The majority of malware needs to take control of the system when it is started. In most cases, there are two fundamental methods and processes to accomplish this:
- in the first place the creation, in the Windows registry autorun keys, of the link to the infected file.
- in the second place, the creation of a copy of the infected file in the Windows autorun directory.
The registry has a considerable number of autorun keys: Run, RunService, RunOnce and RunServiceOnce:
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\]
[HKEY_CURRENT_USER\SOFTWARE\
Microsoft\Windows\CurrentVersion\]
In case of infection, the search executed in these locations will produce the identification of different keys, with paths that lead to the malicious executables.
So, Windows registry and critical system files monitoring, are one of the main tasks that a good antivirus must have.