"Jeff Barnett" wrote

| Assume that a malicious code somehow enters your system. It simply puts
| itself on the "shutdown list" if there is such an entity. At shutdown it
| puts itself on the startup list(s). At next startup, it does what it
| wants then removes itself from the startup list(s) and adds itself to
| the shutdown list.

As far as I know there is no such thing. Something
that wants to run at reboot puts itself in the Run or
RunOnce key... or the startup folder... or whatever.

But there can be all sorts of tricks. A service, which is
what Apple and some others like printer companies do to
keep running. A scheduled task. (I've disabled that whole
mess in XP but it can't be shut off in Win7.) Various shell
extensions can also do sneaky things. I've made a MIME
handler myself. (A protocol filter) In earlier versions of IE it
intercepts all content going to IE and allows me to edit it.
I oroginally made it to create a customizable filter for blocking
any desired content. Only a couple of
Registry settings are required. Similarly, Explorer extensions
can get a lot of access by only registering themselves. They
then get full access to Explorer and IE content. So anyone
who's really worried should check for such things in autoruns.