Malware Persistence¶
Malware wants to survive a reboot, so it registers itself somewhere Windows will start it automatically. Those places are finite. Check each one and anything unfamiliar is a lead.
Startup entries¶
Task Manager → Startup apps tab shows the common ones. The full list:
Get-CimInstance Win32_StartupCommand | Select Name, Command, Location
The registry run keys, by hand:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
And the Startup folders: press Win+R and open shell:startup and shell:common startup.
For each entry: what does it run, and where is that file? A value named WindowsUpdate that runs C:\Users\bob\AppData\Roaming\svchost.exe is malware using a familiar name.
Scheduled tasks¶
Get-ScheduledTask | Where State -ne Disabled | Select TaskName, TaskPath, State | Sort TaskPath
Windows and Microsoft applications create many tasks, mostly under \Microsoft\. Look at anything in the root \ folder or with a name that doesn't match a program you know. Open it in taskschd.msc and read the Actions tab. A task that runs PowerShell with an encoded command, or runs something from a Temp folder, is a finding.
Services¶
Get-CimInstance Win32_Service | Select Name, DisplayName, PathName, StartMode, State | Sort Name
Look at the PathName column. A service whose executable is in a user folder, C:\Windows\Temp, or C:\ProgramData with a random name doesn't belong. So does one with a blank or nonsensical description.
Running processes¶
Task Manager → Details tab, or:
Get-Process | Select Name, Id, Path | Sort Name
Right-click a suspicious process → Open file location. Two patterns to know:
- A process named like a Windows component (
svchost.exe,csrss.exe,lsass.exe) running from anywhere other thanC:\Windows\System32. - A process with a name one letter off from a real one (
svch0st.exe,explore.exe).
WMI subscriptions¶
A less common hiding place:
Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
On a clean machine both return nothing or only Microsoft entries.
Hosts file¶
C:\Windows\System32\drivers\etc\hosts maps names to addresses before DNS is consulted. Malware adds entries to redirect antivirus update sites or banking sites. Open it as administrator:
notepad C:\Windows\System32\drivers\etc\hosts
Everything should be commented out with #. An entry that sends windowsupdate.com or google.com somewhere else is malicious.
Autoruns¶
If the rules allow bringing tools in, Microsoft's Autoruns shows every startup location on one screen and can hide Microsoft-signed entries so the odd ones stand out. It does everything on this page in one pass.
Example¶
Get-ScheduledTask shows a task named Updater at the root, State Ready. Its action is powershell.exe -enc SQBFAFgAIAAo.... The -enc argument is a base64-encoded command, which nothing legitimate on a workstation does from a scheduled task. Disable the task, decode the command to see what it does ([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String("..."))), find the file it points to, and remove both.