Monitoring of the Active Setup Registry Key

What is the Active Setup?

Why monitor this key?

Microsoft uses this key to setup installed Windows components.

You can see a list of the installed components under the key

HKLM\Software\Microsoft\Active Setup\Installed Components

You should launch RegEdit to view it.

As you can see, the registry key of each component has a list of values.

These values are used by Windows to identify a component.

One of these values, StubPath, is very important.

This value includes a command that Windows executes every time it starts if a value called "IsInstalled," is not set to 1 (binary value).

Active Setup is used by new Trojans to install them to the computer.

This is very dangerous because then Windows launches the Trojan before other programs ARE loaded.

RegRun will help you!

RegRun saves a copy of Active Setup key and traces the changes.

You will see a picture like this:

On this picture you can see that the StubPath value was added to the key.

Inspect the contents of the StubPath value.

If you have any doubts, contact us to get support.

You have three choices:

1)   Accept the changes (OK);

2)   Decline the changes (Change Back);

3)   Close this Form (Ask Me Later.)

Do not be afraid if you see this window when you change a collection of Windows components. This is normal. Simply click on the OK button.

You can disable the monitoring of this key by RegRun Control Center.

Open Security tab, choose Registry Tracer. After that set/reset the "Check Active Setup Registry Key" checkbox.

RegRun automatically activates monitoring of the Active Setup key if you have chosen "Ultra High Level" or "High Level" of your security level on the Security tab.