Sometimes people often get a headache over getting a program to start, because some users simply do not know how those files are started. So there are often some useless things hanging on the system and taking up resources. Sometimes people also get a headache because they do not know how to start a certain file. There are even some Trojan horse authors who, because they do not understand the system's auto-start methods, make it easy for others to discover their Trojans...
Windows actually has many auto-start methods. Besides some common startup methods, there are also some very concealed ways that can be used to start files. This article summarizes them below. Although it is not complete, I think it should still be helpful to everyone. Everything in the article is based on the system's default state, for research purposes.
Among them, (English) means the English operating system, and (Chinese) means the Chinese operating system. Anything not otherwise noted in this article refers to Chinese Windows 98.
Warning:
Some of the operations mentioned in this article may affect system stability. For example, if the registry editor is not used correctly, it may lead to serious problems such as having to reinstall the system. Microsoft also cannot guarantee that the results caused by improper use of the registry editor can be resolved. The author is not responsible for the consequences of using it; please use it according to your own situation.
Windows auto-start methods:
I. Auto-start directories:
1. The first auto-start directory:
The default path is located at:
C:windowsstart menuprogramsstartup（English）
C:windowsstart menuprograms启动（Chinese）
This is the most basic and most commonly used Windows startup method, mainly used for auto-start items of some applications, such as Office's shortcut menu. Files that ordinary users want started at startup can also be started from here; you only need to put the required file or its shortcut into the folder.
Corresponding registry locations:
Startup=\"%Directory%\"
Startup=\"%Directory%\"
Here, “%Directory%” is the location of the Startup folder.
The English default is:
C:windowsstart menuprogramsstartup
The Chinese default is:
C:windowsstart menuprograms启动
The “启动” folder in the Start Menu can be changed. If the user changes the startup folder, then the key values in the above registry locations will also change to the corresponding names.
What is worth noting is: although the contents of the “启动” folder in the Start Menu can be seen very clearly by the user in the default state, with some changes it is still possible to achieve fairly concealed startup:
First, the shortcuts or other files in the “启动” folder can have their attributes changed to “hidden.” This can make the system not start the hidden files, and when they need to be started again, startup can be restored by changing the file attributes back.
Second, the “启动” folder is actually just an ordinary folder, but because the system monitors this folder, it becomes somewhat special. Still, whatever functions an ordinary folder has, this folder also has. For example, the name of the “启动” folder can be changed, and the “启动” folder can also have attributes set. If its attribute is set to “hidden,” then the “启动” folder cannot be seen in the system's 【开始】【程序】 menu (even if “show all files” has already been set in “Folder Options”). Yet the system will still start the non-hidden files inside that hidden folder.
Sharp-eyed people may already have noticed the issue. For example:
If I want to start the server side of Trojan A, I can rename the original “启动” menu to “StartUp” first (the change here is arbitrary, and the corresponding registry key values will also change automatically), then create another folder named “启动”, copy all the files from the “StartUp” menu into the “启动” menu (using copy here can fool the user's inspection), then put Trojan A's server program into the “StartUp” folder, and finally hide the “StartUp” folder. Done!
On the surface, the user's 【开始】【启动】 directory is still there, and the files that are supposed to be started are also there. But at this point, the system is not starting the files in the folder named “启动”; it is starting the files in the folder named “StartUp.” If the Trojan is made well enough, it can completely copy the files in “StartUp” to the “启动” directory every time at startup to achieve the purpose of updating the startup directory in real time. Since the “StartUp” folder is hidden, the real startup menu “StartUp” cannot be seen from 【开始】【程序】, thus achieving the purpose of concealed startup!
Although this startup method is rather concealed, it can still be seen on the “Startup” page through msconfig.
2. The second auto-start directory:
Yes, in fact Windows has another auto-start directory, and it is a very obvious one that is often overlooked.
This path is located at:
C:WINDOWSAll UsersStart MenuProgramsStartUp（English）
C:WINDOWSAll UsersStart MenuPrograms启动（Chinese）
This directory is used in exactly the same way as the first auto-start directory. As long as you find the directory and drag the file that needs to be started into it, you can achieve the purpose of startup.
\"Common Startup\"=\"%Directory%\"
\"Common Startup\"=\"%Directory%\"
What is worth noting is: this directory cannot be seen at all in the “启动” directory of the Start Menu. Yet with every startup, the non-hidden files under this directory will also be started! In addition, the files to be started in this directory can be seen in Msconfig.
