forum.vdsworld.com

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

hello all

i was wondering if there are any other ways to have a vds program start up at pc boot up. besides start-up folder and registry run....

thanks

Dr. Dread · Posted: Mon Apr 19, 2004 7:20 am Post subject:

Naaa. Basically that's it. Though it can be diversified:

Windows Registry

All users\Run – Reg-key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
All users\Run Once – Reg-key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
All users\Run Services – Reg-key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
All users\Run Services Once – Reg-key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

Current user\Run – Reg-key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Current user\Run Once – Reg-key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Programs Startup menu.

Win.INI file. (Used to start programs under the older Win systems)

There may be some other non-standard ways for a program to get started, but that would probably be
something used by Trojans etc. to escape notice.

Greetz
Dr. Dread

bbelcher · Contributor Joined: 30 Jul 2002 Posts: 172

In windows 2000 / XP you could add your program into the Startup or Logon Scripts policy. To do this run the MMC console then ADD/REMOVE SNAP IN. Click ADD select GROUP POLICY click ADD then FINISH click OK then expand the LOCAL COMPUTER POLICY group expand the COMPUTER CONFIGURATION - WINDOWS SETTINGS. Also expand the USER CONFIGURATION- WINDOWS SETTINGS. I'm sure theirs a way to automate this process. The STARTUP script runs before you logon in or before the Gina starts.

FreezingFire · **Admin Team** Joined: 23 Jun 2002 Posts: 3508

If you want it to start before logon, you need to make it a service. Smile

bbelcher · Contributor Joined: 30 Jul 2002 Posts: 172

Service would be the way to go but the policy way will work for 2000 / xp I've made a script that checks for specfic settings if not pressent it shutsdown the computer. This all happends before the logon screen.

Skit3000 · Posted: Mon Apr 19, 2004 1:34 pm Post subject:

You could also replace the explorer.exe file with a kind of boot-loader, but that isn't a good solution to try on somebody else his pc... Wink

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

thanks all for the info i would like to learn about :

Skit3000 · Posted: Mon Apr 19, 2004 4:56 pm Post subject:

I think spyware starts up normal, but the only thing weird is that they always seem to find a way to get started even if you deleted the registry keys used, etc.... Sad

vtol · Posted: Mon Apr 19, 2004 5:08 pm Post subject:

Theres the old fashion ways, DOS autoexec.bat and system.ini exporer shell(win98) but its only used by Malicious people now maybe, not sure, been years since I used that kind of power of DOS(windose basement of old sewer pipes) hehe.

But everybody knows to check there 1st, so it wouldnt be very secretive Tim.

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

Skit3000 · Posted: Mon Apr 19, 2004 6:23 pm Post subject:

My best guess is that they replace files like notepad.exe or something, or that they change the file assosiation (spelled right this way?) so that for example .txt files will be started by the spyware program, which will pass it on to Notepad. This way, the user won't see the spyware program opening, but it is still there... Sad

The only bad thing about this is that if you want to remove spyware which will start this way, you need to know the proper values of almost every key in the registry... Sad

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

FreezingFire · **Admin Team** Joined: 23 Jun 2002 Posts: 3508

I wouldn't suggest using these methods in your programs as these could
be considered to be illegal, and if not, at the very least people will not
like your program at all.

Skit3000 · Posted: Mon Apr 19, 2004 6:45 pm Post subject:

No, the spyware will basicly just change the "open .txt file" action so that it will open the spyware program, so that it is able to be loaded even if it is removed from the startup folder.

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790