Monday, December 20, 2010

【 Weak current College 】 detailed Windows 7 startup items


We know that the Windows in the startup folder, it is the most common startup project, but many people have given little attention to double-check it. If the program loaded into this folder, the system starts, it automatically loads the appropriate program, and, because it is exposed, so very vulnerable to external factors change.

First, the specific location is the "start" menu "start" option

The location on your hard disk is: Start menu C:\DocumentsandSettings\Administrator\ "\"; \

In the registry location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Now you can open and see what's inside UN-registered procedures exist.

Second, Msconfig

Msconfig is a Windows system in the "system configuration utility", it can reach of wide, including: system.ini, win.ini and startup items, etc. Similarly, there is also a very self Launcher like staying place!

1.System.ini

First of all, in the "run" dialog box, enter "msconfig" and start the system configuration utility (hereinafter the same), locate the system.ini tab, inside the "shell = ..." can be used to load a special program. If your shell = no is the default explorer.exe, or followed by the name of a program, you may have to be careful, please carefully review the appropriate program is secure!

2.Win.ini

If we want to load a program: hack.exe, so you can win. Ini with the following statement:

[windows]

load=hack.exe

run=hacke.exe

What to do, you should know!

This point, use the Rubik's cube (click here to download) in system setup-start settings at a glance, and you can easily remove and add startup items.

3. the "start" project

System configuration utility to start the label and we start talking about "above" folder and are not the same thing, in the system configuration utility in the startup items, Windows system startup items in the collection. Almost all the startup items can be found here: of course, the special programming process through other methods do not appear here.

Open "start" tab, the "startup items" in the list is the name of the start-up procedure, under the "command" is a specific program additional command, the last of the "location" is the program in the appropriate location in the registry. You can program against suspicious conduct detailed path, command check, once the errors found, you can use the "disable" below to disable the program on time of loading.

In General, in addition to the system based on hardware and kernel part of system software startup items, startup items are appropriate changes, including: anti-virus programs, specific firewall programs, playback software, memory management, software, etc. That is, start a project contains all of the list of our visible, you can use it to manage your startup programs!

3. the registry starts in the loaded project

Registry startup item is virus and Trojan horse love! so many virus Trojan's intractable is achieved through the registry, so the usual time can download a registry monitor to monitor registry changes, Rubik's cube (click here to download), later versions will include a series of security features used to monitor the malware on the system changes, and so on. Especially after installing the new software or run a new program, be sure not to be confused that beautiful appearance. Be sure to see it in real terms is not a Trojan horse masquerading envelope or a bundled program! necessary can backup to restore the registry, the registry program online a lot, there is no longer judged fairly.

We also can perform manual method to check the location in the registry, although they are and where repeat above stresses, but on network security, be careful and never too much!

Note with a safe, clean the system registry is compared to the corresponding key, if found inconsistencies, it is important to make sure it is something! don't believe write on the outside of the "system" and "windows" and "programfiles" and other names, and everybody knows that "trying". If a detailed comparison, you can determine if it is unknown program, do not hesitate and immediately deleted!

IV. Wininit.ini

We know that Windows Installer is often called the program installer after delete work, so don't underestimate it, if you play tricks on it, it can be said is very subtle and very perfect!

It's in the system tray of the Windows directory, open it with Notepad (sometimes wininit.hak file) you can see the content. Obviously, we can add the corresponding statement to modify the system program or remove programs. If the file association-Trojan horse, you can delete it by winint.ini infection after the original file, so as to achieve genuine hide yourself!

5. the battle under DOS

Finally, we talk about DOS boot project loaded, config.sys, autoexec.bat, * .bat files can be specified programmatically to achieve the purpose of the loader. So don't think that DOS is an outdated stuff, good DOS programming often can achieve is very simple, very useful feature!

No comments:

Post a Comment