In «Komputernaya Gazeta» #10 (200) for 16 March 1999 I made my debut with the article «Breaking into Windows via registry». The talk in the article was about the places in the system registry, in initialization files, where the program can be registered to launch during the Windows boot. Since that time several new Windows versions have been released, new version have own features, and the amount of my knowledge has increased. It is high time to fill up the gaps.
The utility for system configuration MSConfig.exe
Beginning from Windows version 98, Microsoft supplies with utility «MSConfig.exe», which gives the convenient interface for management of files starting up while Windows boots. It is placed in Windows installation folder. One can launch it from «Run» dialog box. There is no option to add new item with the application or document name to start-up, but there is an option to turn off, not deleting, any of items present in the lists. There is another interesting option - to check the validity of the path corresponding to given start-up item, and to delete from the lists the items, which paths are not correct. In spite of the rather miserable functionality of this application, it fits for the users of system, but not for the administrators. I will refer to this utility under necessity further in the article.Startup from the initialization files
The description of places for startup will be delivered in chronological order, beginning from the first Windows version and obsolete technologies. The initialization files were inherited from 16-bit Windows versions, Microsoft declared several times about getting rid of obsolete files, but up to now they are actually processed during boot.There are two values in «Win.ini» file in «[windows]» section, which can be the place for startup. The first value is «load», the second one - «run». Their content «by default» is an empty string. The file names in them must contain no blanks; the composing of full file name in quotes is not admissible. In these values several file names can be enumerated by comma. Usually they are used for drivers loading, but can load «Trojan horses» or «keyboard spies».
Another initialization file, which can be used for applications startup is the «System.ini» file. There is a value «shell» in this file in «[boot]» section, which stores the name of Windows shell. The content «by default» of this value is «Explorer.exe». The value «shell» can contain the applications list for startup as command line parameters for «Explorer.exe». The «Explorer.exe» application processes the command line and tries to launch the applications or documents, enumerated in the command line. The requirements to the «shell» value format are the same as to above-mentioned values of «Win.ini» file. Last time this value is wide used for the network worms launch. This makes the localisation hard to reveal, as the administrators forget to check this value as a place for destructive applications startup.
«MSConfig.exe» utility allows checking the state and modifying the content of these three values: «load», «run», «shell», which are located in initialization files.
Startup folders
The first folder, which is worked through after the Windows booting finished, is the folder «StartUp», which can stores the list of applications or documents shortcuts (*.lnk). One can see its state, passed by the «Start» into the submenu «Programs». This is the folder, corresponding to the «Current User».In order to find its location, one must to find in the system registry the «HKEY_CURRENT_USER \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\User Shell Folders» key storing the locations of all the changed folders and to search out the value «Startup» of string type. If the needed value is missing, that its location on hard drive «by default» is registered in the system registry in «Startup» value of «HKEY_CURRENT_USER \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\Shell Folders» key.
The utility for the system tuning «MSConfig.exe» shows the shortcuts to applications, which are located in «StartUp» folder. If any item is turned off using the «MSConfig.exe», that the folder named «Disabled Startup Items» will be created in «Programs» folder (it is the submenu in the «Start» menu), where «MSConfig.exe» will move the disabled item. In order to temporarily exclude the shortcut from the startup I resort to much simpler method: I set the attribute «hidden» on the needed shortcut and it will be omitted during the next booting.
The next folder is «Common» for all users - folder «StartUp» (Common Startup Folder), which is also processed after Windows booting to search for the shortcuts to documents or applications. One can see it in submenu «Start» in Windows NT or 2000. Its content is not shown in Windows 9.x, ME. It must store the shortcuts common for all users' profiles. This folder created for multi-users mode as reported in Microsoft documentation (MSDN). However, its content is processed, even Windows 95, 98, ME work in single-user mode.
The value «Common Startup» in «HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\User Shell Folders» system registry key, which store the locations of all the changed folders, stores its registered location on the hard drive. If this value is missing, one must search of this folder location «by default» in «Common Startup» in «HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\Shell Folders» key.
«MSConfig.exe» also shows the list of executables located in «Common» (general for all the users) «StartUp» folder. If using the «MSConfig.exe» turns off any item, the folder with name «Disabled Startup Items» will be created in the same, where the «Common StartUp» folder is located, folder, and the disabled item will be moved there.
