Autoruns 13.90

[Solarquest]

What's New (July 5, 2018)


-Autoruns v13.90
Autoruns now includes Runonce*\Depend entries, adds GPO logon and logoff locations, and fixes a bug in WMI path parsing.

 

[conceptualclarity]

Don't see why any serious user would be without Autoruns. I think it's a good idea to get it with the whole Sysinternals Suite. There are also some programs that allow you to get that together with the Nirsoft suite.

 

[TairikuOkami]

Sysinternals Suite

Not very user friendly though. But Autoruns and Process Monitor are irreplaceable.
I prefer NirLauncher - Collection of more than 200 portable utilities from NirSoft

 

[shmu26]

Some of these tools are abused by malware, so I don't see a good reason to have extra tools on your system that you are not using. I think it is better to just take the ones you need. Like Autoruns, for instance.

 

[conceptualclarity]

Some of these tools are abused by malware.

I'm sure it would be interesting to hear you elaborate on that should you see fit.

 

[TairikuOkami]

PsExec and the Nasty Things It Can Do (just as an one example)

This malware also includes the ability to use PSExec on a system it has administrative credentials on, allowing it to execute duplicates of the malware on any system on the network.

Petya-esque ransomware is spreading across the world - Malwarebytes Labs

 

[Yellowing]

Well, if you have an execution prevention software like NVT ERP or ReHIPS you can have those tools on your PC with no worries.

 

[shmu26]

I'm sure it would be interesting to hear you elaborate on that should you see fit.

If you look in the advanced settings of OSArmor, you will see block rules for them. But I don't know the details; I am sure Andreas does, though

 

[shmu26]

Well, if you have an execution prevention software like NVT ERP or ReHIPS you can have those tools on your PC with no worries.

The thing that worries me a little is that if you installed it yourself, and you ran it once or twice just to take a look, you might not get prompts, or you might ignore them, because after all, it is your own "trusted" software.

 

[Yellowing]

The Prompts don't disappear for no reason, but I can see myself clicking them accidentially. You could put the files in a folder with something scary in its name, like: "##WARNING-GHOSTS!##", or, to be sure, put them in a folder with the RTL character, so your anti-virus complains about it too!
I mean something like this: .... Its isn't the filename of a jpg, but of an exe, However the chars get switched because of the RTL char that is between the "h" and the "g" (Yes the last char): sexyh‮gpj.exe

Kaspersky complains about it as a Trojan, which is is to be honest You can't add i to exclusions for it to work, though. And it's a stupid solution.