Besides HK_Local ... Run, what other vectors do viruses use to launch from?

  • Thread starter Thread starter GaryH
  • Start date Start date
G

GaryH

A virus originates from a file that gets executed sometime during your
session on the PC.
I know to look in the Run section of the registry to see if it is being
lauched from there, but
if it's not there, where else might I look. Might it still be in the
registry but
hidden the same way you can turn on the hidden attribute of a file?
 
GaryH said:
A virus originates from a file that gets executed sometime during your
session on the PC.
I know to look in the Run section of the registry to see if it is
being lauched from there, but
if it's not there, where else might I look. Might it still be in the
registry but
hidden the same way you can turn on the hidden attribute of a file?
Click to expand...

GaryH:

Get a copy of StartupList from:

http://www.spywareinfo.com/~merijn/downloads.html

and run it in verbose mode. It will give you a very good idea of the
various places in and out of the Registry for where files are launched from.
Note that this product is also included with HijackThis.

Steve
 
GaryH said:
A virus originates from a file that gets executed sometime during your
session on the PC.
I know to look in the Run section of the registry to see if it is being
lauched from there, but
if it's not there, where else might I look.
Click to expand...

If you are trying to find all possible places that malware can use to ensure it runs again when the computer is rebooted,
then maybe this will help.

http://www.governmentsecurity.org/articles/Placesthatvirusesandtrojanshideonstartup.php
Might it still be in the
registry but
hidden the same way you can turn on the hidden attribute of a file?
Click to expand...

The registry editor that you use may be compromised, or a rootkit could intercept requested information before
it gets to the editor. Some recent malwares have opted to modify "Media Player" so that whenever the user tries
to play a media file the malware is started again. If you eliminate all of the startup axis points of interest, and you
remove all of the malware executables that were obvious to you, you could assume you were malware free until
you play any media file and the trojanized "player" reinstalls the malware again.

Are you experiencing a specific problem, or just trying to learn more about security?
 
No specific problem on my machine but friends & co-workers often ask me to
help them out. Just thought I'd bone up on my anti-virus trouble shooting
skills. Thanks for your suggestions.

Roger Wilco said:
If you are trying to find all possible places that malware can use to
Click to expand...
ensure it runs again when the computer is rebooted,
then maybe this will help.

http://www.governmentsecurity.org/articles/Placesthatvirusesandtrojanshideonstartup.php

The registry editor that you use may be compromised, or a rootkit could
Click to expand...
intercept requested information before
it gets to the editor. Some recent malwares have opted to modify "Media
Click to expand...
Player" so that whenever the user tries
to play a media file the malware is started again. If you eliminate all of
Click to expand...
the startup axis points of interest, and you
remove all of the malware executables that were obvious to you, you could
Click to expand...
assume you were malware free until
 
Back
Top