|
The BigList of Known Spyware and Startup
Methods
StartGuard Pro detects and removes all of the following
spyware and other threats not yet identified.
List of Common Spyware Startup
Registry Keys
Almost all spyware uses one of they following registry
keys below to load itself onto your computer without you knowing it. A registry
key is a system setting used by Windows to store bits of information. StartGuard
monitors all of these keys and some keys not listed here for spyware attempting
to load itself onto your computer.
- HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml
- HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html
- HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain
- HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\run
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEx
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
- HKEY_LOCAL_MACHINE\Software\Classes
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml
- HKEY_LOCAL_MACHINE\Software\Classes\PROTOCOLS\Filter\text/html
- HKEY_LOCAL_MACHINE\Software\Classes\PROTOCOLS\Filter\text/plain
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/webviewhtml
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEx
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
List of Common Spyware Startup
File and Directory Locations
Spyware can also load itself by adding itself to
the following files and directories.
- C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
- C:\Documents and Settings\<username>s\Start Menu\Programs\StartUp
- C:\<Windows Directory>\Start Menu\Programs\StartUp
- C:\<Windows Directory>\Profiles\All Users\Start Menu\Programs\StartUp
- C:\<Windows Directory>\WIN.INI; Section: [windows]; Line: Run= or Load=
- C:\<Windows Directory>\WININIT.INI; Section: [windows]; Line: Run= or Load=
Home
|
Summary
|
Known Spyware List
| Contact
StartGuard ™ and StartGuard Pro
™ are trademarks of StartGuard Software.
Copyright © 2005-2009 StartGuard Software. All rights Reserved. Privacy Policy.
|