2

I ran "autoruns" from Windows Sysinternals on a Windows 10 machine, and noticed that the Windows Defender services were marked in red colour, and did not have verified signatures. I checked these services on another machine and found that they were all verified as expected.

Does this mean the Windows Defender on my machine is malware? If so, how can I remove it and reinstall a clean Windows Defender? Running the thorough offline-scan did not help.

screenshot

1
  • 1
    Check using sigtool64 or right click and use “Properties” in explorer. It’s possible that autoruns isn’t correctly handling the signing mechanism. I would expect Defender to be signed.
    – David
    Jan 25 '20 at 23:14
4

No, it is normal for legitimate applications to appear as "not verified" in autoruns.exe. In my experience, this is normal behaviour and I have seen other legit applications that didn't appear as digitally signed. I wouldn't worry too much about what autoruns tells me if I were you.

This is why malware analysis makes use of various tools, either for static or dynamic analysis. There needs to be a much more detailed "inspection" of the characteristics and behaviour of the application to reach a verdict.

Here is a screenshot from my machine, to put your mind at ease: enter image description here

What you CAN do, is to create some sort of 'saved state', to compare your system with at a later time, and possibly detect how a malware gains persistence. Remember, if you eliminate a malware's persistence, then you've 'theoretically' eliminated the malware:

  1. Run autoruns.exe on a "clean" system and let it finish. (If you suspect your system is already infected with malware, then this process won't help you).
  2. Click on File -> Save, and then save the .arn file.
  3. When at some point you suspect that you have been infected by some malware, then run autoruns.exe again and when it finishes, go to File -> Compare and load the .arn file from step 2. If you notice some dodgy Registry entry that you can be certain it is not legitimate, then you can safely delete it.

However, this doesn't mean that you'll always be able to see the auto-start registry entry (e.g. see persistence through RunOnceKey, rootkit driver infection, etc). Nevertheless, it might help sometimes.

3

No, Defender is digitally signed. You can check the image by opening its properties in Explorer and check it manually. I found that it is a bug, but Microsoft hasn't fixed it yet.

1
  • 1
    yep, it's a bug in autoruns where they flag as "unverified" if it's been signed by Microsoft but is not in a protected system folder.
    – pcalkins
    May 26 '20 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.