What are the different methods that programs can use to automatically start
up when Windows starts, or when a user logs in?

I'm aware of the system setting in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

I know that for user logins, the Startup folder is also a place to look.

After installing Winbench 99, it started to automatically shut down the
system and then invoke itself on reboot and re-login to the computer. I
did NOT see it in either of the two above locations, so I have to assume
that it was using yet another technique to restart itself. Any help is
appreciated.

--
Will
westes AT earthbroadcast.com

the runonce key is used for things that run once and then are removed.
device drivers get loaded at boot or when new usb devices are detected.
system services are started after the kernal loads but before
run/runonce/startup group stuff. then there is the task scheduler from
windows or the AT command line tool. other programs that are started can
also schedule their own tasks that can run other programs... av, disk
defrag, mail readers, and other tools can run their own schedule of tasks.
the synchronization manager with active desktops can also kick off
processes. there are still system.ini and win.ini, autoexec.bat,
config.sys, though i don't know if you can still run stuff out of them or
when it fits in. the boot.ini file could probably point to a different boot
loader that could do stuff before windows loads, as could another multi-boot
configuration tool.

"CHANGE USERNAME TO westes" wrote in
message news:eEZEv4oaEHA.2408@tk2msftngp13.phx.gbl...
> What are the different methods that programs can use to automatically
start
> up when Windows starts, or when a user logs in?
>
> I'm aware of the system setting in the registry:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
> I know that for user logins, the Startup folder is also a place to look.
>
> After installing Winbench 99, it started to automatically shut down the
> system and then invoke itself on reboot and re-login to the computer. I
> did NOT see it in either of the two above locations, so I have to assume
> that it was using yet another technique to restart itself. Any help is
> appreciated.
>
> --
> Will
> westes AT earthbroadcast.com
>
>

Beside HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
there are about 40 more keys that can execute programs. For more information
visit:

http://www.aaronoff.com/silent_runners/#keylist

Mike

"CHANGE USERNAME TO westes" wrote in
message news:eEZEv4oaEHA.2408@tk2msftngp13.phx.gbl...
> What are the different methods that programs can use to automatically
start
> up when Windows starts, or when a user logs in?
>
> I'm aware of the system setting in the registry:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
> I know that for user logins, the Startup folder is also a place to look.
>
> After installing Winbench 99, it started to automatically shut down the
> system and then invoke itself on reboot and re-login to the computer. I
> did NOT see it in either of the two above locations, so I have to assume
> that it was using yet another technique to restart itself. Any help is
> appreciated.
>
> --
> Will
> westes AT earthbroadcast.com
>
>

Where is the run once key located?

--
Will
westes AT earthbroadcast.com


"Dave" wrote in message
news:uzK9DFpaEHA.1652@TK2MSFTNGP09.phx.gbl...
> the runonce key is used for things that run once and then are removed.
> device drivers get loaded at boot or when new usb devices are detected.
> system services are started after the kernal loads but before
> run/runonce/startup group stuff. then there is the task scheduler from
> windows or the AT command line tool. other programs that are started can
> also schedule their own tasks that can run other programs... av, disk
> defrag, mail readers, and other tools can run their own schedule of tasks.
> the synchronization manager with active desktops can also kick off
> processes. there are still system.ini and win.ini, autoexec.bat,
> config.sys, though i don't know if you can still run stuff out of them or
> when it fits in. the boot.ini file could probably point to a different
boot
> loader that could do stuff before windows loads, as could another
multi-boot
> configuration tool.
>
> "CHANGE USERNAME TO westes" wrote in
> message news:eEZEv4oaEHA.2408@tk2msftngp13.phx.gbl...
> > What are the different methods that programs can use to automatically
> start
> > up when Windows starts, or when a user logs in?
> >
> > I'm aware of the system setting in the registry:
> >
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> >
> > I know that for user logins, the Startup folder is also a place to look.
> >
> > After installing Winbench 99, it started to automatically shut down the
> > system and then invoke itself on reboot and re-login to the computer.
I
> > did NOT see it in either of the two above locations, so I have to assume
> > that it was using yet another technique to restart itself. Any help
is
> > appreciated.
> >
> > --
> > Will
> > westes AT earthbroadcast.com
> >
> >
>
>

right next to the run key... same path, usually shows just above or below
the run key in registry editor.

