Step 15. ★ Project: What Happens After Boot? — A Full Survey of Auto-Start Locations
Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 3–4 hours
Prerequisite: Step 14 complete. We will work in Windows PowerShell. A comprehensive project combining the investigation techniques from Steps 11–13. Today we query only — we do not delete or change anything we find.
- What you need: a Windows PC, PowerShell, Notepad. Nothing new gets installed.
- Caution: today’s rule is just one — look only. Even if you find something that looks suspicious, do not delete it — the reason is covered in Wall 5. The deliverable is a single document, "a list of my computer’s auto-start locations," the same kind of artifact a real security audit produces.
In the few minutes between pressing the power button and the screen coming up, dozens of programs inside your computer automatically arrive at work. Antivirus, cloud sync, sound drivers… all registered on the "run automatically at boot" roster. And uninvited guests can slip into that roster. For malware to survive a reboot, it must register somewhere — and those registration places are well known. Today is a full survey: we visit all of them as a four-piece set.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Explain what persistence is and why attackers use "doors that already exist"
- Enumerate the four auto-start locations (Run keys, Startup folder, scheduled tasks, automatic services) and query each
- Perform a first-pass screening using the three outward traits of suspicious entries
- Gather query results through a script and produce a single report document
- Know how to use that document as a "baseline" — the reference point for later comparison
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language & environment | PowerShell 5.1 + Run dialog (Win + R) + Notepad |
| Today’s commands | shell:startup (open the Startup folder), Get-ScheduledTask (scheduled tasks); review: Get-ItemProperty ...Run, Get-Service, Out-File -Append |
| Concepts needed | Persistence, the four auto-start locations, baseline documents, the three suspicious outward traits |
| Today’s deliverable | autoruns-report.txt — a document listing my computer’s auto-start roster |
2-1. Persistence — The Technology of Survival
The devices an attacker plants so that even after a reboot, their code runs again on a compromised computer are collectively called persistence techniques. It’s the formal name of what we met as "지속성" in Step 11.
Here’s one important insight: attackers don’t create new doors — they use doors that already exist. Windows already has several legitimate auto-start mechanisms (for updates, antivirus, and the like), and malware slips in through those legitimate doors. Because the best place to hide is "a place where you can pretend to be normal."
So the defender’s logic is equally simple: pull the roster of every door, and ask each entry, "who are you?" That’s what we do today.
2-2. Four Doors — Today’s Investigation Map
| # | Location | Role | How to query |
|---|---|---|---|
| 1 | Registry Run keys | Run programs at login | Get-ItemProperty (Step 11) |
| 2 | Startup folder | Files in this folder run at login | shell:startup |
| 3 | Scheduled tasks | Run on set conditions (time/boot) | Get-ScheduledTask |
| 4 | Auto-start services | Reside in background from boot | Get-Service (Step 13) |
Numbers 1 and 4 you already know. New today are 2 (Startup folder) and 3 (scheduled tasks), and at the end we merge all four into one document.
2-3. What Suspicious Looks Like — Screening Methods in Advance
Before investigating, let’s decide "what we regard as suspicious":
- Random-looking names (
xkqj2.exe,a7f.tmp) — legitimate programs have names - Paths in temporary folders (
Temp,AppDataLocalTemp) — legitimate installs go to Program Files - A program you know, in the wrong location (
C:WindowsTempchrome.exe) — suspected name impersonation
On your computer right now, probably none of these will turn up. That’s good — once you’ve built a list that is "all normal," it becomes a comparison baseline you can use for life.
3. Follow Along
3-1. The First Door — Run Keys (Review + Extension)
What you learned in Step 11, this time across both areas:
Get-ItemProperty "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
Get-ItemProperty "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"
Review points: the top is the current user’s, the bottom is the whole computer’s login auto-run. Malware prefers the lower one once it gains administrator privileges. Note the results — they form the first page of today’s document.
3-2. The Second Door — The Startup Folder
This time it’s a physical place you reach through File Explorer:
Win + R(open the Run dialog)- Type
shell:startup→ OK - A folder opens — files/shortcuts in here run automatically at login
You can also check it from PowerShell:
Get-ChildItem "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartup"
Name
----
Python Viewer Keeper.lnk
Python Viewer.lnk
Synology Drive Client.lnk
(Verified on 2026-09-09. Many computers have this folder empty — empty is normal. The verification computer held shortcuts for a NAS sync program and a development tool.)
