Monitoring of the Active Setup Registry Key
What is the Active Setup?
Why monitor this key?
Microsoft uses this key to setup installed Windows components.
You can see a list of the installed components under the key
HKLM\Software\Microsoft\Active Setup\Installed Components
You should launch RegEdit to view it.
As you can see, the registry key of each component has a list of values.
These values are used by Windows to identify a component.
One of these values, StubPath, is very important.
This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).
Active Setup is used by new Trojans to install them to the computer.
This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.