TABLE OF CONTENTS When you know your computer is clean and is running well, you should establish a baseline for your system so that you can take advantage of Autoruns File Compare feature. File comparison automatically flags autostart differences that have occurred over time. You can thoroughly research these differences to determine their cause and to rule out a malware association.
Here are the steps to follow to compare files:
Take a baseline snapshot of your system startups by selecting File Save, in the Autoruns menu.
Change the default filename to one that includes a date stamp so that the file is permanently saved.
To see whether malware may have been added, select File Compare to compare the current log to the earlier baseline snapshot.
Determine to what the file comparison differences are attributable.
Remove any unwanted program startups and their associated program components.
Symantec has compiled a list of the most common autostarts used to launch malware programs. These autostarts do not represent the most common startups used by legitimate programs. Rather, many of these autostarts are selected to be obscure, to thwart currently used detection and removal techniques.
HKEY_CURRENT_USER\Software\Microsoft\Windows\_CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\_CurrentVersion\Windows
HKEY_CURRENT_USER\Software\Microsoft\Windows\_CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\_CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\_CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\_CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\_CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\_CurrentVersion\Windows
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\_CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\_CurrentVersion\Windows\AppInit_DLLs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\_CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\_CurrentVersion\Explorer\SharedTaskScheduler
HKEY_CLASSES_ROOT\comfile\shell\open\command
HKEY_CLASSES_ROOT\piffile\shell\open\command
HKEY_CLASSES_ROOT\exefile\shell\open\command
HKEY_CLASSES_ROOT\txtfile\shell\open\command
The following two malware autostart locations are listed by clicking the Explorer tab in Autoruns:
Shell Object Delay Load:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\_ShellServiceObjectDelayLoad
Shell Execute...
