Hacking
1. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRun
· All values in this key are executed.
2. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunOnce
· All values in this key are executed, and then their autostart reference is deleted.
3. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunServices
· All values in this key are executed as services.
4. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunServicesOnce
· All values in this key are executed as services, and then their autostart reference is deleted.
5. · HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRun
· All values in this key are executed.
6. · HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunOnce
· All values in this key are executed, and then their autostart reference is deleted.
7. · HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunOnceSetup
· Used only by Setup. Displays a progress dialog box as the keys are run one at a time.
8. · HKEY_USERS.DefaultSoftwareMicrosoftWindowsCur rentVersionRun
· Similar to the Run key from HKEY_CURRENT_USER.
9. · HKEY_USERS.DefaultSoftwareMicrosoftWindowsCur rentVersionRunOnce
· Similar to the RunOnce key from HKEY_CURRENT_USER.
10. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon
· The "Shell" value is monitored. This value is executed after you log in.
11. · HKEY_LOCAL_MACHINESoftwareMicrosoftActive SetupInstalled Components
· All subkeys are monitored, with special attention paid to the "StubPath" value in each subkey.
12. · HKEY_LOCAL_MACHINESystemCurrentControlSetServic esVxD
· All subkeys are monitored, with special attention paid to the "StaticVXD" value in each subkey.
13. · HKEY_CURRENT_USERControl PanelDesktop
The "SCRNSAVE.EXE" value is monitored. This value is launched when your screen saver activates.
14. · HKEY_LOCAL_MACHINESystemCurrentControlSetContro lSession Manager
The "BootExecute" value is monitored. Files listed here are Native Applications that are
executed before Windows starts.
15. · HKEY_CLASSES_ROOTvbsfileshellopencommand
· Executed whenever a .VBS file (Visual Basic Script) is run.
16. · HKEY_CLASSES_ROOTvbefileshellopencommand
· Executed whenever a .VBE file (Encoded Visual Basic Script) is run.
17. · HKEY_CLASSES_ROOTjsfileshellopencommand
· Executed whenever a .JS file (Javascript) is run.
18. · HKEY_CLASSES_ROOTjsefileshellopencommand
· Executed whenever a .JSE file (Encoded Javascript) is run.
19. · HKEY_CLASSES_ROOTwshfileshellopencommand
· Executed whenever a .WSH file (Windows Scripting Host) is run.
20. · HKEY_CLASSES_ROOTwsffileshellopencommand
· Executed whenever a .WSF file (Windows Scripting File) is run.
21. · HKEY_CLASSES_ROOTexefileshellopencommand
· Executed whenever a .EXE file (Executable) is run.
22. · HKEY_CLASSES_ROOTcomfileshellopencommand
· Executed whenever a .COM file (Command) is run.
23. · HKEY_CLASSES_ROOTbatfileshellopencommand
· Executed whenever a .BAT file (Batch Command) is run.
24. · HKEY_CLASSES_ROOTscrfileshellopencommand
· Executed whenever a .SCR file (Screen Saver) is run.
25. · HKEY_CLASSES_ROOTpiffileshellopencommand
· Executed whenever a .PIF file (Portable Interchange Format) is run.
26. · HKEY_LOCAL_MACHINESystemCurrentControlSetServic es
· Services marked to startup automatically are executed before user login.
27. HKEY_LOCAL_MACHINESystemCurrentControlSetServic esWinsock2
ParametersProtocol_CatalogCatalog_En tries
· Layered Service Providers, executed before user login.
28. · HKEY_LOCAL_MACHINESystemControlWOWcmdline
· Executed when a 16-bit Windows executable is executed.
29. · HKEY_LOCAL_MACHINESystemControlWOWwowcmdline
· Executed when a 16-bit DOS application is executed.
30. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonUserinit
· Executed when a user logs in.
31 . HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr ent
VersionShellServiceObjectDelayLoad
· Executed by explorer.exe as soon as it has loaded.
32. · HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindowsrun
· Executed when the user logs in.
33. · HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindowsload
· Executed when the user logs in.
34. · HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionPoliciesExplorerrun
· Subvalues are executed when Explorer initialises.
35. · HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionPoliciesExplorerrun
· Subvalues are executed when Explorer initialises.
|
