Windows sysinternals

Chapter 5 Autoruns 167
include the omitted rows. And if any files had signature verification attempted, the saved file
will retain the results of those verifications.
You can automate the capture of Autoruns data and saving it to a .arn file with the –a
command-line option. The following command captures the state of autostart entries on the
system to outputfile.arn, using default Autoruns options:
Autoruns -a outputfile.arn
To add signature verification, include the –v option. Make sure not to put it between the –a
and the file name:
Autoruns -v -a outputfile.arn
Viewing and Comparing Saved Results
To view the .arn file on the same or another system, choose Open from the File menu and
select the saved file.
To compare the results displayed in Autoruns—whether it’s a fresh capture or from a saved
file—choose Compare from the File menu and select the saved file to compare the displayed
results against. Entries that have changed between the two sets are highlighted in green, as
are any entries that were added in the first set and weren’t found in the “compare” set. Note
however, that items that were deleted aren’t displayed. One workaround that will show these
as well is to save the sets as FileOne.arn and FileTwo.arn, open FileOne.arn and compare
FileTwo.arn, and then open FileTwo.arn and compare FileOne.arn.
AutorunsC
AutorunsC is a console-mode version of Autoruns that outputs results to its standard output.
It is designed primarily for use in scripts. Its purpose is data collection only: it cannot disable
or delete any autostart entries.
The command-line options are listed in Table 5-11. They let you capture all autostarts or just
specific categories, verify digital signatures, omit Microsoft entries, specify a user account for
which to capture autostarts, and output results as comma-separated values (CSV) or as XML.
If you don’t specify any options, AutorunsC outputs just the Logon entries without signature
verification and in an indented list format designed for human reading.
Whether in the default list format, CSV, or XML, AutorunsC’s output always includes the ASEP
location, entry name, description, publisher, image path, and whether the entry is enabled. It
also includes the MD5, SHA-1, and SHA-256 hashes of the image file.
www.it-ebooks.info