TABLE OF CONTENTS Process Explorer and Autoruns are powerful, full-featured programs in their own right, but they synergistically complement one another when used together. This is definitely a case where the sum of the parts is greater than the whole. This is why I have branded them as The Dynamic Duo.
Now that we have discussed the features available in Autoruns and Process Explorer, it is time to see how you can use them effectively to troubleshoot nonessential startups and combat malware. I am going to list some requirements for using Autoruns and Process Explorer in combination. This way you may follow along with some of the examples I present and get accustomed to using the programs. The examples will increase in difficulty as we progress.
The following list of the items will help you follow along with the examples that are presented in this section:
Active Internet connection to perform searches
Both Autoruns and Process Explorer open
Separate browser windows open to two startup databases
The Bleeping Computer startup database (www.bleepingcomputer.com/startups)
The CastleCops startup list (www.castlecops.com/StartupList.html)
A text file containing links to the relevant research databases
The Bleeping Computer startup database contains links to research databases, which we will use to investigate startups and processes in our troubleshooting examples. This file is also posted at the Syngress Web site under the filename Researchdb.doc. I have posted the database links here as well so that we may...
