Windows Startup Locations

Windows certainly has a lot of places that it looks to load things on startup. Most locations are in the registry, but there are others as well. Some easy to find, others not.

The first, fastest, and easiest would be under Start->Programs->StartUp. Anything in that folder will be loaded when Windows boots. Many legitimate programs use this location because it's easy to edit if you decide you don't want it to load.

Autoexec.bat & Config.sys. While archaic and outdated, Windows 95, 98, and ME all will load things from these ancient DOS relics. Generally speaking, you don't need them. At all. Just rename the files to Autoexec.bkp and config.bkp. That way you'll have them if you need them. Which you probably won't.

Windows\Win.ini look in here for a run= or load= line. Anything on that line will be executed.

The Registry... This is where it gets fun. Windows stores virtually all it's settings in here, and so it makes sense that it would have a startup location in there as well. Well it does. Tons of them. Here is a list of keys to check:

General Startup

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

In the following key, older Windows will have the actual username within it, whereas XP and the like will have a goofey looking #. Just look in all of the directories in here to make sure that when another profile is loaded it doesn't start anything you don't want it to.

HKEY_USERS\*User*\Software\Microsoft\Windows\CurrentVersion\Run

Explorer run - These are usually used to load programs as part of a policy

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

UserInit - This tells Windows what to run when a user logs on

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

AppInit_DLLs - I believe this is only in NT, 2000, and XP, but this one you may want to keep an eye on.

The "Only the best" browser hijacker uses this one.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

Load - Not used too much, but Windows will load from it nonetheless

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

A couple more

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoaddows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

And, finally, here are some other files Windows will look at:

windows\wininit.ini
windows\system.ini - [boot] - "shell"
windows\system.ini - [boot] - "scrnsave.exe"
windows\dosstart.bat - Only in Win95 or 98 when you restart to MS-DOS mode
windows\winstart.bat
windows\system\autoexec.nt
windows\system\config.nt

90% of these locations are not used. However, the knowledge has come in handy more than once. Keep it under your hat. Still, though, msconfig is your friend...