The 10 most stealthy Windows self-starter programs

Windows usually starts with a whole bunch of programs that start automatically. Don't think it's okay. "Start → program → start" menu is all right, in fact, in Windows xp/2k, let Windows automatically start the program a lot of ways, the following tells you the most important two folders and eight registration keys.

First, the current user-specific Startup folder

This is a common location where many applications start automatically, and Windows automatically launches all shortcuts that are placed in that folder. User startup folder generally in:/documents and settings/< user name >/"Start menu/program/launch, where" < user name > "is the user account name that is currently logged in.

Second, a valid startup folder for all users

This is the second important location to find the Autostart program, and the shortcut to the folder will always start automatically, regardless of the user's identity, which is the difference between the user-specific Startup folder. This folder is generally in:/documents and Settings/all users/"Start menu/program/start.

Third, load registration key

There is not much information about the registration key, in fact it can also start the program automatically. Position:
Hkey_current_user/software/microsoft/windowsnt/currentversion/windows/load.

Four, Userinit registration key

Position:
hkey_local_machine/software/microsoft/windowsnt/currentversion/
Winlogon/userinit. This also enables the program to be initialized automatically when the system starts. Typically there is a userinit.exe below the registration key, but this key allows you to specify multiple programs separated by commas, such as "Userinit.exe,osa.exe" (without quotation marks).


Five, Explorer/run registration key

Unlike load, Userinit, Explorer/run keys are HKEY_CURRENT_USER and
HKEY_LOCAL_MACHINE, the exact location is:
hkey_current_user/software/microsoft/windows/currentversion/policies/
Explorer/run, and Hkey_local_machine/software/microsoft/windows.
/currentversion/policies/explorer/run.

Six, RunServicesOnce registration key

The RunServicesOnce registration key is used to start the service program, the startup time before the user logs on, and before the other programs started through the registration key. The location of the RunServicesOnce registration key is:
Hkey_current_user/software/microsoft/windows/currentversion/runservicesonce,
and hkey_local_machine/software/microsoft/windows/
Currentversion/runservicesonce.

Seven, RunServices registration key

The program specified by the RunServices registry key runs immediately after the program specified by RunServicesOnce, but both before the user logs on. The location of the RunServices is:
Hkey_current_user/software/microsoft/windows/currentversion/runservices, and
Hkey_local_machine/software/microsoft/windows/currentversion/runservices.

Eight, Runonce/setup registration key

RUNONCE/SETUP Specifies the program that runs after the user logs on, and its location is:
Hkey_current_user/software/microsoft/windows/currentversion/runonce/setup,
and hkey_local_machine/software/microsoft/windows/
Currentversion/runonce/setup.

Nine, RunOnce registration key

The installer usually runs the program automatically with the RunOnce key, which is located in the
Hkey_local_machine/software/microsoft/windows/currentversion/runonce and
Hkey_current_user/software/microsoft/windows/currentversion/runonce.
HKEY_LOCAL_MACHINE the RunOnce key below will run the program immediately after the user logs in, running at the same time as the program specified by the other run key. HKEY_CURRENT_USER The following RunOnce key runs after the operating system processes the other run keys and the contents of the Startup folder. If it's XP, you need to check
Hkey_local_machine/software/microsoft/windows/currentversion/runonceex.

X. Run registry key

Run is the most common registration key for Autorun programs, located in:
Hkey_current_user/software/microsoft/windows/currentversion/run, and
Hkey_local_machine/software/microsoft/windows/currentversion/run.
HKEY_CURRENT_USER The following run key runs immediately below HKEY_LOCAL_MACHINE, but both are processed before the Startup folder.

http://blog.csdn.net/jiangxinyu/article/details/5396479

The 10 most stealthy Windows self-starter programs