53 self-starting methods for Windows

Registry 1. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entversion \ Run \ All values in this key are executed. 2. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entversion \ runonce \ All values in this key are executed, and then their autostart reference is deleted. 3. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entversion \ runservices \ All values in this key are executed as services. 4. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entversion \ runservicesonce \ All values in this key are executed as services, and then their autostart reference is deleted. 5. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curre ntversion \ Run \ All values in this key are executed. 6. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curre ntversion \ runonce \ All values in this key are executed, and then their autostart reference is deleted. 7. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curre ntversion \ runonce \ Setup \ Used only by setup. displays a progress dialog box as the keys are run one at a time. 8. HKEY_USERS \. Default \ Software \ Microsoft \ Windows \ cur upgrade version \ Run \ Similar to the run key from HKEY_CURRENT_USER. 9. HKEY_USERS \. Default \ Software \ Microsoft \ Windows \ cur upgrade version \ runonce \ Similar to the runonce key from HKEY_CURRENT_USER. 10. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon The "shell" value is monitored. This value is executed after you log in. 11. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Active Setup \ Installed Components \ All subkeys are monitored, with special attention paid to the "stubpath" value in each subkey. 12. HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ VxD \ All subkeys are monitored, with special attention paid to the "staticvxd" value in each subkey. 13. HKEY_CURRENT_USER \ Control Panel \ Desktop The "SCRNSAVE. EXE" value is monitored. This value is launched when your screen saver activates. 14. HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ contro l \ Session Manager The "bootexecute" value is monitored. files listed here are native applications that are executed before Windows starts. 15. Hkey_classes_root \ vbsfile \ shell \ open \ command \ Executed whenever a. vbs file (Visual BASIC script) is run. 16. Hkey_classes_root \ vbefile \ shell \ open \ command \ Executed whenever a. VBE file (encoded visual basic script) is run. 17. Hkey_classes_root \ jsfile \ shell \ open \ command \ Executed whenever a. js file (JavaScript) is run. 18. Hkey_classes_root \ jsefile \ shell \ open \ command \ Executed whenever a. JSE file (Encoded javascript) is run. 19. Hkey_classes_root \ wshfile \ shell \ open \ command \ Executed whenever a. wsh file (Windows Scripting host) is run. 20. Hkey_classes_root \ wsffile \ shell \ open \ command \ Executed whenever a. WSF file (Windows scripting file) is run. 21. Hkey_classes_root \ exefile \ shell \ open \ command \ Executed whenever a. EXE file (executable) is run. 22. Hkey_classes_root \ comfile \ shell \ open \ command \ Executed whenever a. com file (command) is run. 23. Hkey_classes_root \ batfile \ shell \ open \ command \ Executed whenever a. BAT file (batch command) is run. 24. Hkey_classes_root \ scrfile \ shell \ open \ command \ Executed whenever a. scr file (screen saver) is run. 25. Hkey_classes_root \ piffile \ shell \ open \ command \ Executed whenever a. pif file (portable Interchange Format) is run. 26. HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ Services marked to startup automatically are executed before user login. 27. HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ Winsock2 \ Parameters \ protocol_catalog \ catalog_en tries \ Layered Service Providers, executed before user login. 28. HKEY_LOCAL_MACHINE \ SYSTEM \ Control \ wow \ cmdline Executed when a 16-bit Windows Executable is executed. 29. HKEY_LOCAL_MACHINE \ SYSTEM \ Control \ wow \ wow1_line Executed when a 16-bit dos application is executed. 30. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ userinit Executed when a user logs in. 31. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entversion \ shellserviceobjectdelayload \ Executed by assumer.exe as soon as it has loaded. 32. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows \ Run Executed when the user logs in. 33. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows \ Load Executed when the user logs in. 34. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curre ntversion \ Policies \ Explorer \ Run \ Subvalues are executed when explorer initialises. 35. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entversion \ Policies \ Explorer \ Run \ Subvalues are executed when explorer initialises. Folder 1. WinDir \ Start Menu \ Programs \ Startup \ 2. User \ Startup \ 3. All Users \ Startup \ 4. WinDir \ System \ iosubsys \ 5. WinDir \ System \ vmm32 \ 6. WinDir \ Tasks \ File 1. c: \ assumer.exe 2. c: \ autoexec. bat 3. c: \ config. sys 4. WinDir \ wininit. ini 5. WinDir \ winstart. bat 6. WinDir \ win. ini-[windows] "LOAD" 7. WinDir \ win. ini-[windows] "run" 8. WinDir \ system. ini-[boot] "shell" 9. WinDir \ system. ini-[boot] "scrnsave.exe" 10. WinDir \ dosstart. bat 11. WinDir \ System \ autoexec. NT 12. WinDir \ System \ config. nt