Someone says that he knows ho to run a program at Windows start up and he is NOT usin the :
-registry
-system.ini
-autoexec.bat
-config.sys
Does anyone know how it is posible ?
BYE
(excuse the typing errors)
My immediate answer is put it on the Start->Programs->Startup folder, and it will get run.
You can also install a program as a service and it will run at startup. On Windows NT you can get your service to run at boot time, before anyone logs in.
There is also a way, under Windows NT, toget a program runnning just after boot, before the GUI gets going.... theres an example of that at sysinternals
umbongo
Ok ! but the problem is that the program i mentioned vorks on Win95 and it certainly not in the start up !!! nor in the other places i mentioned earlier(surely not in the registry )
Where can it be ??
(I heared there is a troyan that works linke this prog but i do not know it's name nor where to find it)
Ros, i don't quite understand your problem. I assume you mean
that the program start everytime you start your computer, but
the problem is that you can't find that anywhere in what you've
mentioned. is that correct?
let's assume that target.exe execute everytime you started
your window, but target.exe doesn't exist anywhere in registry,
nor win.ini or autoexec.bat <--- is that your question?
c:\windows\all user <----- have a look in there.
Thank you
You'r saying that if i put an exe in "c:\windows\all user" it will run every time i start windows ?
i already tried that but it doesnt work !
(maybe some special setings before)
Rosky,
For windows 95 you can put a line in system.ini like this:-
load=c:\myprogram.exe
or
that will run it while 95 is loading.
umbongoRosky,
For windows 95 you can put a line in system.ini like this:-
load=c:\myprogram.exe
or
run=c:\myprogram.exe
Nop it's not in the system.ini
What is the nature of the program. You stated that someone said he runs a program, but it seems like you have access to his computer. Did list off where that program wasn't, or you are not able to find it? Do you know the name of the exe? Is something you're trying to remove?
Do a logged start up (using the Start Up menu). Then search through c:\BOOTLOG.TXT. The location within the file will give a clue as to what is invoking it.
You might find the answer here:
All Known and (so called) Unknown Autostart Methods
http://www.softwarecreations.co.nz/security/Autostart%20Methods.htm
There are sure a lot of places to hide an executable.
This message was edited by eet_1024, on 6/23/2001 1:45:27 AM
regedit
HKLocalMachine
software
microsoft
windows
run
runonce
also the "runservice" and "runserviceonce" entries
those keys are repeated under HKDefaultUser
SubSeven v2.2 has options to startup the trojan in many new ways. I suggest u do a search for it and read about how it starts up in those new ways. This way u should come to know how the app is started.
P.S.- i am not trying to promote this trojan or anything. I have suggested the above so that u only come to know how the win progs can be loaded at startup in new ways. It doesnt mean u go and try out the trojan at somebody.