The administrators are to pay attention to this folder content as to place of possible application startup.
System registry: startup, common for all Windows versions
There is the branch «SOFTWARE\Microsoft\Windows\CurrentVersion» in the Windows system registry containing several groups for applications startup. All these groups can be in the both HKEY_LOCAL_MACHINE hive and HKEY_CURRENT_USER hive. The description is general; all can be extrapolated for both these hives. If Windows is used in multi-user mode, in other words, this is either Windows version NT/2000/XP, or 95, 98, ME with user profiles enabled, one must also search these groups in «HKEY_USERS\.Default» hive. This branch is common for all the users of system. If Windows 95, 98, ME work in single-user mode, the «HKEY_USERS\.Default» branch is identical to the HKEY_CURRENT_USER branch.So then, I give the full paths to keys:
«SOFTWARE\Microsoft\Windows\CurrentVersion\Run»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce»,
which can contain the string values with applications or documents names launching during the system starts. The «RunOnce» branch is not supported in Windows NT 3.5. The names of string values, which are located in these keys, can be arbitrary.
Further I deliver few rules, orientated on which one can better understand the process and the order of applications launch registered in those or other places for startup:
- The keys, located in HKEY_LOCAL_MACHINE hive, are processed earlier than corresponding keys, located in HKEY_CURRENT_USER hive.
- The content of «RunServices», «RunServicesOnce» system registry keys is processed earlier than values in «Run», «RunOnce» keys.
- The launch of «RunServices» and «RunServicesOnce» happens before the displaying of user logon dialog box, further goes asynchronously with logon dialog box and can continue after successful registration. The applications, registered in system registry values, located in «RunServices» and «RunServicesOnce» are launched asynchronously, and therefore there can be the situation when they work simultaneously.
- The launch of applications or documents, as it follows from the very name, registered in «RunOnce» and «RunServicesOnce» keys, happens one time irrespective whether it is successful or not. The value, located in «RunOnce» or «RunServicesOnce» key, is removed before the launch of application, which name it contains.
- The values, stored in «Run», «RunOnce» keys, are launched synchronously and in indefinite order, but only, when the content of «RunServices» and «RunServicesOnce» finishes loading.
The list located in «RunServices» and «Run» keys, which automatically startup while Windows boots, can be controlled with the application for the system tuning «MSConfig.exe». If any item form the list is disabled, the «MSConfig.exe» will move this item to «RunServices-» or «Run-» correspondingly.
The «Setup» key, which can be stored in «RunOnce» key both in HKEY_LOCAL_MACHINE hive and HKEY_CURRENT_USER hive, is worthy attention. This key is used by either the Windows Setup Wizard or «Add/Remove Programs» Wizard. While working through the values containing in this key, dialog box with the progress bar is displayed. The name of item is used as a name of item in dialog box. Analogously to the content «RunOnce» key, the item of the «RunOnce\Setup» are deleted and launched one time. Another system registry key, which is worthy attention, is «RunOnceEx». I will give the differences in launch for the values located in «RunOnceEx» and «RunOnce» from the launch of values located in system registry key «Run».
The values located in «RunOnceEx» key will not be launched. For the automatic processing the registry sub-key must be created in it and, this sub-key, which is to contain values with applications names. The keys and values located in «RunOnceEx» key are sorted in alphabetical order to force them to definite startup order compulsorily. In other words, the item higher by alphabet would be launched earlier, not depending when it was added to «RunOnceEx» key. The applications or scripts must either finish themselves or not require the definite action for finishing. While one item is not finished either further list processing stops or Windows booting stops waiting for compulsory terminating of the launched application. The separate processes are not created for the applications launched from «RunOnceEx» key in contrast to the «RunOnce» и «Run» keys.
«MSConfig.exe» application for the system tuning does not show the content of the keys «RunOnce», «RunOnceEx», «RunOnce\Setup» and «RunServicesOnce»
Startup features in Windows NT/2000/XP
As an addition to above-listed keys, the another key «Software\Microsoft\Windows NT\CurrentVersion \Windows\Run» is specific for Windows versions NT, 2000 and XP, which can be in hives LOCAL_MACHINE or HKEY_CURRENT_USER.There can be two string values «Load» and «Run» in «Software\Microsoft\Windows NT\CurrentVersion \Windows» key, which can store the list of applications for automatic startup.
