Windows AutoRuns JavaScript MSHTML

Info Nessus Plugin ID 80887


Report JavaScript running on startup.


Reports if one of the autorun keys in the registry is using the JavaScript MSHTML technique to allow startup actions. This technique is not common in most software and has been shown to be used by malware to perform persistence without having a file on disk.

The detection of this technique does not imply that the remote host has a malware infection, but an administrator should verify.



See Also

Plugin Details

Severity: Info

ID: 80887

File Name: windows_autoruns_javascript_mshtml.nbin

Version: $Revision: 1.98 $

Type: local

Agent: windows

Family: Windows

Published: 2015/01/21

Modified: 2018/03/13

Dependencies: 70621, 70627

Risk Information

Risk Factor: Info

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated, war/setup/ran