Autostart / RUN
Diese Orte durchsucht Windows nach Autostart-Einträgen:
o HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
o HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
o HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal
o HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
o HKLM\System\CurrentControlSet\Control\Terminal Server
o HKLM\SOFTWARE\Wow6432Node\Classes\*\ShellEx\ContextMenuHandlers
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
o HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\
Explorer\Browser Helper Objects
o HKLM\System\CurrentControlSet\Services
o HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
o HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Einträge über MS-Config:
o HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg