RunScanner is a startup and critical area analyzer that is great compliment to antivirus software. Often antivirus will miss left behind virus components. Traditionally, the only way to delete these files was to comb through a program like HijackThis. However, Runscanner makes the process hundreds of times easier for the novice user and expert alike by providing a lot of useful tools that assist a user in finding malware.
The first way that Runscanner improves this process, is that any item that is displayed on the found list, when right clicked, gives the user the option to lookup the suspicious file or process in google, runscanner.net, or process identifier. Once one of these sites is clicked, the suspicious file will be looked up on one of these sites and displayed all known information about the process or file. There is also an option to upload ones whole report file to runscanner.net for analysis. On the test machine, runscanner did an excellent job of flagging all suspicious entries (especially suspicious drivers aka potentially rootkits or keyloggers.) While I don’t have any malware my system, I can assure a user that the RunScanner has by far the best automated capability at identifying malware that I have seen.
The next thing that I liked was that for every item listed, RunScanner attempts to enumerate who is the original publisher of the process and show the signers certificate. This process is helpful in determining if the process or file is an operating system component (Microsoft) or made by a third party.
RunScanner also give the user the ability to essentially save multiple system and startup profiles. Say one is cleaning out their system of viruses and they are not sure about a certain entry, a user can create multiple profiles and progressively test how they affect the system. One top of the profile system there is also a full backup and history area that saves all modifications to the system. This way one can restore any mistakenly deleted entry at any time.
There are a lot of “extra stuff†including all autostart items, process killer, installed software, host file editior, loaded modules and much more. I just want to say something about the autostart items. Malware cannot hide from the user any more with this feature. It shows about 100 different startup points in the registry and is the most comprehensive list I have ever seen.
Runscanner is a must have tool that really expands upon the functionality of HijackThis and brings it into the 21st century. I did run into a few bugs and got an access file error (Windows 7) but overall the experience is worth any type of bug that I experienced.
