They are in the system logging keystrokes, taking screen shots at periodic intervals and uploading them to a command and control server, or doing other nefarious things.
Microsoft wants to limit malware's ability to do that, which is part of the reason why the company introduced a new alert to the latest Windows 10 build that will let users know anytime an app registers itself to run automatically at startup.
It's not just malware, by the way. There are all sorts of perfectly legitimate apps that are designed to run at startup. While it might not matter if you've got two or three apps churning quietly in the background, over time it can begin to get a little out of control and the net effect of all those apps running will invariably begin to degrade the performance of your system.
The new alert system is designed to work hand in hand with the company's Potentially Unwanted App feature. So now when you get an alert, if you click on it, you'll be taken to a screen that shows you what the app is, and you'll have an option to block both unwanted apps and unnecessary downloads.
This is a really good, surprisingly simple fix. Microsoft has been known to over-engineer solutions to problems, but this one is simple and elegant. In addition to that, it addresses an issue that impacts a tremendous percentage of users, but mostly manages to stay below the radar. In our book that's amazing.
While the Redmond Giant has certainly had their share of stumbles and PR gaffes, this isn't one of them. It's a great new addition. Kudos to Microsoft for making the change.