Results 1 to 6 of 6

Thread: Program Autostart Methods In Windows

  1. #1
    Senior Member
    Join Date
    Jun 2003

    Program Autostart Methods In Windows

    Known program Autostart Methods

    1. Autostart folder

    C:\windows\start menu\programs\startup {english}
    C:\windows\Menu D幦arrer\Programmes\D幦arrage {french}
    C:\windows\All Users\Menu Iniciar\Programas\Iniciar { Portuguese, Brasilian }

    This Autostart Directory is saved in :
    Startup="C:\windows\start menu\programs\startup"

    * [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell
    Startup="C:\windows\start menu\programs\startup"

    * [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell
    "Common Startup"="C:\windows\start menu\programs\startup"

    * [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell
    "Common Startup"="C:\windows\start menu\programs\startup"

    By setting it to anything other then C:\windows\start menu\programs\startup will lead to
    of ALL and EVERY executable inside set directory.

    2. Win.ini

    3. System.ini
    Shell=Explorer.exe file.exe

    4. c:\windows\winstart.bat

    5. Registry







    6. c:\windows\wininit.ini

    'Often Used by Setup-Programs when the file exists it is run ONCE and then is deleted by
    Example content of wininit.ini :
    ' This example sends c:\windows\picture.exe to NUL, which means that it is being deleted.
    This requires no interactivity with the user and runs totaly stealth.

    7. Autoexec.bat

    Starts everytime at Dos Level.

    8. Registry Shell Spawning

    [HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*"
    [HKEY_CLASSES_ROOT\comfile\shell\open\command] @="\"%1\" %*"
    [HKEY_CLASSES_ROOT\batfile\shell\open\command] @="\"%1\" %*"
    [HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @="\"%1\" %*"
    [HKEY_CLASSES_ROOT\piffile\shell\open\command] @="\"%1\" %*"
    [HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @="\"%1\" %*"
    [HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @="\"%1\" %*"
    [HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @="\"%1\" %*"
    [HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @="\"%1\" %*"
    [HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @="\"%1\" %*"
    The key should have a value of Value "%1 %*", if this is changed to "server.exe %1 %*",
    the server.exe
    is executed EVERYTIME an exe/pif/com/bat/hta is executed.

    9. Icq Inet
    This key includes all the APPS which are executed IF ICQNET Detects an Internet

    10. Explorer start-up

    Windows 95,98,ME
    Explorer.exe ist started through a system.ini entry, the entry itself contains no path
    information so if c:\explorer.exe exist it will be started instead of

    Windows NT/2000/XP/2k3
    The Windows Shell is the familiar desktop that's used for interacting with Windows.
    During system startup, Windows NT 4.0 and Windows 2000 consult the "Shell" registry
    NT\CurrentVersion\Winlogon\Shell, to determine the
    name of the executable that should be loaded as the Shell.

    By default, this value specifies Explorer.exe.

    The problem has to do with the search order that occurs when system startup is in
    Whenever a registry entry specifies the name of a code module, but does it using a
    relative path,
    Windows initiates a search process to find the code. The search order is as follows:

    * Search the current directory.
    * If the code isn't found, search the directories specified in
    Manager\Environment\Path, in the order
    in which they are specified.
    * If the code isn't found, search the directories specified in
    in the order in which they are specified.

    More info : http://www.microsoft.com/technet/sec...n/fq00-052.asp
    Patch : http://www.microsoft.com/technet/sup....asp?ID=269049

    General :
    If a trojan installs itself as c:\explorer no run keys or other start-up entries are needed.
    If c:\explorer.exe is a corrupted file the user will be locked out of the system. Affects all
    version as of today.

    10. Active-X Component

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]

    Believe it or not, this does start filename.exe BEFORE the shell (explorer.exe) and any other
    Program normaly
    started over the Run Keys.

    11. Misc Information

    [HKEY_LOCAL_MACHINE\Software\CLASSES\ShellScrap] @="Scrap object"

    The NeverShowExt key has the function to HIDE the real extension of the file (here) SHS.
    This means if you rename a file as "Girl.jpg.shs" it displays as "Girl.jpg" in all programs
    including Explorer.Your registry should be full of NeverShowExt keys, simply delte the key
    to get the real extension to show up.

  2. #2
    Join Date
    Aug 2005
    Great Info

    thanks for that

  3. #3
    I negged you because it seems like you copied it from here:


    next time put the source in where you got it from...don't show it off as your own, i dunno if this was on purpose or not....
    O.G at A.O

  4. #4
    Senior Member
    Join Date
    Jun 2003
    妯py展ght even that's not the original source i was member with www.tlsecurity.net which is
    curently down, i wrote it then, and how the heck can you claim your mentioned address is
    the real source and i as for negative antipoints and don't really care.

  5. #5
    I didn't say that was the source, i said IT SEEMS like you copied it from there....

    as for negative antipoints and don't really care.
    No problems then.
    O.G at A.O

  6. #6
    Join Date
    Sep 2005
    Good one-stop-shop of Windows start info.
    I wonder how many of those autostarts are utilized by some of the more stubborn to remove malware/spyware.... especially the ones that self reinfect/install after having been removed/wiped.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts