first -> here are this utility tool download site:autoruns

摘錄自:http://edu.uuu.com.tw:80/data_article/article/080422tips.htm

作　　者：唐任威 精誠資訊恆逸教育訓練中心資深講師
技術分類：資訊安全

相信大家都曾經有過電腦中毒的經驗，也相信大家都遇過中毒時掃毒軟體不管用的時刻，那...這個時候怎麼辦呢！？自己動手搞定！是每個IT專家都會做的事情，但工欲善其事、必先利其器的道理是不變的，可是有那些好用的小工具可以協助我們獵殺惡意程式呢？

基本上所有的惡意程式在植入到受害者的電腦後，都一定會找一個方法，讓電腦重新開機時，惡意程式可以自動啟動。也因此只要可以破解惡意程式自動啟動的方法，那麼惡意程式移除的工作就算已經完成一半了。可是問題在於Windows環境中，可以伴隨著作業系統啟動而順帶啟動程式的設定不下百種，假如一個一個檢查，那要檢查到什麼時候呢？況且設定那麼多，也不知道到底有那些設定是可以用來自動啟動程式的，因此對於IT專家來講，這種作法似乎不太可行～

不過所幸的是，Windows大師—Mark Russinovich跟他的好朋友—Bryce Cogswell已經為我們提供了一個好用的工具，那就是—Autoruns。基本上Autoruns這個工具可以將Windows環境中所有用來自動啟動應用程式的設定全部都列出來，藉此IT專家就可以自行判斷那些自動啟動程式的項目是可疑的，然後加以清查、而後清除。Autoruns這個工具有二個版本—圖形版與指令版，在這次的Tips中，我們將以圖形版的使用方式為主。

Autoruns的下載網址為：http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx 或者直接在Google打Autoruns也可以找到。程式一開使執行時，會先掃瞄系統中所有程式的啟動項目，取決於項目的多寡可能會花費30秒～5分鐘，假如希望中斷掃瞄作業，則可以利用鍵盤上的[ESC]按鍵中斷程式的掃瞄作業。 底下是原作者介紹該工具原文 AutoRuns for Windows v9.13 By Mark Russinovich and Bryce Cogswell Published: February 26, 2008   Introduction This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP. Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc. You'll probably be surprised at how many executables are launched automatically! Autoruns works on all versions of Windows including 64-bit versions. Usage See the November 2004 issue of Windows IT Pro Magazine for Mark's article that covers advanced usage of Autoruns . If you have questions or problems, visit the Sysinternals Autoruns Forum. Simply run Autoruns and it shows you the currently configured auto-start applications as well as the full list of Registry and file system locations available for auto-start configuration. Autostart locations displayed by Autoruns include logon entries, Explorer add-ons, Internet Explorer add-ons including Browser Helper Objects (BHOs), Appinit DLLs, image hijacks, boot execute images, Winlogon notification DLLs, Windows Services and Winsock Layered Service Providers. Switch tabs to view autostarts from different categories. To view the properties of an executable configured to run automatically, select it and use the Properties menu item or toolbar button. If Process Explorer is running and there is an active process executing the selected executable then the Process Explorer menu item in the Entry menu will open the process properties dialog box for the process executing the selected image. Navigate to the Registry or file system location displayed or the configuration of an auto-start item by selecting the item and using the Jump menu item or toolbar button. To disable an auto-start entry uncheck its check box. To delete an auto-start configuration entry use the Delete menu item or toolbar button. Select entries in the User menu to view auto-starting images for different user accounts. More information on display options and additional information is available in the on-line help. Autorunsc Usage Autorunsc is the command-line version of Autoruns. Its usage syntax is: Usage: autorunsc [-a] | [-c] [-b] [-d] [-e] [-g] [-h] [-i] [-l] [-m] [-p] [-r] [-s] [-v] [-w] [user] -a Show all entries. -b Boot execute. -c Print output as CSV. -d Appinit DLLs. -e Explorer addons. -g Sidebar gadgets (Vista and higher) -h Image hijacks. -i Internet Explorer addons. -l Logon startups (this is the default). -m Hide signed Microsoft entries. -p Printer monitor drivers. -r LSA providers. -s Autostart services and non-disabled drivers. -t Scheduled tasks. -v Verify digital signatures. -w Winlogon entries. user Specifies the name of the user account for which autorun items will be shown.