The BigList of Known Spyware and Startup Methods

StartGuard Pro detects and removes all of the following spyware and other threats not yet identified.

List of Common Spyware Startup Registry Keys

Almost all spyware uses one of they following registry keys below to load itself onto your computer without you knowing it.  A registry key is a system setting used by Windows to store bits of information. StartGuard monitors all of these keys and some keys not listed here for spyware attempting to load itself onto your computer.

• HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml
• HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html
• HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain
• HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\run
• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEx
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
• HKEY_LOCAL_MACHINE\Software\Classes
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml
• HKEY_LOCAL_MACHINE\Software\Classes\PROTOCOLS\Filter\text/html
• HKEY_LOCAL_MACHINE\Software\Classes\PROTOCOLS\Filter\text/plain
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/webviewhtml
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEx
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

List of Common Spyware Startup File and Directory Locations

Spyware can also load itself by adding itself to the following files and directories.

• C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
• C:\Documents and Settings\<username>s\Start Menu\Programs\StartUp
• C:\<Windows Directory>\Start Menu\Programs\StartUp
• C:\<Windows Directory>\Profiles\All Users\Start Menu\Programs\StartUp
• C:\<Windows Directory>\WIN.INI; Section: [windows]; Line: Run= or Load=
• C:\<Windows Directory>\WININIT.INI; Section: [windows]; Line: Run= or Load=
   

Home | Summary | Known Spyware List | Contact
StartGuard ™ and StartGuard Pro ™ are trademarks of StartGuard Software.
Copyright © 2005-2009 StartGuard Software. All rights Reserved. Privacy Policy.