Installed Components

最新推荐文章于 2021-12-29 16:04:21 发布

转载最新推荐文章于 2021-12-29 16:04:21 发布 · 1.2k 阅读

文章标签：

#components #security #windows #microsoft #command #list

Windows启动相关专栏收录该内容

3 篇文章

订阅专栏

本文介绍如何通过监控ActiveSetup注册表键来检测潜在的安全威胁。Microsoft使用此键设置已安装的Windows组件，某些恶意软件可能利用这一特性进行自我安装。文章详细解释了ActiveSetup的工作原理，以及如何使用RegRun等工具跟踪此注册表键的变化。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Active Setup/Installed Components

Monitoring of the Active Setup Registry Key

What is the Active Setup?

Why monitor this key?

Microsoft uses this key to setup installed Windows components.

You can see a list of the installed components under the key

HKLM/Software/Microsoft/Active Setup/Installed Components

You should launch RegEdit to view it.

As you can see, the registry key of each component has a list of values.

These values are used by Windows to identify a component.

One of these values, StubPath, is very important.

This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).

Active Setup is used by new Trojans to install them to the computer.

This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.

RegRun will help you!

RegRun saves a copy of Active Setup key and traces the changes.

Inspect the contents of the StubPath value.

If you have any doubts, contact us to get support.

You have three choices:

1) Accept the changes (OK);

2) Decline the changes (Change Back);

3) Close this Form (Ask Me Later.)

Do not be afraid if you see this window when you change a collection of Windows components. This is normal. Simply click on the OK button.

You can disable the monitoring of this key by RegRun Control Center.

Open Security tab, choose Registry Tracer. After that set/reset the "Check Active Setup Registry Key" checkbox.

RegRun automatically activates monitoring of the Active Setup key if you have chosen "Ultra High Level" or "High Level" of your security level on the Security tab.