Security → Lets take a look at startups for malware!

There are plenty of ways trojans and other malware can hide when they startup. But they have to startup somehow. Lets take a look about WHAT and WHERE do startup programs appear on WindowsXP Pro atleast... Please, give more tips if you know other places where programs can be launched during startup!

- At registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Windows\load
HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Windows\run
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Install Components\
HKEY_CLASSES_ROOT\exefile\shell\open\command (so that whenever and .exe files is run, also the trojan is run)

- At startmenu (other users startup menu should also be checked)
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

- At services the ones that are "manual" or "automatic"
Go to "Start menu\Administrator tools\services"

- At login/logoff script.
Run "gpedit.msc" and go to "Local computer policy - User Configuration - Windows Settings - Scripts (Logon/Logoff)

- At "win.ini" and "boot.ini" files by adding command like "load = trojan.exe" or "Run= trojan.exe" or "Shell=Explorer.exe trojan.exe".

- By adding itself to existing .exe files such as Explorer.exe so that when that file is launched as normally it is, so will the trojan be too... Or attaching itself to the .dll files so that when some program uses those .dll files, trojan gets loaded to memory.

The only way keep in touch about what is starting up in your system (actually, what files there are in your system and have they been tampered with) is to use tool like "NISfilecheck" that creates SHA-1 hashes from wanted files so that if trojan attaches itself to those file, NISfilecheck will discover it easily when you next run it. Ofcourse, you must specify all files that need to be checked. I have set my NISfilecheck to check all files that have .exe .dll .ocx .vxd .sys .bat .scr .ini .com .cmd .dat .reg .drv .vbs .inf .msi .wsc .386 .pif extension. To protect registry against trojans you need program like "Active Registry Monitor". To prevent unknown .exe and .dll files to be executed on your system you need program like "Abtrusion Protect"...To put it simple, if you are running "Abtrusion Protect", there is practicly NO WAY of you getting infected with trojan accidently since it prevents all .exe and .dll files to be executed that you have not specificly allowed to execute...naturally, trojan cant disable it because trojan cant even execute in the first place. Programs like "What's Happening" make it possible to monitor already running processes and .dll files, where "Active Ports" will tell you about what program is using your network.

And here is one excellent site about what does what entry or file being starting up mean and what it is
http://www.pacs-portal.co.uk/startup_pages/startup_full.htm

Here's what I have collected. Not every startup location is valid for every operationg system, of course.

1. Autostart folder

C:\windows\start menu\programs\startup {english}
C:\windows\Menu Démarrer\Programmes\Démarrage {french}
C:\windows\All Users\Menu Iniciar\Programas\Iniciar { Portuguese, Brasilian }

This Autostart Directory is saved in :

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup="C:\windows\start menu\programs\startup"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup="C:\windows\start menu\programs\startup"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"
By setting it to anything other then C:\windows\start menu\programs\startup will lead to execution of ALL and EVERY executable inside set directory.

Addendum : as of 10/03/2001 Subseven 2.2 now uses this method.

2. Win.ini

[windows]
load=file.exe
run=file.exe

3. System.ini
[boot]
Shell=Explorer.exe file.exe

4. c:\windows\winstart.bat
'Note behaves like an usual BAT file. Used for copying deleting specific files. Autostarts everytime.

5. Registry

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\000x]
"RunMyApp"="||notepad.exe"
The format is: "DllFileName|FunctionName|CommandLineArguements" -or- "||command parameters"

Microsoft Windows 98 Microsoft
Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows Millennium Edition

support.microsoft.com/sup...2/5/09.ASP

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

6. c:\windows\wininit.ini
'Often Used by Setup-Programs when the file exists it is run ONCE and then is deleted by windows
Example content of wininit.ini :

[Rename]
NUL=c:\windows\picture.exe

' This example sends c:\windows\picture.exe to NUL, which means that it is being deleted. This requires no interactivity with the user and runs totaly stealth.

