注册表项HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components的作用

    Monitoring of the Active Setup Registry Key

What is the Active Setup?

Why monitor this key?

Microsoft uses this key to setup installed Windows components.

You can see a list of the installed components under the key

HKLM\Software\Microsoft\Active Setup\Installed Components

You should launch RegEdit to view it.

As you can see, the registry key of each component has a list of values.

These values are used by Windows to identify a component.

One of these values, StubPath, is very important.

This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).

Active Setup is used by new Trojans to install them to the computer.

This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.