中央論壇 - CENTER BBS

標題: 木馬設定開機自動啟動可能會常修改的地方 [打印本頁]

作者: f66666602 時間: 2007-7-6 18:17
標題: 木馬設定開機自動啟動可能會常修改的地方
98/ME/NT4/2000/XP/2003 中文版

Windows 98/ME

%windir%\Start Menu\Programs\啟動

AUTOEXEC.BAT
WIN.INI 的 [WINDOWS] LOAD= 和 RUN=

**********************************************************************************

Windows NT 4

%USERPROFILE%\「開始」功能表\程式集\啟動

**********************************************************************************

Windows 2000/XP/2003

%USERPROFILE%\「開始」功能表\程式集\啟動

**********************************************************************************

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Windows 98/Me/NT 才有)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce (都有)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx (都有)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices (都有, 除 NT)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce (Windows 98/Me 才有)

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (Windows NT/2000/XP 才有)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce (Windows 98/Me/2003 才有)

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run (Windows NT/2000/XP 才有)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce (Windows 98/Me/2003 才有)

Windows 98/ME 中文版

%windir%\All Users\Start Menu\Programs\啟動
%windir%\Start Menu\Programs\啟動
%windir%\Tasks
%windir%\win.ini

NT4 中文版

%USERSPROFILE%\..\All Users\「開始」功能表\程式集\啟動 (NT4 沒有 %ALLUSERSPROFILE%)
%USERSPROFILE%\「開始」功能表\程式集\啟動
%windir%\Tasks

Windows NT4/2000/XP/2003 中文版

%ALLUSERSPROFILE%\「開始」功能表\程式集\啟動
%USERSPROFILE%\「開始」功能表\程式集\啟動
%windir%\Tasks

HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\MICROSOFT\Windows\CURRENTVERSION\Run (Win2003 才有)
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\MICROSOFT\Windows\CURRENTVERSION\Runonce (Win2003 才有)
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\MICROSOFT\Windows\CURRENTVERSION\RunonceEx (Win2003 才有)
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices (Win98/ME 才有)
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices (Win98/ME 才有)
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce (Win98/ME 才有)
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce (Win98/ME 才有)
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\MICROSOFT\Windows\CURRENTVERSION\Run (Win2003 才有)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\MICROSOFT\Windows\CURRENTVERSION\Runonce (Win2003 才有)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\MICROSOFT\Windows\CURRENTVERSION\RunonceEx (Win2003 才有)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup (Win2003 才有)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify (Win98/ME 沒有)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Internet Explorer\Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms (Win2003 才有)
HKLM\System\CurrentControlSet\Services (Win98/ME 沒有)

歡迎光臨中央論壇 - CENTER BBS (https://centerbbs.com/)