To change the automatic start of the current session, you need to find in the list (in the left column) a folder called "HKEY_CURRENT_USER" and follow the path HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run(Fig. 5).

Figure 5. Finding the necessary registry keys to configure application startup.
This way you can easily configure the launch of applications.

List of Windows 7 registry sections where you need to look for applications registered in startup:

What do you need to add a new application to startup?

This is how you debug application startup in Windows 7. Don’t forget to save restore points so that if you do something wrong, you can return the system to its original state.

To go to the desired branch in the registry to edit the list of programs launched when the system starts, you need to open the “Registry Editor” application. To launch an application in Windows 7, click the “Start” menu - “All Programs” - “Accessories” - “Run”. In the window that appears, enter the request regedit.exe. If the above steps are performed correctly, a window will appear in front of you new program, in which the registry branches will be displayed. You can also open Registry Editor by searching for "Run" in the "All Programs" search bar of the Start menu. After that, in the window that appears, also enter regedit.exe and press Enter to go.

Search for startup branch

To navigate through the registry tree in the editor window, use the diagram displayed on the left side of the program window. To move to the desired section for editing startup, go to the HKEY_LOCAL_MACHINE section. Next, select the directories SOFTWARE – Microsoft – Windows – CurrentVersion – RUN. As soon as you go to this section, basic parameters available for editing in the system will be displayed on the right side of the window. The leftmost column of the table will display the name of the application. The “Value” section will indicate the location of the file that runs when the system is turned on. You can change these values ​​or, if you wish, delete the program key in the list if you want to permanently remove the application from startup. To do this, right-click on the corresponding name and select “Delete”.

If you do not find the program you need in the list provided, use other keys to search for it. For example, applications often place startup data in the HKEY_CURRENT_USER – SOFTWARE – Microsoft – Windows – Current Version – RUN section. There is also another branch in the system that is responsible for launching programs when the system starts at the address HKEY_USERS - .DEFAULT - SOFTWARE - Microsoft - Windows - CurrentVersion - RUN.

After completing the removal of unnecessary keys, close the program window and reboot the system. If the operation was performed correctly, the program removed from the registry will not appear after loading the Desktop. If you want the application to start when you turn on the computer as before, go to the settings section of the application you are using and use the “Startup” option. To edit system parameters, you can also use the msconf.exe utility, available from the “Run” menu of the “Start” section.

In order to clean the registry, you can use an old, but even nowadays relevant program - Regseeker. Perhaps you can find its improved versions on the Internet for a long time, but this is not a guarantee that they have not become paid.

Instructions

When the check is completed, you should click the Select all button (on the same line as the Stop button), and select Select all again from the next window. After this, you need to right-click on any entry that was found. From the list that drops down, you must select Delete Selected Item. All. Ready.

If suddenly something goes wrong (this is almost impossible, since it has been tested by users many times), something is unstable, you should select the Backups program in the window, click the button twice, then click OK. All files that were deleted will be restored.

This may require a program such as CCleaner. It can also be used to delete registry files.
How to use it:
- First of all, you should change the language from English. Click the “clean” button and mark everything that we want to delete. However, you should make sure that nothing important is deleted.

After cleaning, you should go to the “Registry” and click the “Search” button.

After finishing the search, you need to click on the “Fix” button. Almost always this program suggests checking backup copy. That's pretty much where it all ends.

Video on the topic

Registry is a database that stores information about Windows configuration, about equipment, users, programs, parameters and settings. While the computer is running, the operating system accesses this data. You can open the registry using an editor program.

Instructions

The registry editor program is included in Windows package. It can be used to modify the registry, but it is highly discouraged for users to edit the registry themselves, especially when the user only vaguely understands what they are doing. Registry errors can seriously damage your operating system, so don't edit the registry unless absolutely necessary.

To launch the registry editor program, through the “Start” menu, call the “Run” command. IN empty line Type regedit (or regedit.exe) without quotes, spaces or other unnecessary characters and press the OK button or the Enter key on your keyboard - the Registry Editor will open in a new window.

The registry has a tree structure. You can expand each folder and view all resources. In certain cases, if incorrect entries have been made to the registry, the registry repair option can help you. To restore the registry, through the “Start” button, select “Shut down” and the “Restart” command. Click OK.

When your computer starts to restart, press F8 when the "Select an operating system to start" message appears. Use the arrows to move up and down the menu. Select Load Last Known Good Configuration and press Enter. In this way, you can restore the registry only in case of problems caused, for example, by installing new drivers that are not compatible with existing hardware. If you mistakenly deleted the necessary files or drivers from the registry, this method will not help.

There are also third-party programs and utilities for opening and working with the registry, for example, CCleaner. If you downloaded such a program or utility from the Internet or installed it from a disk, follow the instructions that came with it.

Video on the topic

Sources:

• where to find the registry on your computer

Operating system registry Windows any version is one of the main computer management tools. Standard tool To work with the registry, use the regedit.exe utility.

Instructions

Access the premier Windows registry management tool. To do this, call the main menu by clicking the “Start” button and go to the “Run” dialog. Type gpedit.msc in the Open line and confirm the launch of the Group Policy Editor utility by clicking OK. Expand the "User Configuration" link and go to the "Administrative Templates" section. Expand the “System” node by double-clicking and open the “Make registry editing tools unavailable” policy by also double-clicking. Apply the checkbox in the “Not specified” line and save the changes made by clicking the “Apply” button. Confirm the selected action by clicking OK.

