Analysis of a large number of startup locations
Virtually any malware has to firmly settle in a system after intrusion, thus infecting it to be able to load itself during subsequent system or browser startups. Malicious software performs the following actions for this purpose:
- Uses special locations in the Windows registry for automatic loading
- Register as system or browser components, becoming their “integral” part
- Uses special startup folders that allow applications to start upon users’ login into the system
CESAM analyses over 100 locations used by malware to start automatically on your computer.




