Autoruns v12.0: This release of Autoruns, a Windows application and command-line utility for viewing autostart entries, now reports the presence of batch file and executable image entries in the WMI database, a vector used by some types of malware.
http://blogs.technet.com/b/sysinternals/archive/2014/05/13/updates-autoruns-v12-0-procdump-v7-0.aspx