I wonder what are the main registry windows keys malware target often ? I would love to code a program that will check the state of those windows registry keys for eventual modifications by malware.


The most common? Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup. Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much.

The problem with simply watching registry keys for modification is that normal programs also change many of them. You can't, for example, tell the difference between a spyware toolbar installing itself and an ordinary toolbar being installed just by watching Internet Explorer's section of the registry.

  • Suppose I decide not to install any additional software to my Windows XP (on a virtual machine): will HKLM\Software\Microsoft\Windows\CurrentVersion\Run remain unchanged ? – user45139 Jul 10 '14 at 7:40
  • 1
    If you do not install any software, and you do not change the run-at-start settings of any software, and none of the software you've installed changes run-at-start behavior on its own, it shouldn't change. – Mark Jul 10 '14 at 7:44
  • 1
    There is no such thing as an ordinary toolbar! – executifs Jul 10 '14 at 8:42
  • @executifs What do you mean by your comment ? Explain, please. – user45139 Jul 10 '14 at 13:39
  • 2
    Just a witty remark implying that no toolbar is ever legitimate; they're always some kind of adware/spyware instead. By the way, the program you intend to develop exists and is called Sysinternal's autoruns. – executifs Jul 10 '14 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy