|
1. |
HKCU\Software\Microsoft\Command Processor\AutoRun |
NT4+ |
|
2. |
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ |
W2K/WXP |
|
3. |
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\any subkey\ |
W2K |
|
4. |
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell |
WXP |
|
5. |
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ |
All |
|
6. |
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\any subkey\ |
W2K |
|
7. |
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ |
All |
|
8. |
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\any subkey\ |
W2K |
|
9. |
HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ |
All |
|
10. |
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run |
NT4+ |
|
11. |
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell |
NT4+ |
|
12. |
HKCU\Software\Policies\Microsoft\Windows\System\Scripts |
W2K/WXP |
|
13. |
HKLM\Software\Classes\batfile\shell\open\command\ |
All |
|
14. |
HKLM\Software\Classes\comfile\shell\open\command\ |
All |
|
15. |
HKLM\Software\Classes\exefile\shell\open\command\ |
All |
|
16. |
HKLM\Software\Classes\htafile\shell\open\command\ |
All |
|
17. |
HKLM\Software\Classes\piffile\shell\open\command\ |
All |
|
18. |
HKLM\Software\Microsoft\Active Setup\Installed Components\ |
All |
|
19. |
HKLM\Software\Microsoft\Command Processor\AutoRun |
NT4+ |
|
20. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ |
All |
|
21. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ |
All |
|
22. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ |
W2K/WXP |
|
23. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\any subkey\ |
W2K |
|
24. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ |
All |
|
25. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\any subkey\ |
W2K |
|
26. |
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\ |
All |
|
27. |
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\any subkey\ |
W2K |
|
28. |
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\ |
All |
|
29. |
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\ |
All |
|
30. |
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\ |
W98 |
|
31. |
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\ |
W98 |
|
32. |
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ |
All |
|
33. |
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ |
All |
|
34. |
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs |
NT4+ |
|
35. |
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\System
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit |
NT4+ |
|
36. |
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ |
W2K/WXP |
|
37. |
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\ |
W2K/WXP |
|
38. |
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute |
NT4+ |
|
39. |
HKLM\System\CurrentControlSet\Services |
NT4+ |
|
40. |
%WINDIR%\WIN.INI [windows] load=, run= |
W98 |
|
41. |
%WINDIR%\SYSTEM.INI [boot] shell= |
W98 |
|
42. |
%WINDIR%\WINSTART.BAT |
W98 |
|
43. |
[Local Fixed Disk]\AUTORUN.INF open=, shellexecute= |
All * |
|
44. |
%WINDIR%\Start Menu\Programs\Startup |
W98 |
|
45. |
%WINDIR%\All Users\Start Menu\Programs\Startup |
W98 |
|
46. |
%USERPROFILE%\Start Menu\Programs\Startup |
NT4+ |
|
47. |
%ALLUSERSPROFILE%\Start Menu\Programs\Startup |
NT4+ |
|
48. |
%WINDIR%\Tasks |
All
|