where in registry do programs hide automated startups?

N

nightfly

2[H]4U
Joined
Jun 7, 2011
Messages
3,812
I turned on my computer. did nothing, went to make lunch. Came back, and found a message from a software company telling me I had to update their program. Now, there's nothing in my startup folder, nothing in the run or runonce sections of the registry connected to this program, and I can't find any evidence of the program's supposedly only known executables anywhere other than in it's directory. Where and how is this starting by itself? Program is 4k video downloader.
 
Code: 
%appdata%\Microsoft\Windows\Start Menu\Programs\Startup
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce

Also check any services set to run on startup and possibly scheduled tasks set to run when a user logs in.
 
Also look at services. Might find something in there set to automatic statup (or delayed startup).
 
Once you find it, if it's a service, you can delete it from the services.msc control panel, or from an admin command prompt with:

sc delete "servicename"
 
did you create a new user and see if it happens to that user too? If not just merge everything to a new user account.
 
You must log in or register to reply here.
Back
Top