Some applications start automatically with Windows through startup entries. This is legitimate for many programs, but malware can abuse the mechanism to stay active after a reboot.
What HKCU Run is
The HKCUSoftwareMicrosoftWindowsCurrentVersionRun path can associate commands with user sign-in. A value name alone does not prove malicious intent.
The Helper indicator
In the reproduced MAYUNDO scenarios, a RunHelper entry was observed as part of the chain. This mechanism made checking the removable drive alone insufficient.
Why indiscriminate manual removal is risky
Deleting registry values at random can interrupt legitimate programs. Before changing startup settings, identify the command, the target file and other indicators, and preserve suitable evidence or recovery points.
ANTÍDOTO validation
In V1.6.3 lab testing, removal of the observed persistence was confirmed and the rescan completed without that known chain. In real cases, newly encountered indicators require fresh analysis.
Related reading
- Formatted the USB drive but it returned? MAYUNDO may persist in Windows
- Windows ↔ USB reinfection: understanding a MAYUNDO-related chain
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.