These values are analogies to values of the same name from the initialisation file «Win.ini». When Windows NT (2000) is installed over Windows 95, 98 the values content from section «[windows]» of «Win.ini» are transferred to the corresponding values of «Software\Microsoft\Windows NT\CurrentVersion\ Windows» key. If several files are registered in the value, their names must be separated with space chars. Therefore the path to file containing the space char can not be written to them, the quotation marks are not accepted. The content «by default» for these values is the space char. The programs, which launched from «Load» value, are minimised during launch.
Startup features in Windows ME/2000/XP
Windows versions has another one list for documents or applications startup, launching after the user registration in the system, which can be located both in HKEY_LOCAL_MACHINE hive and HKEY_CURRENT_USER hive. It is stored in string values of «Software\Microsoft\Windows\CurrentVersion \Policies\Explorer\Run» key. The names of values for this key have one distinctive feature: they must be represented in the form of ordinal numbers, beginning at «1». The list located in HKEY_LOCAL_MACHINE hive will be processed before the list of HKEY_CURRENT_USER hive.Startup while Windows Logon
The separate group Windows Logon for the control over the initialisation during the user registration appears in Windows NT and is developed further by Microsoft for Windows version 2000 and XP. The Winlogon values are located in the system registry in «SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon» key of HKEY_LOCAL_MACHINE hive. All the described in the article values, related to Winlogon, have the string type.Shell value
The «Shell» value standing for the program shell, is present in the system registry branch «Winlogon» in Windows versions NT, 2000 and XP.This string value determines the list of executable files providing the operating system with the user interface, and which must be launched together with the program shell.
«By default» Windows launches the programs, enlisted in «Userinit» value, located in «Winlogon» branch, and including very «Userinit.exe». If, by any reason, «Winlogon» process could not launch the programs defined in «Userinit» value, then «Winlogon» would directly go to process the executable files, which name are registered in «Shell» value.
The «value by default» of «Shell» can vary. This is «taskman, progman, wowexec» for Windows NT and «Explorer.exe» for Windows 2000, XP.
System value
This value is present in Windows versions NT, 2000 and XP. It contains the list of executable files launched by Winlogon in the system context during the system initialisation. This list can be varied by modification of this value.The «value by default» is «lsass.exe, spoolss.exe» for Windows NT and «lsass.exe» for Windows 2000, XP. The note by Microsoft given in MSDN is interesting: «This entry appears in the registry, but it is not used by Windows».
VmApplet value
«VmApplet» value launching the «Control Panel» application for the system configuration is specific for Windows versions 2000 и XP.
It stores the list or one executable file, which is launched by Winlogon process to let user to adjust the virtual memory settings, if the system volume misses the paging swap-file. The file extensions for the file name are not obligatory.
The «value by default» for it is «rundll32 shell32, Control_RunDLL "sysdm.cpl"». One must not change the content of this value without need, because it can lead to the change of virtual memory settings in Windows 2000, XP.
Userinit value
«Userinit» (user initialization) is specific for Windows versions NT, 2000 and XP.The content of this value contains the executables, which are launched by WinLogon process in user context, during the user registration in the system.
«By default» Winlogon launches «Userinit.exe», which is responsible for the launch of program shell, and executes the script files for registration, re-establishes the network connections and then launches the «Explorer.exe».
The «value by default» for «Userinit» is «userinit, nddeagnt.exe» for Windows NT, «userinit» for Windows 2000, XP. «nddeagnt.exe» application is necessary for the NetDDE launch - network dynamic data exchange.
The extensions in file name enumerated in this value are not obligatory.
One may change the content of this value by adding or removing the programs from the list. «Userinit.exe» can be changed to the name of one's own program, not having forgotten to include in application the code for «Userinit.exe» launch, if it is necessary to launch the application before the user interface together with the Windows «explorer» is loaded. Or make much simpler, creating the executable file for batch processing named «userinit.bat» with the list of programs for launch and registering in one of the lines the very «Userinit.exe» file.
P.S. These are administrators, but not hackers, who were addressed with the information, systematised in this article. The official Microsoft documentation contains in such or other form all the knowledge given in the article.
Valient Newman aka Black Prince
All of these was realised in Activity and Authentication Analyzer
