Hacker News Reader

Comment by rkagerer | Hacker News Reader

SysJoker will create persistence by adding an entry to the registry run key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

I regularly run tools like Autoruns to disable unwanted new entries in places like this. These days it's more of a problem for me with regular software than it is malware.

Unfortunately locking down the registry key can break legitimate installers.

Does anyone know of a decent utility that monitors for changes in the background and notifies you via an unintrusive little icon in the system tray (no balloons) which you can click when convenient to review the offenders?

Have also contemplated a process "whitelist" that allows you to whitelist regular programs (maybe it has a mode you can run for a time where it learns automatically) and let's you easily view stuff running that you don't recognize.

View on HN

I know your question is for Windows, but in case someone was wondering about MacOS:

Aside from being able to manage some persistent login items under Settings > Users > Login Items, there is a free tool available from Patrick Wardle that helps manage the hidden launch items (like updaters) on MacOS called Knock Knock.

https://objective-see.com/products/knockknock.html

Also recommended by the same developer: BlockBlock

https://objective-see.com/products/blockblock.html

Have you checked how many users are running on Windows though?

Its all very well checking _your__own_ HKCU keys, but what if the persistent entry was setup in another window user account??? That point isnt made obvious on that website link!

On Win10 how many people can easily see the Administrator (500), DefaultAccount (503), Guest(501) & WDAGutilityAccount (504) and checked their metrics???

Who checks their services are all genuine?

There are loads of place to run apps at system startup besides the registry. This link shows you where you can autorun apps buts it was written in 2016 and I think there are now a few more places where you can autorun at startup. https://www.ghacks.net/2016/06/04/windows-automatic-startup-...

You could also piggy back off another common utility if you know how to delta patch an app, or even use a driver if you can get in that deep without arousing any suspicion!

The next problem is trying to avoid getting picked up by the AV/malware running, unless your group policy doesnt allow anything to run other than what is allowed in the group policy.

Havent tried this on home in win10 but it might/should work https://www.howtogeek.com/howto/8739/restrict-users-to-run-o... Basically in Pro and above you can use group policy to restrict windows so it only runs allowed programs, then you are in the same situation as Linux users.

Depending on your exact use case checkout

- MJ Registry Watcher

- RegShot

- Or monitor yourself with some WMI query

Windows 11 does notify the user when a program registers itself to run at startup.

How it took Windows 30 years to do this is beyond me

Does Linux? OSX? There's a hundred and one different ways to get Windows to run something at boot, even as an unpriviliged user. So it's not as simple as just monitoring HKCU\..\Run. With Linux at least it's somewhat more limited: Unpriviliged users typeically only have access to cron for running things at boot.

"Does Linux" is a pretty broad question. Most distros nowadays will require you to manually enable systemd services you install though.

I think this is more like adding lines to /etc/profile.d or .bashrc than adding a service. Linux has a pretty complicated flow if you want to know what runs on login or on startup.

If the application choses to do so. Installation used to require root and I don't see a way who root could prevented from be enabling a systemd service. Short of having a signed read-only rootfs which no common distro has.

Nowadays you don't even need root to install something that runs a every login: There is the user instance of systemd. Of course without root those services are limited in what they can do.

I used to use WinPatrol from BillP Studios, but it seems to no longer be up.

Reply on news.ycombinator.com