Learn how Windows controls autorun programs
Hunting down and stopping programs that launch themselves at system startup whether you want them to or not is a pain. Windows can automatically start programs according to two folders and eight core registry subkeys. Here are the 10 locations from which Windows XP, Windows 2000, and Windows NT can automatically run programs at system startup.
10. The user Startup folder—The user's Startup folder is the most common location for programs that Windows automatically loads at boot time. You can find the user Startup folder at Documents and Settings, user, Start Menu, Programs, Startup. If you've migrated from NT, you'll find the Startup folder at WinNT, Profiles, user, Start Menu, Programs, Startup.
9. The All Users Startup folder—The next most common place to find autostart programs is the All Users Startup folder. Whereas the user Startup folder runs programs for only the user who's logged on, the All Users Startup folder autostarts programs no matter who logs on to the system. You can find this folder at Documents and Settings, All Users, Start Menu, Programs, Startup. If you've migrated from NT, you'll find the folder at WinNT, Profiles, user, Start Menu, Programs, Startup.
8. The load entry—Several registry subkeys also can start programs automatically. One esoteric location is the load entry at HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows\load.
7. The Userinit entry—The Userinit entry, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Userinit, can also initiate programs when the system boots. You'll usually see an entry for userinit.exe, but this subkey can accept multiple comma-separated values (CSVs), so other programs can tack themselves onto the end of the entry.
6. The Explorer\Run entry—Unlike the load and Userinit entries, the Explorer\Run entry works in both the HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE root keys. You can find the Explorer\Run subkey at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run and at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.
5. The RunServicesOnce subkey—The RunServicesOnce subkey is designed to start service programs before the user logs on and before the other registry autostart subkeys start their programs. You'll find the RunServicesOnce subkey at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce and at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce.
4. The RunServices subkey—The RunServices subkey loads immediately after the RunServicesOnce subkey and runs before the user logs on. You'll find the RunServices subkey at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices and at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices.
3. The RunOnce\Setup subkey—The RunOnce\Setup subkey's default value specifies programs to run after the user logs on. The RunOnce\Setup subkey is in the HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE root keys. You'll find it at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup and at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup.
2. The RunOnce subkey—Setup programs typically use the RunOnce subkey to run programs automatically. You'll find this subkey at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce and at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. The RunOnce entry in the HKEY_LOCAL_MACHINE root runs associated programs immediately after logon and before the other registry Run entries start their programs. The RunOnce subkey in the HKEY_CURRENT_USER root runs after the OS processes the other registry Run subkeys and the contents of the Startup folder. If you run XP, you can also check the RunOnceEx subkey at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx.
1. The Run subkey—By far the most common registry location for autorun programs is the Run entry, which you'll find at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run entry in the HKEY_LOCAL_MACHINE root runs immediately before the Run entry in the HKEY_CURRENT_USER root, and both subkeys precede the processing of the Startup folder.