Windows sysinternals

150 Part II Usage Guide
Files for which signature checks fail might be considered suspicious. A common malware
technique is to install files that on casual inspection appear to be legitimate Windows files.
The Sysinternals Sigcheck utility, described in Chapter 8, “Security Utilities,” provides deeper
detail for file signatures, including whether the file is catalog-signed and the location of the
catalog.
Hiding Microsoft Entries
The default list of ASEP entries is always large because, as mentioned earlier, Windows itself
makes extensive use of ASEPs. Typically, these autostart entries are not of interest when
troubleshooting. Likewise, autostart entries from other Microsoft-published software such as
Microsoft Office are usually not the droids you’re looking for 2 . You can choose to hide these
autostart entries from the display by enabling the Hide Windows Entries or Hide Microsoft
And Windows Entries from the Options menu and refreshing the display by pressing F5. The
Hide Windows Entries option is enabled by default.
The behavior of these options depends on whether Verify Code Signatures is also enabled. If
signature verification is not enabled, Hide Windows Entries omits from the display all entries
for which the target image file has the word “Microsoft” in the version resource’s Company
Name field, and for which the image file resides in or below the %windir% folder. Hide
Microsoft And Windows Entries checks only for “Microsoft” in the Company Name field and
omits those entries. As mentioned earlier, it is easy for anyone to create a program that gets
past this check, so the Verify Code Signatures option is recommended.
If signature verification is enabled, Hide Windows Entries omits entries that are signed with
the Microsoft Windows code-signing certificate. (Windows components are signed with a
different certificate from other Microsoft products.) Hide Microsoft And Windows Entries
omits entries that are signed with any Microsoft code-signing certificate that chains to a
trusted root certificate authority on the computer.
Note Some files that ship with Windows, particularly drivers, are provided by third parties and
have a third-party name in the Company Name field of the file’s version resource, but they are
catalog signed with the Windows code-signing certificate. Consequently, these entries can be
hidden when signature verification is enabled but displayed when verification is not enabled.
The Verify and Hide options are saved in the registry, and they’ll remain in effect the next
time the same user starts Autoruns.
2 Cultural reference: “These aren’t the droids you’re looking for” is a quote from the film, Star Wars IV: A New Hope.
www.it-ebooks.info