Name of program that tells you what programs load when Windows starts

[WhoIam]

...and lets you disable them.

thanks

[BiPolar_Nut]

Autoruns

[sznavor23]

windows XP, click start...click run...type "msconfig" (without quotes). on the far right click the startup tab. this will show you everything that runs on startup, you can uncheck whatever you want and it won't run on startup anymore. be careful what you uncheck!

Steve

[wallywojo]

msconfig is a frontend to other settings. If you want to know where this is located regardless of the Windows os, check HKLM\Software\Microsoft\Windows\CurrentVersion\Run key. The thing I do not like about msconfig is that you get reminders it exposes you to somethings that you should not be touching where the Run key has everything that you are concerned about.

[BiPolar_Nut]

[ QUOTE ]
the Run key has everything that you are concerned about

[/ QUOTE ]

Not quite:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
– these programs automatically start when any user is logged in. It is used for all users on this computer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce
– The programs here start only once when any user is logged in and will be removed after the Windows boot process would have finished.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnceEx
– The programs here start only once when any user is logged in and will be removed after the Windows boot process would have finished. Also the RunOnceEx registry key does not create a separate processes. The RunOnceEx registry key also support a dependency list of DLLs that remain loaded while either all the sections or some of the sections are being processed.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServices
– these programs automatically start when the system is loading before the user logs in. It is used for service applications - antivirus, drivers etc. In Windows NT/2000/XP it could be canceled by admin to use other service startup sections. Read more at services startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServicesOnce
– these programs automatically start only once when the system is loading as service application and items are deleted after the Windows boot process have finished.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run
– The programs here automatically start when the current user logs in. It is used only for current logoned user.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\RunOnce
– The programs here automatically start only once when the current user logs in and it will be deleted after the Windows boot process would have finished.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Run
– The programs here automatically will be copied into HKEY_CURRENT_USER\...\Run for every new user account.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\RunOnce
– The programs here automatically will be copied into HKEY_CURRENT_USER\...\RunOnce for every new user account.

And there are others that are backwards compatible from NT4 but I'm too lazy to dig those up as well [img]/images/graemlins/wink.gif[/img]

Edit: I agree not to use MSConfig tho. I've had calls from clients because they disabled too much and mucked their system. Besides, MSConfig requires a reboot before services are disabled....you can disable them in real time via services.msc (which is another place not to mess around with if you don't know what you're doing lol). I can't remember the last time I actually ran MSConfig. Autoruns is far superior, and services.msc will make real-time changes.

[wallywojo]

pretty good info on the diff keys of Run. I never knew what differentiated them, just to make sure to check them. Yeah, not sure if they are looking at services either. For services, would you expect normal users to use the mmc snap-ins or instead something like Computer Management? I only referenced the registry since the front-end version could be more dangerous than removing everything in the Run key.

[BiPolar_Nut]

[ QUOTE ]
would you expect normal users to use the mmc snap-ins or instead something like Computer Management? I only referenced the registry since the front-end version could be more dangerous than removing everything in the Run key.


[/ QUOTE ]

services.msc is just a subset of computer management. I've guided customers through both ways...usually through comp mgmt if there were other issues to check or if I needed them to check event logs. If it was just a matter of turning on or off a service or two (like a couple years ago when auto-updates suddenly started requiring BITS running...which was a service I disabled on all my builds) I'd have them go through services.msc. It's the exact same functionality either way.

The problem w/ removing stuff from the Run key (any of them) is if they remove it, it's gone and they likely won't know what to put back if suddenly their wireless didn't work, or the unloaded a protection program (Spybot's TeaTimer, an Antivirus or antispyware realtime protection program, etc), or some funky card-based login service prevents them from getting back in to the corp network, etc.

If you know what to delete, editing the reg can be good to walk the average user through over the phone, cause they'd likely be intimidated and not make sense of too much of it, whereas using an MMC, they may say "Neat! Wonder what else I can do here?"

I guess it depends on the customer.

Oh...almost forgot...sometimes you need to go back and re-check the Run keys to be sure they weren't re-created (as in during manual spyware removal on an infected system) because there are often monitoring processes that put deleted keys back immediately, and the reg display isn't refreshed automagically like an explorer window. I've run in to systems that had a team of 3 malicious programs all monitoring each other and their reg keys....if any was stopped or changed, the others would restart/fix them. In those cases, you need to identify the processes that are working together and kill them all simultaneously before being able to make any effective registry changes.