Why attackers like it: because you never touch the registry — just copy a single file in and you’re done. An old trick precisely because it’s simple, but still in use today.
Predict this: what happens if you put a Notepad shortcut into this folder? (Answer: Notepad opens by itself at the next login. This is a safe experiment, so if you’d like — copy a Notepad shortcut in, log off, and log back in. Afterward, take it back out. A one-minute experiment for understanding "register it, and it auto-runs" with your whole body.)
3-3. The Third Door — Scheduled Tasks
Windows has a Task Scheduler — an alarm-clock system that runs programs on conditions like "every Tuesday," "at boot," or "when the machine goes idle":
Get-ScheduledTask | Where-Object State -eq 'Ready' |
Where-Object TaskPath -eq '' | Select-Object TaskName
TaskName
--------
Anyang52911-HomeNAS-Backup-4h
Codex Restore AnYang Share
Codex-HomeNAS-Root-Hygiene
NVIDIA app SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
ODIS Cache Auto Cleanup
OneDrive Reporting Task-S-1-5-21-1312351761-2503608414-2748900299-1001
OneDrive Standalone Update Task-S-1-5-21-1312351761-2503608414-2748900299-1001
OneDrive Startup Task-S-1-5-21-1312351761-2503608414-2748900299-1001
Run LG Live Wallpaper
(Verified on 2026-09-09. There were 171 Ready-state tasks in total; this shows only the top-level () ones among them.)
How to read the output: Ready = waiting to run when its condition is met. Tasks whose TaskPath is MicrosoftWindows... (the large majority of those 171 in the verification) are Windows built-in tasks and almost all legitimate, so look at the top-level () ones first.
Let’s practice screening with this real list. The NAS backup and development-tool tasks are easy to clear because their names read plainly. But what about NVIDIA app SelfUpdate_{B2FE1952-...}? A brace-wrapped string that looks random — it hits Section 2-3’s suspicion criteria. Search it, and it turns out to be the NVIDIA graphics driver’s auto-update task. "Suspicious appearance = malicious" is wrong; "suspicious appearance = needs verification" is right — the principle just proved itself on a real computer.
Why do this: scheduled tasks are less widely known than Run keys, so attackers use them when they "want to hide a bit deeper." It’s a location that appears often in recent breach reports.
3-4. The Fourth Door — Auto-Start Services
Step 13 review:
Get-Service | Where-Object StartType -eq Automatic | Measure-Object | Select-Object Count
Count
-----
105
(Verified on 2026-09-09.)
105 services start automatically at boot. Look at the front portion:
Get-Service | Where-Object StartType -eq Automatic | Select-Object Name, DisplayName -First 8
Name DisplayName
---- -----------
AdskLicensingService Autodesk Desktop Licensing Service
ALUpdateService ESTsoft ALTools Update Service
AppXSvc AppX Deployment Service (AppXSVC)
AudioEndpointBuilder Windows Audio Endpoint Builder
Audiosrv Windows Audio
BFE Base Filtering Engine
BITS Background Intelligent Transfer Service
...
How to read it: mostly Windows components and helpers for installed programs. For something you can’t identify from the Name alone, like ALUpdateService, take a hint from the DisplayName (the display name), and if you still don’t know, search.
What suspicious looks like: a plausible DisplayName paired with an odd Name, or something whose identity doesn’t turn up in a search at all. Services reside out of the user’s sight, making them a good hiding place.
3-5. Merging Four Doors into One Document
Now let’s combine the harvest. Paste the script below into Notepad and save it as autoruns-report.ps1 — the encoding must be "UTF-8 with BOM" (a mandatory condition for scripts containing Korean text; Step 9 review):
# 내 컴퓨터 자동 실행 지점 총조사
$out = "autoruns-report.txt"
"=== 자동 실행 지점 조사 보고서 ===" | Out-File $out
"조사 시각: $(Get-Date)" | Out-File $out -Append
"`n[1] 레지스트리 Run 키 (현재 사용자)" | Out-File $out -Append
Get-ItemProperty "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" |
Out-File $out -Append
"`n[2] 시작 폴드" | Out-File $out -Append
Get-ChildItem "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartup" |
Out-File $out -Append
"`n[3] 예약 작업 (Ready 상태)" | Out-File $out -Append
Get-ScheduledTask | Where-Object State -eq 'Ready' |
Select-Object TaskName, TaskPath | Out-File $out -Append
"`n[4] 자동 시작 서비스" | Out-File $out -Append
Get-Service | Where-Object StartType -eq Automatic |
Select-Object Name, DisplayName, Status | Out-File $out -Append
"보고서 완성: $out"
Run it:
.autoruns-report.ps1
보고서 완성: autoruns-report.txt
(Verified on 2026-09-09. The generated report was 332 lines.)
