注册表项HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components的作用
2012-10-30 21:02
615 查看
Monitoring of the Active Setup Registry Key
What is the Active Setup?
Why monitor this key?
Microsoft uses this key to setup installed Windows components.
You can see a list of the installed components under the key
HKLM\Software\Microsoft\Active Setup\Installed Components
You should launch RegEdit to view it.
As you can see, the registry key of each component has a list of values.
These values are used by Windows to identify a component.
One of these values, StubPath, is very important.
This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).
Active Setup is used by new Trojans to install them to the computer.
This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.
What is the Active Setup?
Why monitor this key?
Microsoft uses this key to setup installed Windows components.
You can see a list of the installed components under the key
HKLM\Software\Microsoft\Active Setup\Installed Components
You should launch RegEdit to view it.
As you can see, the registry key of each component has a list of values.
These values are used by Windows to identify a component.
One of these values, StubPath, is very important.
This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).
Active Setup is used by new Trojans to install them to the computer.
This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.
相关文章推荐
- 注册表项HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components的作用
- Cannot evaluate the property expression "$([MSBuild]::ValueOrDefault('$(VCTargetsPath)','$(MSBuildExtensionsPath32)\Microsoft.Cpp\v4.0\V140\'))" found at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSBuil
- The useful App Paths registry key : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
- vs2008 HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ MSBuild \ ToolsVersions \ 14.0
- 破解QTP10插件时,注册表中没有HKEY_LOCAL_MACHINE -- SOFTWARE -- mercury Interactive我们该怎么办?
- 错误 1402 不能打开HKEY_LOCAL_MACHINE\Software\Classes\Msxml.2.DOMDocument.4.0\CLSID 的问题(server2003 , virtual server 2005 r1)
- 关于安装VMware软件出现1021错误但文件HKEY LOCAL MACHINE\SOFTWARE\VMware Inc已删除仍报错的解决办法
- 关于异常“The 'Microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine”的处理
- The Microsoft.Jet.OLEDB.4.0 provider is not registered on the local machine (zz)
- The 'Microsoft.ACE.Oledb.12.0' provider is not registered on the local machine
- 关于异常“The 'Microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine”的处理
- RegOpenKeyA(HKEY_LOCAL_MACHINE, AppPath, &hKey)
- Error creating object Microsoft Data Access Components 2.1 (or later) have been properly installed
- 关于异常“The 'Microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine”的处理
- HKEY_LOCAL_MACHINE:hardware\DeviceMap\SerialComm里找不到串口的解决办法
- 注册表知识:HKEY_LOCAL_MACHINE根键详解
- The 'Microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine.
- Error 1406. Setup cannot write the value DisableExceptionChainValidation to the registry key \SOFTWARE\Microsoft\Windows NT\Curr
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
- Microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine