Super exposure-all hidden startup methods of Trojans

One of the biggest features of a Trojan is that it must be started with the system, otherwise it will be completely meaningless !!!

Method 1: Registry Startup item: you may be familiar with this item. Pay attention to the following registry key values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunservices
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunOnce
1:


All sensitive words such as "run" must be carefully described here)

Method 2: Use System Files
Available files include Win. ini; system. ini; Autoexec. bat; Config. sys. when the system starts, some content of these files can be loaded along with the system, so that they can be used by Trojans.

Open the C: system. ini file under Windows in text mode. We will see
2:


The other files are also frequently used to enable startup;

Method 3: System Startup Group
Open "start" ------ "program" ------ "start" in sequence"
3:


WINXP: C: Documents and Settingsgillispie [start] menu program \ Start
WIN98: C: WINDOWSStart MenuPrograms startup

Corresponding registry key value:
Hkey_current_usersoftwaremicrosoftwindowscurrentversionjavasershell Folders
4:

Method 4: Use File Association:
For example, in normal circumstances, the txt file is opened in the format of notepad.exe. If a file is associated with a Trojan, the file should have been opened in the format of Notepad, but now it has become a Trojan.
There are two ways to solve the file association problem:
① Modify the registry:
If the trojan is an associated EXE file:
Find the key value:
HKEY_CLASSES_ROOTexefileshellopencommand
HKEY_LOCAL_MACHINESoftwareCLASSESexefileshellopencommand
5:

② Enter the control panel and select the folder option --------- file type
6:
Click "advanced" and select "application" in the pop-up menu"

Method 5: load data using services
If the system needs to run normally, some services are indispensable. Some Trojans load services to enable the system as soon as the system starts.

Control Panel -------- management tools ------ Service
7:

Use the net start service name (enable service)
Net stop service name (close Service)