Question From which sections from the registry can programs be run??

[The PIT]

Title says it all.

Theres the run sections and services but I've seen viri run from mapped drives outside of this. So whats the full set of rules?

[DGhost]

MSKB Articles that might be of some assitance:

Q137367 - Definition of the RunOnce Keys in the Registry
Q314866 - A Definition of the Run Keys in the Windows XP Registry
Q811154 - "Windows Cannot Find Openme.exe" Error Message When You Start Windows
Q314488 - How to Modify the List of Programs that Run When You Start Windows XP

mostly they talk about the places you already mentioned, but it still has some good info...

[Paddy]

Nice list thanks! I wasn't aware of all of these!

[DGhost]

You would be amazed at what you can find on Microsoft's website. the MSKB is a HUGE resource, as is TechNet. It's just gotten to be problematic because their is so much stuff in there nowdays.

One particularly annoying thing I found a virus do once was modify the default handling of .exe files so that it runs the virus with the .exe as a parameter, and the virus runs whatever was passed as an argument. evvvilll things.

[The PIT]

Thanks Dghost.

I knew about those places but I've still seen spyware/viri launched when there isn't any reg entries in those locations. Theres got to be somewhere else as well.


Problem with Microsofts site is that it's in some ways got too much information. Since microsoft tend not to give error codes to some errors you can look for ever and never find them.

[Kurt]

Unfortunaltey, I can't remember where it was, but both explorer and ie can launch things at start (a "run" key can be present, but it's not in the windows subkey, it's in the explorer or ie subkey somewhere).

don't forget, win.ini, system.ini, autoexec.bat etc...