II. Startup through system configuration files:
Since the system configuration files are quite unfamiliar to most users, these startup methods are relatively well concealed, so some of the methods mentioned here are often used for destructive operations. Readers should take note.
1.WIN.INI startup:
Startup location (file.exe is the name of the file to be started):
load=file.exe
run=file.exe
Note: the difference between load= and run= is that files run through load= will run in the background (minimized), while files run through run= will be run in the default state.
2.SYSTEM.INI startup:
Startup location (file.exe is the name of the file to be started):
The default is:
Shell=Explorer.exe
After adding the startup file it becomes:
Shell=Explorer.exe file.exe
Explanation:
The author remembers that in a book written by Mr. Norton (the person who developed the Norton series software), it once said that whether or not files 1 and 2 exist has little effect on the system, but because of time, the author did not get a chance to test it. Anyone interested can try it.
But one thing is certain: this kind of startup method is often used by Trojans or some prank programs (for example, 妖之吻), causing the system to behave abnormally. Since ordinary users rarely pay attention to these two files, and some people do not even know what these files are for, the concealment is quite good. But because it is being used more and more often, this startup method has gradually been noticed. Users can use the msconfig command to check whether any programs are being loaded. Specifically, enter msconfig in the “Run” item of the Start menu and press Enter, then just follow the text instructions.
Note:
1.Unlike WIN.INI, SYSTEM.INI startup can only start one specified file. Do not change Shell=Explorer.exe file.exe to Shell=file.exe, or Windows will be crippled!
2.This startup method comes earlier than registry startup, so if you want to restrict the startup of files in the registry, you can use this method.
3.WININIT.INI startup:
Many people may not know the file Wininit.ini, and in ordinary use users rarely come into direct contact with it. But if you have written an uninstaller, you may know this file.
WinInit is Windows Setup Initialization Utility. Translated into Chinese, that means Windows installation initialization utility. Maybe that still is not clear, but if you see the following prompt:
Please wait while Setup updates your configuration files.
This may take a few minutes...
then everyone will probably know it! This is Wininit.ini at work!
Under Windows, many executable files and driver files are loaded into memory and protected by the system. So modifying these files while Windows is running becomes a problem, and that is why the file Wininit.ini appeared to help the system do this. Before Windows is loaded, it lets the system execute some commands, including copy, delete, rename, and so on, in order to update files. The Wininit.ini file exists in the Windows directory, but under normal circumstances we cannot find this file in C:Windows, only its exe program Wininit.exe. The reason is that every time the system finishes executing the commands in Wininit.ini, the file is automatically deleted by the system, until a new Wininit.ini appears again... and is then deleted again.
File format:
file1=file2
file1=file2 means copying file2 as a file named file1, which is equivalent to overwriting file1.
In this way, at startup Windows achieves the purpose of using file2 to update file1; if file1 does not exist, the actual result is that file2 is copied and renamed to file1; if you want to delete a file, you can use the following command:
nul=file2
This means turning file2 into empty, that is, deleting it.
All of the above file names must include full paths.
Note:
1.Since Wininit.ini processes files before Windows starts, it does not support long filenames.
2.All the above file copying, deleting, renaming, etc. are carried out without prompting the user. Some viruses will also use this file to damage the system, so if a user finds the system inexplicably showing:
Please wait while Setup updates your configuration files.
This may take a few minutes...
then perhaps there is something wrong with the system.
3. In the Windows 95 Resource Kit it was mentioned that the Wininit.ini file may have three possible sections, but only the use of the section was described.
4.WINSTART.BAT startup:
This is a system auto-start batch file. Its main purpose is to handle some tasks that need copying or deleting. For example, after installation or uninstallation some software will ask for a reboot, and this can be used to copy or delete some files to complete the task. For example:
“@if exist C:WINDOWSTEMPPROC.BAT call C:WINDOWSTEMPPROC.BAT”
This is the command to execute the PROC.BAT file;
“call filename.exe > nul”
This removes any output on the screen.
What is worth noting is that WinStart.BAT in a certain sense has the same role as AUTOEXEC.BAT. If arranged cleverly, it can completely achieve the purpose of modifying the system!
5.AUTOEXEC.BAT startup:
There is not much to say about this one; it should be one of the system files users are most familiar with. It starts under DOS each time the system reboots. Malicious programs often use this file for some auxiliary measures.
