Autoruns is probably one of the most important tools on any maintenance USB drive. Its ability to detect everything that starts with the operating system is extraordinary, and it plays a critical role in fighting malware. Its latest version is 13.0, and as its main improvement it incorporates VirusTotal support, so each file can be checked against more than four dozen antivirus programs to see how safe it is.
No matter how firmly you control the contents of your computer, there is always something that manages to stay off the radar. The vast majority of items that start with the operating system tend to fall into that category. The msconfig tool shows only a fraction of these items, ignoring details such as scheduled tasks, drivers, codecs, Internet Explorer plugins, and executions before the graphical environment. Fortunately, we have a powerful ally. It's called Autoruns, and together with Process Explorer and Process Monitor it forms the best combo of software developed by the folks at Sysinternals, ex Winternals since Microsoft bought the company in 2006. Autoruns is free, doesn't need to be installed, and with sufficient privileges it can remove even the darkest entry, completely affecting or interrupting the operation of many malware variants.
What’s New in Autoruns 13
Last Thursday, Sysinternals published a new update for Autoruns, effectively reaching version 13.0. The general functionality of the program remains intact, but we should still consider version 13 as a major update for one simple reason: Autoruns now has integrated VirusTotal support. If there is a stable internet connection available, all the user has to do is right-click on the main window and select “Check VirusTotal”. In less than a minute, each entry will be updated with the VirusTotal score, indicating how high the chances are that the file is actually malicious.
Occasionally, VirusTotal can give a false positive, but what we're looking for here are low numbers: if there are one or two alerts out of a total of fifty antivirus programs, it's most likely safe anyway.
In short, a fabulous tool has just become even better. Previously, analyses on VirusTotal had to be done manually, but with the help of Autoruns 13, that is no longer the case. As for the rest, let's say Autoruns needs no introduction. While it is an advanced program that no novice should touch without informing themselves first, that doesn't change the fact that it deserves a privileged place on any maintenance platform.
