I added auto-run scanning support to version 1.1 of FirstOnScene, which is now available here. The auto-run feature scans the registry and file system for known auto-run facilities that are commonly used by trojans. It's an option that you have to invoke by specifying “/autoruns” on the command line. For more information about this feature, see this blog entry. AutorunScanner is a stand-alone version of the /autoruns feature in FirstOnScene. The core code is identical.
I also changed the execution order when calling for a dd image of the system memory with the /m option. It now runs first thing, when requested. This way, the memory scan will happen first, instead of last, where it was making an image of memory that my 20 tools just got done splashing around in (forensically speaking). Hopefully this will make the feature more useful.
Seems like I did something else, but I can't remember what. It's bedtime.