WindowsBox/StartUp

Ways of automatically starting stuff up on Windows startup (i.e., places to look in to work out where the adware has managed to implant itself)

: Alternatively, run AdAware? Seems quite good to me, but then I haven't used it that much I guess - Kazuhiko

autoexec.bat - in root, runs DOS executables (9x)

wininit.exe - always runs, executes contents of wininit.ini if wininit.ini is present in Windows folder (9x, ME)

winstart.bat - in windows folder, runs DOS executables (9x)

dosstart.bat - in windows folder, runs DOS executables when booting to DOS mode (9x)

system.ini - starts explorer.exe (SHELL parameter in [BOOT] section). explorer.exe will run stuff it's given as a parameter. (9x, ME, XP, 2000)

win.ini - runs anything in load and run parameters in [windows] section. (9x, ME, XP, 2000)

registry - Run, RunOnce, RunOnceEx, RunServices, RunServicesOnce keys in \SOFTWARE\Microsoft\Windows\Current Version\ subdirectory of HKEY_LOCAL_MACHINE\, HKEY_CURRENT_USER\ and/or HKEY_USERS\.DEFAULT (all versions, except RunOnce isn't supported by NT 3.5).

Run and Load keys in HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows (NT only)

UserInit?, Shell, System, VmApplet?, RunDLL? keys in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (NT only)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run (ME, 2000, XP)

global startup folder in start menu (NT, 2000, XP)

user's startup folder in start menu (all)

[Image file execution option keys] for, e.g., explorer.exe

msconfig is a useful tool to see & toggle what is running on your pc (Specially if you are having problems starting/shutting down)

: But it misses a number of the above places, including wininit.ini, LoadOnce? and RunOnce?, and the NT-specific keys. - MoonShadow