Anti-startup

[mary]

hi!

I'm under admin account (xp and vista). my goal is to "freeze" my startup list (process and services that start with windows) and prohibit (or delete) any other modification of this whitelist.

my code need to start at the first and stop at the last ( to prevent any virus or spyware startup techniques).

any idea ?

thanks

[maqleod]

hi!

I'm under admin account (xp and vista). my goal is to "freeze" my startup list (process and services that start with windows) and prohibit (or delete) any other modification of this whitelist.

my code need to start at the first and stop at the last ( to prevent any virus or spyware startup techniques).

any idea ?

thanks

first start with this program:

http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx

it will give you EVERY possible start location and all that is starting with Windows. It also has a command line version that you can query if you want to include it in your script.

Essentially you need a list of all the microsoft signed items (items that are default for windows) and standard third party list (like adobe, or java scheduler, etc). Then the ability to add to the list (via ini file or something on that order)

[mary]

Thanks maqleod !

very nice tools !

Now we know that it is possible to detect new entries ! so we can delete any added ones (virus or spyware), but how we can be sure that our script will be executed:

- before any others ?

-or to be the lastest one before system shutdown/reboot ?

so virus or spyware can't restore their own entries !

thanks a lot

Edited April 1, 2009 by mary