{"id":1266,"date":"2012-09-16T13:13:39","date_gmt":"2012-09-16T13:13:39","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1266"},"modified":"2014-09-20T22:22:53","modified_gmt":"2014-09-20T22:22:53","slug":"beyond-good-ol-run-key-part-2","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2012\/09\/16\/beyond-good-ol-run-key-part-2\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 2"},"content":{"rendered":"

In my previous post<\/a> I described various less-known autoruns mechanisms that can be utilized by malware. This post follows-up on some of the ideas I have described there and lists another batch of applications providing features that could be potentially used by malware authors. This is not to scaremonger users of these applications –\u00a0 the features described here are actually very useful and needed, and certainly developed in the best interest of the users. Still, they are potential avenues for developing hidden autostart so with ‘the better evil known than unknown’ in mind, here it goes:<\/p>\n

Winrar archiver<\/strong><\/p>\n

Allows to define external viewer:<\/p>\n

\"\"<\/a><\/p>\n

The value is stored under the following registry location:<\/p>\n