7. Autoexec.bat
Starts everytime at Dos Level.

8. Registry Shell Spawning

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @="%1" %*
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @="%1" %*
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @="%1" %*
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @="%1" %* [HKEY_CLASSES_ROOT\piffile\shell\open\command] @="%1" %*

[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @="%1" %*
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @="%1" %*
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @="%1" %*
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @= "%1" %*
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @="%1" %*

The key should have a value of Value , if this is changed to , the server.exe is executed EVERYTIME an exe/pif/com/bat/hta is executed.

Known as Unkown Starting Method and is currently used by Subseven.

9. Icq Inet

[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\test]
"Path"="test.exe"
"Startup"="c:\\test"
"Parameters"=""
"Enable"="Yes"

[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\
This key includes all the APPS which are executed IF ICQNET Detects an Internet Connection.

10. Explorer start-up

Windows 95,98,ME
Explorer.exe ist started through a system.ini entry, the entry itself contains no path information so if c:\explorer.exe exist it will be started instead of c:\$winpath\explorer.exe.

Windows NT/2000
The Windows Shell is the familiar desktop that's used for interacting with Windows. During system startup, Windows NT 4.0 and Windows 2000 consult the "Shell" registry entry, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, to determine the name of the executable that should be loaded as the Shell.
By default, this value specifies Explorer.exe.

The problem has to do with the search order that occurs when system startup is in process. Whenever a registry entry specifies the name of a code module, but does it using a relative path, Windows initiates a search process to find the code. The search order is as follows:

Search the current directory.
If the code isn't found, search the directories specified in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path, in the order in which they are specified.
If the code isn't found, search the directories specified in HKEY_CURRENT_USER\Environment\Path, in the order in which they are specified.
More info : www.microsoft.com/technet...00-052.asp
Patch : www.microsoft.com/technet...?ID=269049
General :
If a trojan installs itself as c:\explorer no run keys or other start-up entries are needed. If c:\explorer.exe is a corrupted file the user will be locked out of the system. Affects all windows version as of today.

10. Active-X Component
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName
StubPath=C:\PathToFile\Filename.exe
Believe it or not, this does start filename.exe BEFORE the shell and any other Program normaly started over the Run Keys.

Misc Information

[HKEY_LOCAL_MACHINE\Software\CLASSES\ShellScrap] @="Scrap object"
"NeverShowExt"=""

The NeverShowExt key has the function to HIDE the real extension of the file (here) SHS. This means if you rename a file as "Girl.jpg.shs" it displays as "Girl.jpg" in all programs including Explorer.
Your registry should be full of NeverShowExt keys, simply delete the key to get the real extension to show up.

11. Win.ini Load= and Run= in NT/XP:

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"run"=""
"load"=""

Programs Automatically Start When User Logs on to Windows

Here's some further information of the use of HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

Common loading points of threats in Windows NT/2000/XP

And from Frank Kiechel's site:

"System : NT, 2K
Key : HKCU \Software \Microsoft \Windows NT \CurrentVersion \Windows
This key contains the 2 REG_SZ entries run and load which also execute programs at startup. Win.ini and System.ini may contain a run/load section too which can be deleted to prevent some programs from being executed : if Windows finds sections in .ini files which are not present in the registry, those sections will automatically be registered. "

12. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="F:\WINDOWS\system32\userinit.exe,

You can add a path to a program after the comma.

13. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

http://www.avp.ch/avpve/newexe/win32/highway.stm

http://vil.mcafee.com/dispVirus.asp?virus_k=99238

14. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup
String Value some program or file

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
String Value some program or file

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

String Value some program or file

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

15. Windows XP does not use Wininit.ini. Instead it uses this Registry Key.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
" PendingFileRenameOperations"

Another Possible Multi-String Value here to look at is: ExcludeFromKnownDlls

The reason is this. The known dll's key lists dll's which can only be run from the System Folder. If the same file is located in a program's folder it will not be run. The version in System32 will be run.
Here 's a complete explanation
http://support.microsoft.com/default.aspx?scid=KB;en-us;q164501

16. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

The layout of the values in that key is somewhat like the one in the Run key, only it points to the InProcServer for the CLSID instead of pointing to a file.
---------------------------------------------------------------------------------- -------- --------------------------------