Analysis of a large number of startup locations

Virtually any malware has to firmly settle in a system after intrusion, thus infecting it to be able to load itself during subsequent system or browser startups. Malicious software performs the following actions for this purpose:

  • Uses special locations in the Windows registry for automatic loading
  • Register as system or browser components, becoming their “integral” part
  • Uses special startup folders that allow applications to start upon users’ login into the system

Startup

Registry

CESAM analyses over 100 locations used by malware to start automatically on your computer.