Tag Info

New answers tagged


New services, programmed tasks, shell extensions, DLLs, program modules… The list of autostart ways in Windows is huge, see sysinternals autorun for those available just in the OS. Plus the secret rootkit that you had no idea it had been installed. I would only consider cleaning a production machine instead of reimaging if working with a lack of equipment ...


Even though this is an older question, I believe this will be relevant and added value. So, here it goes. Assuming an NTFS file system, the $UsnJrnl and $Logfile record changes made to the file system. File creation can be detected through these artifacts. There are many articles online that explain this process and the tools better than I can. However, I ...

Top 50 recent answers are included