Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run when any user logs on.īy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell subkeys can automatically launch programs. Most of these actions are under the control of the operating system, but you can also add custom actions here.
CONTROL TECHNIQUES DPL TOOLKIT SOFTWARE WINDOWS
The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.Using policy settings to specify startup programs creates corresponding values in either of two Registry keys: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce.The following Registry keys can control automatic startup of services during boot: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.The following Registry keys can be used to set startup folder items for persistence: For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evildll"
Registry run key entries can reference programs directly or list them as a dependency. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer.