Sophia, a forensic expert, is analyzing a system for signs of malware.

Option C. Autoruns is the best answer because the question is specifically about identifying services and other components configured to start automatically during boot . In CHFI-style Windows forensics and malware persistence analysis, investigators focus on auto-start mechanisms , including services, registry run keys, startup folders, drivers, scheduled tasks, and related launch points. Autoruns is designed to enumerate these persistence locations in a comprehensive way, making it the most appropriate tool among the options.

Event Viewer is useful for examining logs and system events, but it is not the primary tool for enumerating all boot-start and auto-start entries. Task Manager can show currently running processes and some startup items, but it is less complete than Autoruns for deep persistence analysis. Process Explorer is excellent for analyzing active processes and parent-child relationships, yet it is not focused on full startup enumeration.

Because Sophia wants to identify which Windows services are configured to start automatically , the most effective forensic tool is Autoruns , which directly supports malware persistence investigation and startup analysis.