Reading the structure: all pieces you know — variables, Get-Date, Out-File -Append (Step 5), filtering (Step 8), and today’s four query commands. The "`n" is a special character meaning "insert one blank line."
Why is this security-relevant: this report is precisely a baseline document. A month from now, generate it again and compare with today’s. Any new lines are the list of "things installed on my computer in the meantime" — and if there’s a line you have no memory of installing, that’s where an investigation begins. Without something to compare against, even "something strange" looks ordinary. Today’s document is that reference point.
4. Missions & Exercises
Mission — Add Screening Comments to the Report
Let’s upgrade the finished report:
- Open
autoruns-report.txtin Notepad - Skim through each section’s entries, and for things you recognize, mark the end of the line with
← 정상(앎)("known, normal") - For things you don’t recognize, mark
← 확인 필요("needs verification"), then search the name and investigate its identity (most will turn out to be Windows built-ins or programs you installed — that’s normal) - On the last line, write a one-line reflection: something like "Out of N locations totaling M entries, K were unknown; investigation cleared them all as normal"
Exercises
Question 1. What is persistence, and why do attackers use Windows’ built-in mechanisms instead of creating new ones?
Question 2. Enumerate the four auto-start locations and state "when" each one fires.
Question 3. Among 171 scheduled tasks, where is it efficient to start looking, and why?
Question 4. Comparing last month’s report with today’s, one unknown line has newly appeared. State the next sequence of actions.
5. Model Answers & Completion Criteria
Mission Model Answer
An example of the Notepad work (the Startup folder section from the verification computer):
[2] 시작 폴드
Python Viewer Keeper.lnk ← 정상(앎): 개발 도구
Synology Drive Client.lnk ← 정상(앎): NAS 동기화, 내가 설치
The scheduled tasks section:
NVIDIA app SelfUpdate_{...} ← 확인 필요 → 검색 결과 NVIDIA 업데이터로 판명, 정상
OneDrive Startup Task-S-1-5-… ← 정상(앎): OneDrive. 긴 숫자는 내 계정의 고유 번호(SID)
Run LG Live Wallpaper ← 정상(앎): 모니터 부속 프로그램
An example last-line reflection: "Out of 4 locations with about 280 entries, 12 were unknown; investigation cleared them all as normal."
How to verify: once every "needs verification" has its identity established, you’re done. If even one entry remains unidentifiable, searching its name plus "what is" is part of the real investigation procedure. Don’t be discouraged by a long list of unknowns — not even Windows developers know all 171 scheduled tasks. The very fact that "I flagged what I didn’t know and ran the verification procedure" is the audit’s deliverable.
Exercise Answers
Answer 1. Persistence refers to the devices an attacker plants on a compromised computer so their code runs again after a reboot. They use Windows’ built-in mechanisms because "a place where you can pretend to be normal" is the best hiding spot — a brand-new mechanism becomes a trace by its very existence, but one blended into a built-in mechanism gets buried among legitimate entries.
Answer 2. ① Registry Run keys — at login, ② Startup folder — at login, ③ scheduled tasks — when their set conditions (time, boot, idle, etc.) are met, ④ auto-start services — residing in the background from boot.
Answer 3. Start with the top-level tasks (TaskPath = ). Tasks under MicrosoftWindows... are Windows built-ins, mostly legitimate, so they’re low priority; the top level holds things registered by users or programs, making "who registered this?" a question worth asking. In the verification, only 9 of the 171 were top-level, so the workload shrinks dramatically.
Answer 4. Not "discover → delete" but "discover → investigate → judge." ① Record the name and path, ② check whether the path is in a strange location like a Temp family folder, ③ search the name to investigate its identity, ④ use Step 13’s parent tracing to confirm who launches it, ⑤ if still suspicious, run a full antivirus scan. If it’s explainable, record it as normal; if not, that’s when response begins.
