How Can Programs Auto-Run When Windows Starts?

  • Thread starter Thread starter CHANGE USERNAME TO westes
  • Start date Start date
C

CHANGE USERNAME TO westes

What are the different methods that programs can use to automatically start
up when Windows starts, or when a user logs in?

I'm aware of the system setting in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

I know that for user logins, the Startup folder is also a place to look.

After installing Winbench 99, it started to automatically shut down the
system and then invoke itself on reboot and re-login to the computer. I
did NOT see it in either of the two above locations, so I have to assume
that it was using yet another technique to restart itself. Any help is
appreciated.
 
the runonce key is used for things that run once and then are removed.
device drivers get loaded at boot or when new usb devices are detected.
system services are started after the kernal loads but before
run/runonce/startup group stuff. then there is the task scheduler from
windows or the AT command line tool. other programs that are started can
also schedule their own tasks that can run other programs... av, disk
defrag, mail readers, and other tools can run their own schedule of tasks.
the synchronization manager with active desktops can also kick off
processes. there are still system.ini and win.ini, autoexec.bat,
config.sys, though i don't know if you can still run stuff out of them or
when it fits in. the boot.ini file could probably point to a different boot
loader that could do stuff before windows loads, as could another multi-boot
configuration tool.
 
right next to the run key... same path, usually shows just above or below
the run key in registry editor.
 
Logon scripts can also be used to start an application at logon. There is an
excellent free tool from SysInternals called Autoruns than can list all the various
places and what is currently set to autorun on a computer. Process Explorer can be
helpful in determining what process is related to an executable and other related
files to the process. Booting into safe mode will stop a lot of startup processes if
need be to make repairs or adjustments to configuration. --- Steve

http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml -- link to Autoruns and
Process Explorer
 
See http://securityadmin.info/faq.asp#startup for tools...

.... although the most complete tool for looking at startup locations that
are hijacked by malware is Silent Runners. Search www.google.com for
Silent-Runners to find it.

Most OSes except for Windows 2000 let you click Start, Run, type MSCONFIG
and click OK to see some but not all startup locations.
 
Back
Top