However, AUTOEXEC.BAT may contain malicious code, such as format c: /y and so on; because of the existence of malicious BAT programs, this possibility has greatly increased. For example, the recently very popular SirCam worm also uses Autoexec.bat.
Explanation:
Files 4 and 5 are both batch files, and their functions often cannot be fully written out, because batch processing was used so widely in the DOS era, and its capabilities are relatively powerful. To make use of these two files, you need some understanding of DOS。.
III. Registry startup:
Startup in the registry is probably the most frequently used startup method, but even here there are some methods with relatively high concealment, roughly three kinds.
1.Conventional startup:
Here %path% is any path, and file.exe is the program to be run.
\"Anything\"=\"%path%file.exe\"
\"Anything\"=\"%path%file.exe\"
\"Anything\"=\"%path%file.exe\"
\"Anything\"=\"%path%file.exe\"
\"Whatever\"=\"c:runfolderprogram.exe\"
\"Whatever\"=\"c:runfolderprogram.exe\"
Note:
(1).If you need to run a .dll file, a special command line is needed.
For example:
Rundll32.exe C:WINDOWSFILE.DLL,Rundll32
(2).To remove the corresponding auto-start item here, you only need to delete that key value, but be careful not to delete system key values such as SystemTray, ScanRegistry, and so on.
(3).If you only want to prevent it from starting while keeping the key value, just add rem to that key value. For example:
“remC:Windowsa.exe”
(4).Among the auto-start items in the registry there is no such item:
(5).The difference between Run and RunServices is that programs in Run are started each time the system starts, while RunServices are started each time you log into the system.
About:
there is a special syntax:
For example, to run notepad.exe
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
\"Title\"=\"My Setup Title\"
\"Flag\"=dword:00000002
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx001
\"RunMyApp\"=\"||notepad.exe\"
The syntax is:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
Flags = 0x0000000
Title = \"Status Dialog Box Title\"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceExDepend
0001 = \"xxx1\"
000X = \"xxxx\"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx001
Entry1 = \"MyApp1.exe\"
EntryX = \"MyApp2.exe\"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx00x
...
Note:
(1).“xxx1，xxxx” is a dynamic link library (DLL) or .OCX filename (such as My.ocx or My.dll).
Windows actually has many auto-start methods. Besides some common startup methods, there are also some very concealed ways that can be used to start files. This article summarizes them below. Although it is not complete, I think it should still be helpful to everyone. Everything in the article is based on the system's default state, for research purposes.
Among them, (English) means the English operating system, and (Chinese) means the Chinese operating system. Anything not otherwise noted in this article refers to Chinese Windows 98.
Warning:
Some of the operations mentioned in this article may affect system stability. For example, if the registry editor is not used correctly, it may lead to serious problems such as having to reinstall the system. Microsoft also cannot guarantee that the results caused by improper use of the registry editor can be resolved. The author is not responsible for the consequences of using it; please use it according to your own situation.
Windows auto-start methods:
I. Auto-start directories:
1. The first auto-start directory:
The default path is located at:
C:windowsstart menuprogramsstartup（English）
C:windowsstart menuprograms启动（Chinese）
This is the most basic and most commonly used Windows startup method, mainly used for auto-start items of some applications, such as Office's shortcut menu. Files that ordinary users want started at startup can also be started from here; you only need to put the required file or its shortcut into the folder.
Corresponding registry locations:
Startup=\"%Directory%\"
Startup=\"%Directory%\"
Here, “%Directory%” is the location of the Startup folder.
The English default is:
C:windowsstart menuprogramsstartup
The Chinese default is:
C:windowsstart menuprograms启动
The “启动” folder in the Start Menu can be changed. If the user changes the startup folder, then the key values in the above registry locations will also change to the corresponding names.
What is worth noting is: although the contents of the “启动” folder in the Start Menu can be seen very clearly by the user in the default state, with some changes it is still possible to achieve fairly concealed startup:
First, the shortcuts or other files in the “启动” folder can have their attributes changed to “hidden.” This can make the system not start the hidden files, and when they need to be started again, startup can be restored by changing the file attributes back.
Second, the “启动” folder is actually just an ordinary folder, but because the system monitors this folder, it becomes somewhat special. Still, whatever functions an ordinary folder has, this folder also has. For example, the name of the “启动” folder can be changed, and the “启动” folder can also have attributes set. If its attribute is set to “hidden,” then the “启动” folder cannot be seen in the system's 【开始】【程序】 menu (even if “show all files” has already been set in “Folder Options”). Yet the system will still start the non-hidden files inside that hidden folder.
