Manage Autoruns
Start-up items can also have a significant impact on the security of the computer. Some forms of malware will add a start-up item to run in the background which facilitates the execution of key loggers, rootkits, buffer overflows and Denial of Service (DoS) attacks.
To deploy Autoruns Manager tool
- Select 'Remote Desktop' from the 'Deploy Tool' drop-down on the left
A new 'Autoruns Manager' tab will
be created in the main configuration area.
Select the category of the start-up
item from the drop-down at the bottom:
- Startup Applications - Displays the autorun items identified from standard autostart locations such as the Startup folder for all users, the Registry Run keys, and standard application launch locations.
- Services - Displays the modules loaded as Windows Services.
- Drivers - Displays the kernel-mode drivers that are in currently enabled on the system.
- Native Applications - Displays the native system applications that are currently running on the system.
- To
remove a startup application, select it and click the 'Remove'
button at the bottom. The selected item will be removed only from
the startup item. The user will be able to run the application
manually in future.
Selecting 'Services' applications displays Windows Services that are currently loaded in to the system with their current running status, whether the service is digitally signed and the path of the application.
- To
view the start type of a service, select it and the 'Start Type'
drop-down displays its status
- To totally remove a service from the computer, select it and click 'Uninstall'
- To stop a running service, select it and click 'Stop'
- To restart a stopped service, select it and click 'Start'
- To change how a service should start, select it, choose the option from the 'Start Type' drop-down and click 'Apply'.
Selecting Drivers displays the device drivers that are currently loaded into the system with their current running status and whether the driver is digitally signed.
- To remove a driver from the system, select it and click 'Uninstall'
- To start/stop a driver, select it and click the 'Start/Stop' button
To change the way a driver should start, select it and choose the option from the 'Start Type' drop-down
To change the error severity of a driver, select it and choose the option from 'Error' drop-down:
To change the file type of a driver, select it and choose the option from the 'Type' drop-down:
- Click 'Apply' for your changes to take effect
Selecting Native Applications displays the native system applications currently loaded into the system.
- To remove an application, select the item and click 'Remove'.