"CHANGE USERNAME TO westes" wrote in
message news:htSdnd1v9oiYWGvdRVn2gg@giganews.com...
> Where is the run once key located?
>
> --
> Will
> westes AT earthbroadcast.com
>
>
> "Dave" wrote in message
> news:uzK9DFpaEHA.1652@TK2MSFTNGP09.phx.gbl...
> > the runonce key is used for things that run once and then are removed.
> > device drivers get loaded at boot or when new usb devices are detected.
> > system services are started after the kernal loads but before
> > run/runonce/startup group stuff. then there is the task scheduler from
> > windows or the AT command line tool. other programs that are started
can
> > also schedule their own tasks that can run other programs... av, disk
> > defrag, mail readers, and other tools can run their own schedule of
tasks.
> > the synchronization manager with active desktops can also kick off
> > processes. there are still system.ini and win.ini, autoexec.bat,
> > config.sys, though i don't know if you can still run stuff out of them
or
> > when it fits in. the boot.ini file could probably point to a different
> boot
> > loader that could do stuff before windows loads, as could another
> multi-boot
> > configuration tool.
> >
> > "CHANGE USERNAME TO westes" wrote in
> > message news:eEZEv4oaEHA.2408@tk2msftngp13.phx.gbl...
> > > What are the different methods that programs can use to automatically
> > start
> > > up when Windows starts, or when a user logs in?
> > >
> > > I'm aware of the system setting in the registry:
> > >
> > >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> > >
> > > I know that for user logins, the Startup folder is also a place to
look.
> > >
> > > After installing Winbench 99, it started to automatically shut down
the
> > > system and then invoke itself on reboot and re-login to the computer.
> I
> > > did NOT see it in either of the two above locations, so I have to
assume
> > > that it was using yet another technique to restart itself. Any
help
> is
> > > appreciated.
> > >
> > > --
> > > Will
> > > westes AT earthbroadcast.com
> > >
> > >
> >
> >
>
>

Logon scripts can also be used to start an application at logon. There is an
excellent free tool from SysInternals called Autoruns than can list all the various
places and what is currently set to autorun on a computer. Process Explorer can be
helpful in determining what process is related to an executable and other related
files to the process. Booting into safe mode will stop a lot of startup processes if
need be to make repairs or adjustments to configuration. --- Steve

http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml -- link to Autoruns and
Process Explorer

"CHANGE USERNAME TO westes" wrote in message
news:eEZEv4oaEHA.2408@tk2msftngp13.phx.gbl...
> What are the different methods that programs can use to automatically start
> up when Windows starts, or when a user logs in?
>
> I'm aware of the system setting in the registry:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
> I know that for user logins, the Startup folder is also a place to look.
>
> After installing Winbench 99, it started to automatically shut down the
> system and then invoke itself on reboot and re-login to the computer. I
> did NOT see it in either of the two above locations, so I have to assume
> that it was using yet another technique to restart itself. Any help is
> appreciated.
>
> --
> Will
> westes AT earthbroadcast.com
>
>

See http://securityadmin.info/faq.asp#startup for tools...

.... although the most complete tool for looking at startup locations that
are hijacked by malware is Silent Runners. Search www.google.com for
Silent-Runners to find it.

Most OSes except for Windows 2000 let you click Start, Run, type MSCONFIG
and click OK to see some but not all startup locations.


"CHANGE USERNAME TO westes" wrote in
message news:eEZEv4oaEHA.2408@tk2msftngp13.phx.gbl...
> What are the different methods that programs can use to automatically
start
> up when Windows starts, or when a user logs in?
>
> I'm aware of the system setting in the registry:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
> I know that for user logins, the Startup folder is also a place to look.
>
> After installing Winbench 99, it started to automatically shut down the
> system and then invoke itself on reboot and re-login to the computer. I
> did NOT see it in either of the two above locations, so I have to assume
> that it was using yet another technique to restart itself. Any help is
> appreciated.
>
> --
> Will
> westes AT earthbroadcast.com
>
>