In my view it has the potential to surpass Hijackthis!, as well as AutoRuns.
In beginner mode, it runs like Hijackthis! and allows simple posting of txt logs. There is an added feature of allowing exporting of a binary "run" file.
The idea here is that the novice sends the "run" file to the expert. The expert loads it up via runscanner, marks entries that are bad, and reexports the run file.
The beginner then runs that "run" file in runscanner, and the entries that have being marked bad by the expert will be automatically indicated and marked in runscanner.
In expert mode it is very much useful than Hijackthis! in helping power users.
The main problem with RunScanner is that it lists a *lot* of locations (one of the most comprehensive since it draws from various sources and lists), but this makes it difficult for even an expert to handle.
As such it borrows from autoruns the smart feature of being able to filter out microsoft signed files (since these are almost always safe).
In addition you can also choose to filter out signed files. Altough in theory signed code doesn't mean that you can automatically
trust it (it depends on whether you trust the signer), in practice malware usually isn't signed.
Lastly, you can filter out entries that are whitelisted marked safe in RunScanner's own online database. There are plans to expand this to support free online sources like the databases at Castlecops, maybe even Fileadvisor.
There is also an added function to upload your logs online, but IMHO this function is not very useful, because it doesn't add any useful information. It does however give you a "secret" url, that you can give to an expert, who wants to review the log. Also, unknown entries are periodically monitored and checked by RunScanner experts and if safe are whitelisted.
Other feature like a quick jump to the registry entry, smart formatting of google queries for searching entries, are also similar to Autoruns.
Autoruns also has a ton of other features, including host files listing, process listing and killing abilities (you can kill several mutually protecting processes simultaneously) but they are not as well developed as say Process Explorer obviously.
It is also just one tool in the arsenal, for example it doesn't do Ad streams, port mapping, and like any normal tool it is easily fooled by rootkits (autoruns is slightly less vulnerable).
The main concern with RunScanner is that it is still a fairly immature tool, and is less well tested than older tools like Hijackthis.
So it is likely there might be more bugs.
But as it becomes more popular (a couple of tech forums like geektogo have started to test it), this problem should be reduced.
