Skip to content

fix(windows): delete autostart script — it looked like malware and froze Settings>Network#1608

Open
joelteply wants to merge 2 commits into
canaryfrom
fix/windows-no-malware-autostart
Open

fix(windows): delete autostart script — it looked like malware and froze Settings>Network#1608
joelteply wants to merge 2 commits into
canaryfrom
fix/windows-no-malware-autostart

Conversation

@joelteply

Copy link
Copy Markdown
Contributor

Summary

Deletes tools/scripts/windows-setup-autostart.ps1. The script registered a ContinuumWSL SYSTEM-level scheduled task that fired wsl.exe at boot, which:

  1. Popped a visible terminal window on every login — the malware playbook signature.
  2. Spun up the vEthernet (WSL) virtual adapter before NlaSvc/WMI had finished enumerating the real Wi-Fi adapter, causing Win11's Settings → Network page to freeze on a stalled WCM provider query. Reproduced twice on a fresh HP Omen 5090 with Wi-Fi 7 silicon.
  3. Started tailscaled + sshd + postgres + nvidia-smi probes at boot as SYSTEM, which is hostile install behavior whether or not the intent was legitimate.

The script's intent was a legitimate "make this box reachable via SSH/Tailscale after a reboot" — but the implementation pattern is indistinguishable from malware to a security-conscious operator. Perception matters. Silent SYSTEM-level scheduled tasks that pop terminals and bring up virtual adapters on every boot erode trust in the project even when the code is benign.

The replacement (for anyone who actually wants WSL services on boot): use Microsoft's built-in wsl.conf [boot] mechanism inside the WSL distro itself. No Windows-side scheduled task. No console window. No SYSTEM privileges.

# /etc/wsl.conf inside the distro
[boot]
command="service ssh start && tailscale up --ssh"

Existing installs — cleanup

Anyone who already ran the script can clean up via:

Unregister-ScheduledTask -TaskName ContinuumWSL -Confirm:$false
wsl --shutdown

Reboot. Settings → Network unfreezes.

Test plan

  • No references to windows-setup-autostart.ps1 anywhere else in the tree
  • Deleting the file does not break any documented install flow (it was never wired into install.ps1)
  • Confirm Settings → Network no longer freezes on the reproducing 5090 box after cleanup

🤖 Generated with Claude Code

joelteply added a commit that referenced this pull request Jun 11, 2026
…-audit.ps1)

Companion to PR #1608. One read-only script the operator runs as admin
on any Windows box to surface EVERY autostart vector in one pass:

  1. Scheduled tasks with logon/startup/boot triggers
  2. HKLM + HKCU Run / RunOnce / WOW6432Node Run keys
  3. User + system Startup folders
  4. Auto-start services filtered to non-Microsoft paths
  5. Win32_StartupCommand (Task Manager Startup view)
  6. Currently running cmd.exe / powershell.exe / wsl.exe / airc.exe
     / continuum* processes with parent + command line

Then prints a section 7 'kill suggestions' block matching airc / continuum /
wsl / cargo / tailscale signatures — operator copies the unwanted entries
to remove them. Read-only by default; no remediation without explicit
operator paste.

Why: the malware-perception PR (#1608) deleted the one autostart script
in source, but machines that already ran historical versions still have
ContinuumWSL or related entries persisting. Without an audit script,
operators have to manually grep Task Scheduler / regedit / startup folders.
This makes finding-and-killing leftovers a single command.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
joelteply and others added 2 commits June 15, 2026 15:29
…STEM scheduled task that froze Settings>Network on boot

The script registered a 'ContinuumWSL' SYSTEM-level scheduled task that
fired wsl.exe at boot, which:

1. Popped a visible terminal window on every login (malware signature).
2. Spun up the vEthernet (WSL) virtual adapter before NlaSvc/WMI had
   finished enumerating Wi-Fi, causing the Settings -> Network page to
   freeze on a stalled WCM provider query. Reproduced twice on a fresh
   HP Omen 5090 with Wi-Fi 7 silicon.
3. Ran tailscaled + sshd + postgres + nvidia-smi probes at boot as
   SYSTEM, which is hostile install behavior whether or not the intent
   was legitimate.

Perception matters. Silently dropped SYSTEM scheduled tasks that pop
terminals and bring up virtual adapters on boot are indistinguishable
from malware to a security-conscious user, and they erode trust in
the project even when the code is benign.

Anyone who actually wants WSL services on boot should use Microsoft's
built-in wsl.conf [boot] mechanism inside the WSL distro itself —
no Windows-side scheduled task required, no console window, no
SYSTEM privileges.

Existing installs can clean up via:
  Unregister-ScheduledTask -TaskName ContinuumWSL -Confirm:$false
  wsl --shutdown

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…-audit.ps1)

Companion to PR #1608. One read-only script the operator runs as admin
on any Windows box to surface EVERY autostart vector in one pass:

  1. Scheduled tasks with logon/startup/boot triggers
  2. HKLM + HKCU Run / RunOnce / WOW6432Node Run keys
  3. User + system Startup folders
  4. Auto-start services filtered to non-Microsoft paths
  5. Win32_StartupCommand (Task Manager Startup view)
  6. Currently running cmd.exe / powershell.exe / wsl.exe / airc.exe
     / continuum* processes with parent + command line

Then prints a section 7 'kill suggestions' block matching airc / continuum /
wsl / cargo / tailscale signatures — operator copies the unwanted entries
to remove them. Read-only by default; no remediation without explicit
operator paste.

Why: the malware-perception PR (#1608) deleted the one autostart script
in source, but machines that already ran historical versions still have
ContinuumWSL or related entries persisting. Without an audit script,
operators have to manually grep Task Scheduler / regedit / startup folders.
This makes finding-and-killing leftovers a single command.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@joelteply joelteply force-pushed the fix/windows-no-malware-autostart branch from a900bc8 to 0ca5e52 Compare June 15, 2026 20:30
@joelteply joelteply changed the base branch from main to canary June 15, 2026 20:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant