Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Runtime Process = c:\windows\{filename} HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Runtime Process = c:\windows\{filename} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Runtime Process = c:\windows\{filename} HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Runtime Process = c:\windows\{filename} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion \policies\Explorer\Run Runtime Process = c:\windows\{filename} HKCU\Software\Microsoft\Windows NT \CurrentVersion\Windows\Run Runtime Process = c:\windows\{filename} HKLM\Software\Microsoft\Active Setup\Installed Components \{44BBA855-CC51-11CF-AAFA-00AA00B6017B} StubPath = "c:\windows\{filename} ComponentID = "Runtime Process" IsInstalled = 1 Locale = "en" Version = "4,88,55,1" ====================================================================== WIN.INI: [windows] load=c:\windows\{filename} run=c:\windows\{filename} ====================================================================== SYSTEM.INI: [boot] shell=Explorer.exe c:\windows\{filename} ====================================================================== Registry NT,2000,XP: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows load = "c:\windows\{filename}" run = "c:\windows\{filename}" HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon shell = "Explorer.exe c:\windows\{filename}"