Malware Startup Paths

[Aegis]

Every registry startup path known to me. Please feel free to submit any that I have missed. Keys under global are keys that always run. Keys under specific apps run only when you execute a certain Windows-installed application.

Important Notice!!! The information below is not meant to be used as a registry script.

Windows Registry Editor Version 5.00

;Global Applications

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
;Loaded with every application linked with User.dll
"AppInit_DLLs"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
;Loaded with logon
"Shell"=""
;Loaded with logon
"Userinit"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
;Loaded with specific logon event

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
;Loaded at boot
"BootExecute"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
;Loaded as a subsystem


;Specific Applications

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET\(Version)]
;.NET Framework
"DllFullPath"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor]
;Command Prompt
"AutoRun"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
;Task Scheduler