Windows sysinternals

Chapter 5 Autoruns 159
for Svchost services, Autoruns displays the path to the target DLL identified by the ServiceDll
value in the service’s key or its Parameters subkey. There are cases for some services in some
versions of Windows where administrative rights are required to view the Parameters key; in
these cases, Autoruns displays the path to Svchost.exe in the image path column.
Be certain you know what you are doing when disabling or deleting services. Missteps can
leave your system with degraded performance, unstable, or unbootable. And again, note that
disabling or deleting a service does not stop the service if it is already running.
One malware technique to watch for is a service that looks like it’s supposed to be part
of Windows but isn’t, such as a file named svchost.exe in the Windows folder instead of in
System32. Another technique is to make legitimate services dependent on a malware service;
removing or disabling the service without fixing the dependency can result in an unbootable
system. Autoruns’ Jump To feature is handy for inspecting service dependencies in the
registry before making changes.
Drivers
Drivers are also configured in the subkeys of HKLM\System\CurrentControlSet\Services,
but they run in kernel mode, thus becoming part of the core of the operating system. Most
are installed in System32\Drivers and have a .sys file extension. Drivers enable Windows to
interact with various types of hardware, including displays, storage, smart card readers, and
human input devices. They are also used to monitor network traffic and file I/O by antivirus
software (and by Sysinternals utilities such as Procmon and Procexp!). And, of course, they are
also used by malware, particularly rootkits.
As with services, the Drivers tab displays drivers that are not marked as disabled, except
those disabled through Autoruns. The Description value comes from the version resource of
the driver file, and the image path points to the location of the driver file.
Most blue-screen crashes are caused by an illegal operation performed in kernel mode, and
most of those are caused by a bug in a third-party driver. (Less common reasons for blue
screens are faulty hardware, the termination of a system-critical process such as Csrss.exe, or
an intentional crash triggered through the keyboard driver’s crash functionality, as described
in Knowledge Base article 244139: http://support.microsoft.com/kb/244139.)
You can disable or delete a problematic driver with Autoruns. Doing so will usually take effect
after a reboot. As with services, be absolutely certain you know what you are doing when
disabling or deleting the configuration of drivers. Many are critical to the operating system,
and any misconfiguration might prevent Windows from working at all.
www.it-ebooks.info