Practical Windows Forensics

Auto-run keys

Malware programs usually tend to preserve their existence in the system in case the system was rebooted or different users log on to the system. The following listing shows two important autorun keys that run when the system boots:

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

These locations can host malware that targets the machine itself, such as rootkit, botnet, or backdoor. Other malware executables target some users on the system and run when the specific user or any user logs on to the system.

They can be found in the following locations:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ...