注册表项HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components的作用
2007-11-30 14:06:27
Monitoring of the Active Setup Registry Key
What is the Active Setup?
Why monitor this key?
Microsoft uses this key to setup installed Windows components.
You can see a list of the installed components under the key
HKLM\Software\Microsoft\Active Setup\Installed Components
You should launch RegEdit to view it.
As you can see, the registry key of each component has a list of values.
These values are used by Windows to identify a component.
One of these values, StubPath, is very important.
This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).
Active Setup is used by new Trojans to install them to the computer.
This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.
从上面看，这个项目也是系统启动项目，很容易被木马所利用。 本文出自 51CTO.COM技术博客 |
xiong2127
博客统计信息
热门文章
最新评论
友情链接