Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What i know is that most viruses use the registry/start up folder to add them to the start up list. Other may use an auto start windows service.

What about the rest, if the virus is not in the services or the start up list how does it start up then?

I recently had this problem i cleaned almost all suspicious start up registry entries and services and still the virus was starting up each time i booted into windows.

Any ideas?

share|improve this question
add comment

migrated from stackoverflow.com Feb 24 '10 at 11:47

This question came from our site for professional and enthusiast programmers.

4 Answers

Windows provides zillions of hooks where malicious code could be added... Sysinternals' Autoruns provides a list of many of those. It might help.

share|improve this answer
2  
+1 for "zillons" –  ukanth Feb 24 '10 at 11:59
    
You can see from the sheer number of tabs in Autoruns' GUI, just how many different ways there are for code to be started in Windows. –  njd Feb 24 '10 at 18:14
add comment

You can start them by running an infected file - "infected" means that some other instance of the malware has added a copy of its code to a previously safe executable program, so that when you run that program, it also runs the malware code.

Boot-sector

When a PC boots, one of the first things it does is load the first block of data on the hard disk: normally that contains the Master Boot Record, which is a tiny program that finds a bootable operating system (Windows, Linux, whatever) and loads it.
But it's possible for that program to be modified, so that it loads some malicious software every time you boot your PC.

Autorun

A more common possibility these days is software hidden in USB flash drives: Windows traditionally looks for a file on every removable device (floppy, CD, USB drive) called Autorun.inf, which tells it which program(s) to run automatically; so it's quite easy for a program to lurk there and be loaded when you plug in your USB device.

10-15 years ago, this autorun feature was supposed to be a convenience, but nowadays it's downright dangerous.

share|improve this answer
add comment

There is also the possibility of a Rootkit which can hide itself completely from the operating system (Windows or otherwise)

share|improve this answer
add comment

The virus may have added itself to the boot record, the Windows boot loader or even some system file that's loaded at boot time.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.