Sharp-eyed people may already have noticed the issue. For example:
If I want to start the server side of Trojan A, I can rename the original “启动” menu to “StartUp” first (the change here is arbitrary, and the corresponding registry key values will also change automatically), then create another folder named “启动”, copy all the files from the “StartUp” menu into the “启动” menu (using copy here can fool the user's inspection), then put Trojan A's server program into the “StartUp” folder, and finally hide the “StartUp” folder. Done!
On the surface, the user's 【开始】【启动】 directory is still there, and the files that are supposed to be started are also there. But at this point, the system is not starting the files in the folder named “启动”; it is starting the files in the folder named “StartUp.” If the Trojan is made well enough, it can completely copy the files in “StartUp” to the “启动” directory every time at startup to achieve the purpose of updating the startup directory in real time. Since the “StartUp” folder is hidden, the real startup menu “StartUp” cannot be seen from 【开始】【程序】, thus achieving the purpose of concealed startup!
Although this startup method is rather concealed, it can still be seen on the “Startup” page through msconfig.
2. The second auto-start directory:
Yes, in fact Windows has another auto-start directory, and it is a very obvious one that is often overlooked.
This path is located at:
C:WINDOWSAll UsersStart MenuProgramsStartUp（English）
C:WINDOWSAll UsersStart MenuPrograms启动（Chinese）
This directory is used in exactly the same way as the first auto-start directory. As long as you find the directory and drag the file that needs to be started into it, you can achieve the purpose of startup.
\"Common Startup\"=\"%Directory%\"
\"Common Startup\"=\"%Directory%\"
What is worth noting is: this directory cannot be seen at all in the “启动” directory of the Start Menu. Yet with every startup, the non-hidden files under this directory will also be started! In addition, the files to be started in this directory can be seen in Msconfig.
II. Startup through system configuration files:
Since the system configuration files are quite unfamiliar to most users, these startup methods are relatively well concealed, so some of the methods mentioned here are often used for destructive operations. Readers should take note.
1.WIN.INI startup:
Startup location (file.exe is the name of the file to be started):
load=file.exe
run=file.exe
Note: the difference between load= and run= is that files run through load= will run in the background (minimized), while files run through run= will be run in the default state.
2.SYSTEM.INI startup:
Startup location (file.exe is the name of the file to be started):
The default is:
Shell=Explorer.exe
After adding the startup file it becomes:
Shell=Explorer.exe file.exe
Explanation:
The author remembers that in a book written by Mr. Norton (the person who developed the Norton series software), it once said that whether or not files 1 and 2 exist has little effect on the system, but because of time, the author did not get a chance to test it. Anyone interested can try it.
But one thing is certain: this kind of startup method is often used by Trojans or some prank programs (for example, 妖之吻), causing the system to behave abnormally. Since ordinary users rarely pay attention to these two files, and some people do not even know what these files are for, the concealment is quite good. But because it is being used more and more often, this startup method has gradually been noticed. Users can use the msconfig command to check whether any programs are being loaded. Specifically, enter msconfig in the “Run” item of the Start menu and press Enter, then just follow the text instructions.
Note:
1.Unlike WIN.INI, SYSTEM.INI startup can only start one specified file. Do not change Shell=Explorer.exe file.exe to Shell=file.exe, or Windows will be crippled!
2.This startup method comes earlier than registry startup, so if you want to restrict the startup of files in the registry, you can use this method.
3.WININIT.INI startup:
Many people may not know the file Wininit.ini, and in ordinary use users rarely come into direct contact with it. But if you have written an uninstaller, you may know this file.
WinInit is Windows Setup Initialization Utility. Translated into Chinese, that means Windows installation initialization utility. Maybe that still is not clear, but if you see the following prompt:
Please wait while Setup updates your configuration files.
This may take a few minutes...
then everyone will probably know it! This is Wininit.ini at work!
Under Windows, many executable files and driver files are loaded into memory and protected by the system. So modifying these files while Windows is running becomes a problem, and that is why the file Wininit.ini appeared to help the system do this. Before Windows is loaded, it lets the system execute some commands, including copy, delete, rename, and so on, in order to update files. The Wininit.ini file exists in the Windows directory, but under normal circumstances we cannot find this file in C:Windows, only its exe program Wininit.exe. The reason is that every time the system finishes executing the commands in Wininit.ini, the file is automatically deleted by the system, until a new Wininit.ini appears again... and is then deleted again.
