Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What i know is that most viruses use the registry/start up folder to add them to the start up list. Other may use an auto start windows service.

What about the rest, if the virus is not in the services or the start up list how does it start up then?

I recently had this problem i cleaned almost all suspicious start up registry entries and services and still the virus was starting up each time i booted into windows.

Any ideas?

share|improve this question

migrated from Feb 24 '10 at 11:47

This question came from our site for professional and enthusiast programmers.

Windows provides zillions of hooks where malicious code could be added... Sysinternals' Autoruns provides a list of many of those. It might help.

share|improve this answer
+1 for "zillons" – ukanth Feb 24 '10 at 11:59
You can see from the sheer number of tabs in Autoruns' GUI, just how many different ways there are for code to be started in Windows. – njd Feb 24 '10 at 18:14

You can start them by running an infected file - "infected" means that some other instance of the malware has added a copy of its code to a previously safe executable program, so that when you run that program, it also runs the malware code.


When a PC boots, one of the first things it does is load the first block of data on the hard disk: normally that contains the Master Boot Record, which is a tiny program that finds a bootable operating system (Windows, Linux, whatever) and loads it.
But it's possible for that program to be modified, so that it loads some malicious software every time you boot your PC.


A more common possibility these days is software hidden in USB flash drives: Windows traditionally looks for a file on every removable device (floppy, CD, USB drive) called Autorun.inf, which tells it which program(s) to run automatically; so it's quite easy for a program to lurk there and be loaded when you plug in your USB device.

10-15 years ago, this autorun feature was supposed to be a convenience, but nowadays it's downright dangerous.

share|improve this answer

There is also the possibility of a Rootkit which can hide itself completely from the operating system (Windows or otherwise)

share|improve this answer

The virus may have added itself to the boot record, the Windows boot loader or even some system file that's loaded at boot time.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .