起源 ：CoolDiyer's Blog

注册表
 一.

HKEY_LOCAL_MACHINE\Software\Microsoft\windows/">windows\Curr entVersion\Run\
All values in this key are executed.
 二.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce\
All values in this key are executed, and then their autostart reference is deleted.
 三.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunServices\
All values in this key are executed as services.
 四.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunServicesOnce\
All values in this key are executed as services, and then their autostart reference is deleted.
 五.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\
All values in this key are executed.
 六.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce\
All values in this key are executed, and then their autostart reference is deleted.
 七.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce\Setup\
Used only by Setup. Displays a progress dialog box as the keys are run one at a time.
 八.

HKEY_USERS\.Default\Software\Microsoft\Windows\Cur rentVersion\Run\
Similar to the Run key from HKEY_CURRENT_USER.
 九.

HKEY_USERS\.Default\Software\Microsoft\Windows\Cur rentVersion\RunOnce\
Similar to the RunOnce key from HKEY_CURRENT_USER.
 一0.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
The "Shell"大众value is monitored. This value is executed after you log in.
 一 一.

HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\
All subkeys are monitored, with special attention paid to the "StubPath"大众value in each subkey.
 一 二.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\VxD\
All subkeys are monitored, with special attention paid to the "StaticVXD"大众value in each subkey.
 一 三.

HKEY_CURRENT_USER\Control Panel\Desktop
The "SCRNSAVE.EXE公众value is monitored. This value is launched when your screen saver activates.
 一 四.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Session Manager
The "BootExecute"大众value is monitored. Files listed here are Native Applications that are executed before Windows starts.
 一 五.

HKEY_CLASSES_ROOT\vbsfile\shell\open\co妹妹and\
Executed whenever a .VBS file (Visual Basic Script) is run.
 一 六.

HKEY_CLASSES_ROOT\vbefile\shell\open\co妹妹and\
Executed whenever a .VBE file (Encoded Visual Basic Script) is run.
 一 七.

HKEY_CLASSES_ROOT\jsfile\shell\open\co妹妹and\
Executed whenever a .JS file (Javascript) is run.
 一 八.

HKEY_CLASSES_ROOT\jsefile\shell\open\co妹妹and\
Executed whenever a .JSE file (Encoded Javascript) is run.
 一 九.

HKEY_CLASSES_ROOT\wshfile\shell\open\co妹妹and\
Executed whenever a .WSH file (Windows Scripting Host) is run.
 二0.

HKEY_CLASSES_ROOT\wsffile\shell\open\co妹妹and\
Executed whenever a .WSF file (Windows Scripting File) is run.
 二 一.

HKEY_CLASSES_ROOT\exefile\shell\open\co妹妹and\
Executed whenever a .EXE file (Executable) is run.
 二 二.

HKEY_CLASSES_ROOT\comfile\shell\open\co妹妹and\
Executed whenever a .COM file (Co妹妹and) is run.
 二 三.

HKEY_CLASSES_ROOT\batfile\shell\open\co妹妹and\
Executed whenever a .BAT file (Batch Co妹妹and) is run.
 二 四.

HKEY_CLASSES_ROOT\scrfile\shell\open\co妹妹and\
Executed whenever a .SCR file (Screen Saver) is run.
 二 五.

HKEY_CLASSES_ROOT\piffile\shell\open\co妹妹and\
Executed whenever a .PIF file (Portable Interchange Format) is run.
 二 六.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\
Services marked to startup automatically are executed before user login.
 二 七.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock 二\Parameters\Protocol_Catalog\Catalog_En tries\
Layered Service Providers, executed before user login.
 二 八.

HKEY_LOCAL_MACHINE\System\Control\WOW\cmdline
Executed when a  一 六-bit Windows executable is executed.
 二 九.

HKEY_LOCAL_MACHINE\System\Control\WOW\wowcmdline
Executed when a  一 六-bit DOS application is executed.
 三0.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Executed when a user logs in.
 三 一.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\
Executed by explorer.exe as soon as it has loaded.
 三 二.

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\run
Executed when the user logs in.
 三 三.

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
Executed when the user logs in.
 三 四.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\run\
Subvalues are executed when Explorer initialises.
 三 五.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Policies\Explorer\run\
Subvalues are executed when Explorer initialises.

文献夹
 一. windir\Start Menu\Programs\Startup\
 二. User\Startup\
 三. All Users\Startup\
 四. windir\system\iosubsys\
 五. windir\system\v妹妹 三 二\
 六. windir\Tasks\

文献
 一. c:\explorer.exe
 二. c:\autoexec.bat
 三. c:\config.sys
 四. windir\wininit.ini
 五. windir\winstart.bat
 六. windir\win.ini - [windows] "load"
 七. windir\win.ini - [windows] "run"
 八. windir\system.ini - [boot] "shell"
 九. windir\system.ini - [boot] "scrnsave.exe"
 一0. windir\dosstart.bat
 一 一. windir\system\autoexec.nt
 一 二. windir\system\config.nt