Have you checked how many users are running on Windows though? Its all very well checking _your__own_ HKCU keys, but what if the persistent entry was setup in

Have you checked how many users are running on Windows though? Its all very well checking _your__own_ HKCU keys, but what if the persistent entry was setup in another window user account??? That point isnt made obvious on that website link! On Win10 how many people can easily see the Administrator (500), DefaultAccount (503), Guest(501) & WDAGutilityAccount (504) and checked their metrics??? Who checks their services are all genuine? There are loads of place to run apps at system startup besides the registry. This link shows you where you can autorun apps buts it was written in 2016 and I think there are now a few more places where you can autorun at startup. https://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ https://www.ghacks.net/2016/06/04/windows-automatic-startup-... You could also piggy back off another common utility if you know how to delta patch an app, or even use a driver if you can get in that deep without arousing any suspicion! The next problem is trying to avoid getting picked up by the AV/malware running, unless your group policy doesnt allow anything to run other than what is allowed in the group policy. Havent tried this on home in win10 but it might/should work https://www.howtogeek.com/howto/8739/restrict-users-to-run-only-specified-programs-in-windows-7/ https://www.howtogeek.com/howto/8739/restrict-users-to-run-o... Basically in Pro and above you can use group policy to restrict windows so it only runs allowed programs, then you are in the same situation as Linux users.