We know that Windows has its own startup folder, which is the most common startup project, but many people pay little attention to check it. If you load the program into this folder, the system will automatically load the program when it starts, and because it is exposed, it is very easy to be changed by external factors.
a specific location is "Start", "start" menu option
location on the hard drive is: C: \\ Documents andSettings \\ Administrator \\ "Start" menu \\ programs \\ Startup;
The location in the registry is:
HKEY_Current_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
Second, Msconfig
Msconfig is "System Configuration Utility" in Windows system, it can be wide enough, including: system.ini, win.ini, startup project, and so on. Similarly, it is also a place that the self-starting program likes to stay very much!
1.System.ini
First, enter "msconfig" in the "Run" dialog box to start the system configuration utility (under The same), find the system.ini tag, inside the "shell=..." can be used to load special programs. If your shell= is not the default explorer.exe, or there is a program name behind it, then you should be careful, please check the corresponding program is safe!
2.Win.ini
If we want to load a program: hack.exe, then it can be in win. Ini is implemented with the following statement:
[Windows]
load=hack.exe
run=hacke.exe
3. "Start "Project
The startup tab in the System Configuration Utility is not the same thing as the "Startup" folder we mentioned above. This startup project in the System Configuration Utility is a collection of Windows system startup projects. Ground. Almost all startup projects can be found here - of course, specially programmed programs can be displayed here in another way.
Open the "Startup" tab, the "Startup Project" lists the name of the boot program, the "Command" is the specific program add-on command, the last "Location" is the program in the registry Corresponding location. You can perform detailed path and command check on suspicious programs. Once you find an error, you can use the "Disable" below to disable the program from loading at boot time.
general, in addition to foreign-based system to start the project hardware and system software core part of other start-up projects can all be modified as appropriate, include: anti-virus program, firewall program-specific, player, memory Management software, etc. In other words, the startup project contains a list of all our visible programs, and you can use it to manage your startup program.
Third, the registry corresponding boot loader project
registry startup project is a favorite of viruses and Trojans! Refractory lot Trojan virus is achieved through the registry So, usually you can download a registry monitor to monitor changes to the registry. Later versions of Rubik's Cube (click here to download) will also add a series of security features to monitor malware modifications to the system, etc. . Especially when installing new software or running a new program, be sure not to be confused by the beautiful appearance of the program. Be sure to see if its essence is the Trojan's camouflage shell or bundled program! If necessary, you can restore the registry according to the backup. There are many such registry programs online, so I won't go into details here.
We can also be checked by the manual method appropriate location in the registry, although they are much talked about position and repeat the above, but in terms of network security, careful never too much!
Pay attention to the corresponding keys in the safe and clean system registry. If you find inconsistencies, be sure to find out what it is! Don't trust the "system", "Windows", "programfiles", etc. written outside. The name, everyone knows the truth of "to cover the glory." If, after a detailed comparison, can determine which program is unclear, do not be soft, remove immediately!
four, Wininit.ini
we know, Windows installer often call this program be implemented After the installation process, delete the work, so don't underestimate it. If you do it on it, it can be said to be very covert and perfect!
It is opened in Notepad in the Windows directory of the system disk. It (sometimes the wininit.hak file) can see the corresponding content. Obviously, we can add corresponding statements to modify the system program or delete the program. If the file is associated with Trojan, you can delete the original file by winint.ini after it infects, so as to achieve truly hide yourself!
V. fighting
under DOS Finally, we talk about The startup project under DOS is loaded, and the files such as config.sys, autoexec.bat, *.bat, etc. can be loaded in a specific programming manner. So don't think that DOS is an outdated thing. Good DOS programming can often achieve very simple and very useful functions.