Skip main navigation

Windows registry

Article detailing the mechanisms of malware persistence via the Windows registry.
© PA Knowledge Ltd | 7Safe Training

Windows registry

The Windows registry is essentially a database that contains the computer hardware, software and user settings. It may also contain supporting information depending on the installed product.

The registry contains five hives two of which are root hives. The root hives are HKLM (applies to all users) and HKCU (only applies to individual users). All hives contain keys, subkeys and values.

The local machine and user hives contain “Run Keys”. The keys are named Run and RunOnce and relate to executing a program either when the computer boots up or when a particular user logs in. The locations of the run keys are:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\

An example of “Run Keys” and entries are detailed below:

Snippet of Windows registry depicting 'Run' key and values.

Additional information…

Microsoft describes the registry as “A central hierarchical database used in Microsoft Windows 98, Windows CE, Windows NT, and Windows 2000 used to store information that is necessary to configure the system for one or more users, applications and hardware devices.”

So they haven’t updated this article in a while then? Click here to go to the Microsoft article in question.

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education