Completion Criteria Checklist
- [ ] I can explain what persistence is
- [ ] I can enumerate the four auto-start locations
- [ ] I can open the Startup folder with
shell:startup - [ ] I can query scheduled tasks and know the priority of starting from the top level
- [ ] I can state the three outward traits of suspicious entries
- [ ] I can explain that suspicious appearance is not automatically malicious (the NVIDIA case)
- [ ] Mission: I completed autoruns-report.txt including the screening comments
6. Common Pitfalls & Fixes
Wall 1. There are so many results, I don’t know where to start
Symptom: 171 scheduled tasks alone, plus 105 services (verified on 2026-09-09).
Cause: that’s normal — Windows has many automatic tasks registered by default.
Fix: the goal is not to understand everything but to know where the locations are. Tentatively treat things under Microsoft as normal, and prioritize the unfamiliar ones at the top level — the workload shrinks dramatically.
Wall 2. Get-ScheduledTask throws an error
Symptom: a red error message.
Cause: some system tasks may be restricted from query under ordinary privileges.
Fix: run it from an administrator PowerShell (Step 12). Even then, some may remain invisible — that’s a matter of privilege, not your mistake.
Wall 3. The Startup folder path is hard to memorize
Symptom: typing the long path (AppDataRoaming...) is painful.
Cause: you don’t need to memorize it.
Fix: Win + R → shell:startup is the official shortcut. Inside a script, $env:APPDATA fills in the path regardless of the username — the secret behind why the Section 3-5 script works unchanged on other computers.
Wall 4. Running the script throws a parsing error
Symptom: an error like 문자열에 " 종결자가 없습니다 ("the string is missing the terminator").
Cause: the classic symptom of saving a script containing Korean text as BOM-less UTF-8 (the same problem as Step 9, Wall 5; verified on 2026-09-09).
Fix: in Notepad, use Save As → set the encoding to "UTF-8 with BOM" and save again.
Wall 5. I think I found "something suspicious" and I’m anxious
Symptom: there’s an entry with a name you don’t know, and searching yields only vague information.
Cause: cases genuinely exist where a name alone doesn’t settle the judgment.
Fix: do not delete it. Today’s rule is query only. The sequence is ① check the file path (is it Temp-family, a strange location?) → ② use Step 13’s parent tracing to confirm who launches it → ③ if still suspicious, run a full antivirus scan. "Discover → investigate → judge," not "discover → delete," is the investigator’s order. Accidents of deleting legitimate system files break computers far more often than malware does.
7. Summary
Today’s Core Concepts
| Concept | One-line description |
|---|---|
| Persistence | Registration devices for surviving reboots |
| The four auto-start locations | Run keys / Startup folder / scheduled tasks / automatic services |
| Baseline document | A list of the normal state — the reference point for later comparison |
Investigation Command Summary
| Location | Command |
|---|---|
| Run keys | Get-ItemProperty "HKCU(HKLM):...Run" |
| Startup folder | shell:startup / Get-ChildItem ...Startup |
| Scheduled tasks | Get-ScheduledTask | Where-Object State -eq 'Ready' |
| Automatic services | Get-Service | Where-Object StartType -eq Automatic |
A Sense That Matters More Than Commands
Just remembering the three outward traits of suspicious things — ① random-looking names, ② Temp-family paths, ③ a known name in a strange location — covers most first-pass screening. And as you saw in today’s NVIDIA case, appearance only selects "candidates for verification"; the verdict comes from the verification procedure.
Remember two more things. First, the security industry has a famous classification of attack techniques called MITRE ATT&CK. Open its "Persistence" chapter and you’ll find the locations we toured today organized with item numbers — today you hands-on practiced one chapter of that framework. Second, beyond the four places we investigated today, more auto-start locations exist, and Microsoft’s free tool Autoruns gathers them all onto one screen. In an arms race where attackers use each newly discovered hiding place first and defenders add it to their checklists, what you did today — location listing and a baseline document — is the straight-and-narrow way to close that gap.
Half of security work is investigation; the other half is record-keeping. Keep the document you made today safe. The moment you run the same script next month and compare, this document begins its real work as a baseline.
Once every box is checked, Step 15 is complete.