GCIH · Question #708
An administrator is inspecting a machine that starts more slowly than it used to. Which key under HKLM\Software\Microsoft\Windows\ should be examined to determine if malware is executing at startup?
The correct answer is A. CurrentVersion\Run\Micromedia. The CurrentVersion\Run registry key is where programs are registered to execute at every startup, making it a primary persistence location for malware.
Question
An administrator is inspecting a machine that starts more slowly than it used to. Which key under HKLM\Software\Microsoft\Windows\ should be examined to determine if malware is executing at startup?
Options
- ACurrentVersion\Run\Micromedia
- BCurrentVersion\ShellCompatibility\Applications\
- CCurrentVersion\Startup
- DCurrentVersion\RunOnce
How the community answered
(43 responses)- A95% (41)
- B2% (1)
- D2% (1)
Why each option
The CurrentVersion\Run registry key is where programs are registered to execute at every startup, making it a primary persistence location for malware.
The HKLM\Software\Microsoft\Windows\CurrentVersion\Run key contains named value entries for programs that execute at every system startup or user login. Malware frequently creates entries here to maintain persistent execution. The 'Micromedia' portion represents a named value under Run, which is the standard format for startup entries.
CurrentVersion\ShellCompatibility\Applications is used to store application compatibility shim data, not startup execution entries.
CurrentVersion\Startup is not a standard or recognized Windows registry key for configuring startup programs.
CurrentVersion\RunOnce executes a program only a single time at the next startup and then removes the entry, making it unsuitable for persistent malware that needs to survive reboots.
Concept tested: Windows registry Run key startup persistence
Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
Topics
Community Discussion
No community discussion yet for this question.