Cyber Security Essentials

mAliCious Code 215

ini, win.ini, and others. Exhibit 4-12 displays an example system.ini

file that allows the system to load various drivers and dynamic link

library (DLL) files.

For malicious code to instruct win.ini or system.ini to run it on

startup, the code simply adds a few lines to either file. For example, a

malicious program could add the following text to win.ini to execute

malware.exe every time the system starts:

[windows]

Run=malware.exe

Accomplishing the same thing using either system.ini or autoexec.

bat is just as easy, although the format is different for each. While

these tricks are easy to use, relatively few malicious code authors ...