File format:
file1=file2
file1=file2 means copying file2 as a file named file1, which is equivalent to overwriting file1.
In this way, at startup Windows achieves the purpose of using file2 to update file1; if file1 does not exist, the actual result is that file2 is copied and renamed to file1; if you want to delete a file, you can use the following command:
nul=file2
This means turning file2 into empty, that is, deleting it.
All of the above file names must include full paths.
Note:
1.Since Wininit.ini processes files before Windows starts, it does not support long filenames.
2.All the above file copying, deleting, renaming, etc. are carried out without prompting the user. Some viruses will also use this file to damage the system, so if a user finds the system inexplicably showing:
Please wait while Setup updates your configuration files.
This may take a few minutes...
then perhaps there is something wrong with the system.
3. In the Windows 95 Resource Kit it was mentioned that the Wininit.ini file may have three possible sections, but only the use of the section was described.
4.WINSTART.BAT startup:
This is a system auto-start batch file. Its main purpose is to handle some tasks that need copying or deleting. For example, after installation or uninstallation some software will ask for a reboot, and this can be used to copy or delete some files to complete the task. For example:
“@if exist C:WINDOWSTEMPPROC.BAT call C:WINDOWSTEMPPROC.BAT”
This is the command to execute the PROC.BAT file;
“call filename.exe > nul”
This removes any output on the screen.
What is worth noting is that WinStart.BAT in a certain sense has the same role as AUTOEXEC.BAT. If arranged cleverly, it can completely achieve the purpose of modifying the system!
5.AUTOEXEC.BAT startup:
There is not much to say about this one; it should be one of the system files users are most familiar with. It starts under DOS each time the system reboots. Malicious programs often use this file for some auxiliary measures.
However, AUTOEXEC.BAT may contain malicious code, such as format c: /y and so on; because of the existence of malicious BAT programs, this possibility has greatly increased. For example, the recently very popular SirCam worm also uses Autoexec.bat.
Explanation:
Files 4 and 5 are both batch files, and their functions often cannot be fully written out, because batch processing was used so widely in the DOS era, and its capabilities are relatively powerful. To make use of these two files, you need some understanding of DOS。.
III. Registry startup:
Startup in the registry is probably the most frequently used startup method, but even here there are some methods with relatively high concealment, roughly three kinds.
1.Conventional startup:
Here %path% is any path, and file.exe is the program to be run.
\"Anything\"=\"%path%file.exe\"
\"Anything\"=\"%path%file.exe\"
\"Anything\"=\"%path%file.exe\"
\"Anything\"=\"%path%file.exe\"
\"Whatever\"=\"c:runfolderprogram.exe\"
\"Whatever\"=\"c:runfolderprogram.exe\"
Note:
(1).If you need to run a .dll file, a special command line is needed.
For example:
Rundll32.exe C:WINDOWSFILE.DLL,Rundll32
(2).To remove the corresponding auto-start item here, you only need to delete that key value, but be careful not to delete system key values such as SystemTray, ScanRegistry, and so on.
(3).If you only want to prevent it from starting while keeping the key value, just add rem to that key value. For example:
“remC:Windowsa.exe”
(4).Among the auto-start items in the registry there is no such item:
(5).The difference between Run and RunServices is that programs in Run are started each time the system starts, while RunServices are started each time you log into the system.
About:
there is a special syntax:
For example, to run notepad.exe
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
\"Title\"=\"My Setup Title\"
\"Flag\"=dword:00000002
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx001
\"RunMyApp\"=\"||notepad.exe\"
The syntax is:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
Flags = 0x0000000
Title = \"Status Dialog Box Title\"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceExDepend
0001 = \"xxx1\"
000X = \"xxxx\"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx001
Entry1 = \"MyApp1.exe\"
EntryX = \"MyApp2.exe\"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx00x
...
Note:
(1).“xxx1，xxxx” is a dynamic link library (DLL) or .OCX filename (such as My.ocx or My.dll).
http://dos.e-stone.cn/dosbbs
uploadImages/200311161145850422.swf
uploadImages/200311161145850422.swf
rogram filestrojan.scr), and modifies HKEY_USERS.DEFAULTControl PaneldesktopScreenSaveTimeOut in the registry, setting the time to 60, then as long as the system sits idle for one minute, that file will be started!