Someone says that he knows ho to run a program at Windows start up and he is NOT usin the : -registry -system.ini -autoexec.bat -config.sys Does anyone know how it is posible ? BYE (excuse the typing errors)
Posted on 2001-06-13 08:13:00 by Rosky
My immediate answer is put it on the Start->Programs->Startup folder, and it will get run. You can also install a program as a service and it will run at startup. On Windows NT you can get your service to run at boot time, before anyone logs in. There is also a way, under Windows NT, toget a program runnning just after boot, before the GUI gets going.... theres an example of that at sysinternals umbongo
Posted on 2001-06-13 08:24:00 by umbongo
Ok ! but the problem is that the program i mentioned vorks on Win95 and it certainly not in the start up !!! nor in the other places i mentioned earlier(surely not in the registry ) Where can it be ?? (I heared there is a troyan that works linke this prog but i do not know it's name nor where to find it)
Posted on 2001-06-22 14:52:00 by Rosky
Ros, i don't quite understand your problem. I assume you mean that the program start everytime you start your computer, but the problem is that you can't find that anywhere in what you've mentioned. is that correct? let's assume that target.exe execute everytime you started your window, but target.exe doesn't exist anywhere in registry, nor win.ini or autoexec.bat <--- is that your question? c:\windows\all user <----- have a look in there.
Posted on 2001-06-22 15:07:00 by disease_2000
Thank you You'r saying that if i put an exe in "c:\windows\all user" it will run every time i start windows ? i already tried that but it doesnt work ! (maybe some special setings before)
Posted on 2001-06-22 15:25:00 by Rosky
Rosky, For windows 95 you can put a line in system.ini like this:-

load=c:\myprogram.exe

or



that will run it while 95 is loading.

umbongo
Posted on 2001-06-22 15:42:00 by umbongo
Rosky, For windows 95 you can put a line in system.ini like this:-

load=c:\myprogram.exe

or

run=c:\myprogram.exe
that will run it while 95 is loading. umbongo
Posted on 2001-06-22 15:43:00 by umbongo
Nop it's not in the system.ini
Posted on 2001-06-22 15:50:00 by Rosky
What is the nature of the program. You stated that someone said he runs a program, but it seems like you have access to his computer. Did list off where that program wasn't, or you are not able to find it? Do you know the name of the exe? Is something you're trying to remove? Do a logged start up (using the Start Up menu). Then search through c:\BOOTLOG.TXT. The location within the file will give a clue as to what is invoking it.
Posted on 2001-06-22 21:37:00 by eet_1024
You might find the answer here: All Known and (so called) Unknown Autostart Methods http://www.softwarecreations.co.nz/security/Autostart%20Methods.htm
Posted on 2001-06-23 01:39:00 by Kayaker
There are sure a lot of places to hide an executable. This message was edited by eet_1024, on 6/23/2001 1:45:27 AM
Posted on 2001-06-23 01:44:00 by eet_1024
regedit HKLocalMachine software microsoft windows run runonce also the "runservice" and "runserviceonce" entries those keys are repeated under HKDefaultUser
Posted on 2001-06-23 19:46:00 by Anonymous
SubSeven v2.2 has options to startup the trojan in many new ways. I suggest u do a search for it and read about how it starts up in those new ways. This way u should come to know how the app is started. P.S.- i am not trying to promote this trojan or anything. I have suggested the above so that u only come to know how the win progs can be loaded at startup in new ways. It doesnt mean u go and try out the trojan at somebody.
Posted on 2001-06-24 10:16:00 by MovingFulcrum