The following registry values, under their respective registry key, will trigger execution when any user logs in:
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- Load = <file path>
- Run = <file path>
BootExecute value
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX\Control\Session Manager
- XXX in ControlSetXXX is a three digit number usually ControlSet001, ControlSet002, or ControlSet003.
- BootExecute = <file path>
- The default value of BootExecute is autocheck autochk *
Winlogon key
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Activities under this registry key are executed during Windows logon
- UserInit = <file path>
- The default value of Userinit is C:\Windows\system32\userinit.exe ...