A place to list all the places programs can auto-start under Windows....

Puzzled about why your windows installation is behaving a particular way, or how a virus can start itself each time you reboot, or why the hell Real Audio Player is always in your system tray? Here's where to look. More to the point, get a load of all the stuff running on your computer that you may have no knowledge about, and can be switched off to improve performance.

(See below for the list of registry keys herein in alphabetic order for quick and efficient spelunking.)
A handy way to check these settings is the utility MSCONFIG which ships with Windows 98, 98SE, ME, and XP. Check out http://netsquirrel.com/msconfig/ for info about MSCONFIG. It also has a link to download a version that works with Windows NT and W2K. --DanielGramunt

This is only a subset of the full list of launch points: to see where everything starts, use the Silent Runners script or the full list of launch points -- Stuart Dunkeld

HKCU = HKEY_CURRENT_USER
HKLM = HKEY_LOCAL_MACHINE

• The User Startup folder (e.g. C:\Documents and Settings\username\Start Menu\Programs\Startup)
  
• The All Users Startup folder (e.g. C:\Documents and Settings\All Users\Start Menu\Programs\Startup)
  
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run executes before the contents of the startup folders is invoked.
  
• Explorer\Run registry entries in the registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run and
  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  
  
• The Userinit entry at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
  initiates programs when the system boots. By default userinit.exe is in this subkey, but this location will process a comma-delimited list of values.
  
  
• The Load entry at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
  
  
• The Run entries at HKCU\Software\Microsoft\Windows\CurrentVersion\Run and
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run and
  
  
• The RunServices entries at HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce and
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce and
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices and
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices all run before the user logs on and before other other registry autostart subkeys start their programs.
  
  
• The RunOnce ( See Q137367 ) entries at HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce and
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup and
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup are there for the use of setup programs to run post-reboot.
  
  
• The RunOnceEx entry at HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  
  
• Less common but nonetheless sometimes used HKCR\batfile\shell\open\command and
  HKCR\comfile\shell\open\command and
  HKCR\exefile\shell\open\command and
  HKCR\htafile\shell\open\command and
  HKCR\piffile\shell\open\command and
  HKLM\Software\Classes\batfile\shell\open\command and
  HKLM\Software\Classes\comfile\shell\open\command and
  HKLM\Software\Classes\exefile\shell\open\command and
  HKLM\Software\Classes\htafile\shell\open\command and
  HKLM\Software\Classes\piffile\shell\open\command
  
  
• Services HKLM\system\CurrentControlSet\Services
  
  
• Win.ini still works for all versions of Windows
  
• Autoexec.bat still works for all versions of Windows or autoexec.nt
  
• Config.sys still works for most versions of Windows or config.nt
  
• Task Scheduler in C:\Windows\tasks

List of the registry keys in alphabetic order

It's much quicker to blast through the registry in a systematic way.

HKLM\Software\Classes\batfile\shell\open\command
HKLM\Software\Classes\comfile\shell\open\command
HKLM\Software\Classes\exefile\shell\open\command
HKLM\Software\Classes\htafile\shell\open\command
HKLM\Software\Classes\piffile\shell\open\command
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKLM\system\CurrentControlSet\Services

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKCR\batfile\shell\open\command
HKCR\comfile\shell\open\command
HKCR\exefile\shell\open\command
HKCR\htafile\shell\open\command
HKCR\piffile\shell\open\command

---

Great list! Thank you for providing this. The set of places where things can auto-start is even more extensive than I knew. Wow. -- Willson Deveas

---

Category Maintain Category Security Category 3 Star Topics