past your antivirus.