来源：CoolDiyers Blog
注册表 1.
HKEY_LOCAL_MACHINESoftwareMicrosoftwindows/">windowsCurr entVersionRun All values in this key are executed. 2.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunOnce All values in this key are executed, and then their autostart reference is deleted. 3.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunServices All values in this key are executed as services. 4.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunServicesOnce All values in this key are executed as services, and then their autostart reference is deleted. 5.
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRun All values in this key are executed. 6.
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunOnce All values in this key are executed, and then their autostart reference is deleted. 7.
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunOnceSetup Used only by Setup. Displays a progress dialog box as the keys are run one at a time. 8.
HKEY_USERS.DefaultSoftwareMicrosoftWindowsCur rentVersionRun Similar to the Run key from HKEY_CURRENT_USER. 9.
HKEY_USERS.DefaultSoftwareMicrosoftWindowsCur rentVersionRunOnce Similar to the RunOnce key from HKEY_CURRENT_USER. 10.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon The "Shell" value is monitored. This value is executed after you log in. 11.
HKEY_LOCAL_MACHINESoftwareMicrosoftActive SetupInstalled Components All subkeys are monitored, with special attention paid to the "StubPath" value in each subkey. 12.
HKEY_LOCAL_MACHINESystemCurrentControlSetServic esVxD All subkeys are monitored, with special attention paid to the "StaticVXD" value in each subkey. 13.
HKEY_CURRENT_USERControl PanelDesktop The "SCRNSAVE.EXE" value is monitored. This value is launched when your screen saver activates. 14.
HKEY_LOCAL_MACHINESystemCurrentControlSetContro lSession Manager The "BootExecute" value is monitored. Files listed here are Native Applications that are executed before Windows starts. 15.
HKEY_CLASSES_ROOTvbsfileshellopencommand Executed whenever a .VBS file (Visual Basic Script) is run. 16.
HKEY_CLASSES_ROOTvbefileshellopencommand Executed whenever a .VBE file (Encoded Visual Basic Script) is run. 17.
HKEY_CLASSES_ROOTjsfileshellopencommand Executed whenever a .JS file ( Java script) is run. 18.
HKEY_CLASSES_ROOTjsefileshellopencommand Executed whenever a .JSE file (Encoded Javascript) is run. 19.
HKEY_CLASSES_ROOTwshfileshellopencommand Executed whenever a .WSH file (Windows Scripting Host) is run. 20.
HKEY_CLASSES_ROOTwsffileshellopencommand Executed whenever a .WSF file (Windows Scripting File) is run. 21.
HKEY_CLASSES_ROOTexefileshellopencommand Executed whenever a .EXE file (Executable) is run. 22.
HKEY_CLASSES_ROOTcomfileshellopencommand Executed whenever a .COM file (Command) is run. 23.
HKEY_CLASSES_ROOTatfileshellopencommand Executed whenever a .BAT file (Batch Command) is run. 24.
HKEY_CLASSES_ROOTscrfileshellopencommand Executed whenever a .SCR file (Screen Saver) is run. 25.
HKEY_CLASSES_ROOTpiffileshellopencommand Executed whenever a .PIF file (Portable Interchange Format) is run. 26.
HKEY_LOCAL_MACHINESystemCurrentControlSetServic es Services marked to startup automatically are executed before user login. 27.
HKEY_LOCAL_MACHINESystemCurrentControlSetServic esWinsock2ParametersProtocol_CatalogCatalog_En tries Layered Service Providers, executed before user login. 28.
HKEY_LOCAL_MACHINESystemControlWOWcmdline Executed when a 16-bit Windows executable is executed. 29.
HKEY_LOCAL_MACHINESystemControlWOWwowcmdline Executed when a 16-bit DOS application is executed. 30.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonUserinit Executed when a user logs in. 31.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionShellServiceObjectDelayLoad Executed by explorer.exe as soon as it has loaded. 32.
HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindows un Executed when the user logs in. 33.
HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindowsload Executed when the user logs in. 34.
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionPoliciesExplorer un Subvalues are executed when Explorer initialises. 35.
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionPoliciesExplorer un Subvalues are executed when Explorer initialises.
文件夹 1. windirStart MenuProgramsStartup 2. UserStartup 3. All UsersStartup 4. windirsystemiosubsys 5. windirsystemvmm32 6. windirTasks
文件 1. c:explorer.exe 2. c:autoexec.bat 3. c:config.sys 4. windirwininit.ini 5. windirwinstart.bat 6. windirwin.ini - [ windows ] "load" 7. windirwin.ini - [windows] "run" 8. windirsystem.ini - [boot] "shell" 9. windirsystem.ini - [boot] "scrnsave.exe" 10. windir dos start.bat 11. windirsystemautoexec.nt 12. windirsystemconfig.nt
查看更多关于53种自启动方式 - Windows操作系统 - 自学php的详细内容...