Startup Program Configuration

Windows Tutorials - Herong's Tutorial Examples

∟Startup Programs Removal for Better System Performance

∟Startup Program Configuration - System Registry

This section provides a tutorial example on how to find where startup programs are defined in the Windows system registry in '...\Windows\CurrentVersion\Run'.

Where are the startup program configuration stored on my Windows system? The answer is in the HijackThis report. The startup program configuration is located in two areas:

System Registry - Windows allows applications and users to add startup programs in three sections in the system registry: HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER and HKEY_USERS. See the first part of O4 section in the HijackThis report with lines started with "O4 - HK...".
Startup Folder - Windows allows applications and users to add startup programs in the startup folders of profiles of "All Users", "Default User" and individual users. See the second part of O4 section in the HijackThis report with lines started with "O4 - ... Startup: ...".

For example, the following O4 line represents a startup program configuration in the HKEY_CURRENT_USER section of the Windows registry:

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger
                  \YahooMessenger.exe" -quiet

More precisely, startup programs are configured in the Windows registry under two registry keys:

1. "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" - If you export this registry key by following the tutorial described in previous chapters, you will get something like this:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier
   \\GoogleToolbarNotifier.exe"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger
   \\YahooMessenger.exe\" -quiet"
"NetZero_uoltray"="C:\\Program Files\\NetZero\\exec.exe regrun"

2. "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" - If you export this registry key by following the tutorial described in previous chapters, you will get something like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"="regsvr32 /s mqrt.dll"
"SoundMAXPnP"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"SoundMAX"="C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe 
   /tray"
"AccelerometerSysTrayApplet"="C:\\WINDOWS\\system32
   \\AccelerometerSt.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"QlbCtrl"=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,...
"Cpqset"="C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe"
"Recguard"="C:\\WINDOWS\\Sminst\\Recguard.exe"
"Reminder"="C:\\WINDOWS\\Creator\\Remind_XP.exe"
"Scheduler"="C:\\WINDOWS\\SMINST\\Scheduler.exe"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\"
   runtime -Delay"
"ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan
   \\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common
   Framework\\UpdaterUI.exe\" /StartedFromRunKey"
"KernelFaultCheck"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,...
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_03\\bin
   \\jusched.exe\""
"BaiduXUpdate"="\"C:\\Program Files\\Baidu\\BaiduX\\MovieUpdate.exe\"
   --Update"
...