Launch the Registry Editor tool. To do this, return to the main Start menu again and go to the Run dialog again. Type regedit in the “Open” line and confirm the launch of the utility by clicking OK.

Use the standard search mechanism for what you need file system registry. To do this, use the “Find” command in the regedit.exe utility menu. Please note that when you call the context menu of any registry key by right-clicking, the following options also become available: - expand; - create; - find; - delete; - rename.

Familiarize yourself with the structure of the root registry keys to make it easier to find what you need file:- HKEY_CLASSES_ROOT, or HKCR - associations of applications and file extensions;- HKEY_CURRENT_USER, or HKCU - settings parameters current user;- HKEY_LOCAL_MACHINE, or HKLM - general system configuration;- HKEY_USERS, or HKU - settings parameters for all users;- HKEY_CURRENT_CONFIG, or HKCC - settings for this hardware profile. The last branch is not a full-fledged section of the system registry, but is a link to the profiles section in HKLM .

Video on the topic

If you need to make sure that some application or program is loaded automatically when the operating system is loaded, and even to be sure, then there is no more reliable and accurate way than to register the loading of this program in the system Windows registry. Yes, there are simpler ways to solve this issue, but I do not take them into account because they are of little interest.

A few words about - this is a complex database of system parameters and key settings in operating systems from Microsoft. Which, by the way, is not advisable to change or edit. Especially for beginners and regular computer users. Let me warn you right away: if you change some parameters, you may end up with a system restore or a complete reinstallation.. But if you know where to go and what to do, then in general nothing bad will happen.

The first place to start is by launching a program to edit the system registry. This small utility, almost always installed with Windows, is called . To start it you need to go to the start page Windows screen, right-click and select All applications where to find the shortcut Execute .

In the window for executing commands write and press OK.

Answer the question about making changes to this computer Yes. A window for editing the registry should appear.

You can also launch the registry editor by going to the disk C:\ Usually the operating system is installed there. Next enter the folder C:\Windows\ and in this folder find the launch file with the name and run it.

In the system registry editor window that opens, you need to go some way to the place where you can specify a program that will load automatically. You need to go to \HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run .

In this registry item Run you will be able to see what programs and services are registered in Windows startup. But to create our own program, which will load automatically when the system starts, we need to do the following.

Right-click in an empty space and select New -> String Parameter.

Next, come up with a name for it. I will have it notepad. Double-click on the created parameter with the left button. In the window that opens in the form Meaning– write the path to the launch file of your program, which should be loaded when the system starts, I have this in in this example "C:\WINDOWS\notepad.exe". Definitely in quotes! . And click OK.

Now, when you load the operating system, your program will load automatically. Accordingly, to remove it from startup, you need to go into the registry and delete the string parameter you created.

Today it is difficult to find an organization that is not subject to virus attacks. And although anti-virus software is already installed almost everywhere, sometimes it becomes necessary to manually see where in the registry this or that malware starts.

Bezmaly V.F.
MVP Consumer Security

Today it is difficult to find an organization that is not subject to virus attacks. And although anti-virus software is already installed almost everywhere, sometimes it becomes necessary to manually see where in the registry this or that malicious software starts, and it is not even necessarily malicious. When searching for resident malware, we cannot help but worry about the following questions:

This is what this article will focus on.

There are many ways to autoload. Below are a few options. I hope this can help you in finding and removing malware from startup.

Startup methods

Registry

In the Windows 7 registry, startup is represented in several branches:
- programs launched upon login.

Programs that run in this section are launched for all users in the system (Fig. 1).

Figure 1 Autostart for all users

- programs that are launched only once when the user logs into the system. After this, program keys are automatically deleted from this registry section.
Programs that run in this partition run for all users on the system.

- programs that run when the current user logs in

- programs that are launched only once when the current user logs into the system. After this, program keys are automatically deleted from this registry section.

For example, to automatically launch Notepad when the current user logs in, open the Registry Editor (regedit.exe), go to the section

and add the following key:
"NOTEPAD.EXE"="C:\WINDOWS\System32\notepad.exe"

Open the "Group Policy" snap-in (gpedit.msc), go to the "Computer Configuration - Administrative Templates - System" tab. On the right side of the snap-in, go to “Login”. (Fig. 2).

Figure 2 Use group policy for autostart (for all users)

By default, this policy is not set, but you can add a program there: enable the policy, click the "Show - Add" button, specify the path to the program, and if the program being launched is in the ..WINDOWS\System32\ folder, then you can only specify the program name , otherwise you will have to specify the full path to the program.

In fact, in this section of local group policy you can specify additional program or a document that will be executed when the user logs in.

Attention! This policy item is available in Computer Configuration and User Configuration. If both policy items are specified, the program from Computer Configuration will be launched first, and then the user.

At the same time, in the system registry in the section [ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] a subsection is created \ Explorer\Run with the keys of the added programs.

Example:

"1"="notepad.exe"

As a result, we get the launch of Notepad (Figure 3).

Figure 3 Launching Notepad using Local Group Policy

Autorun is set similarly for current users, in the "Group Policy" snap-in this is the path "User Configuration - Administrative Templates - System" (Figure 2), and in the registry section

Attention! However, programs from this list do not appear in the list of programs available for disabling in msconfig.exe, and are also not detected by all startup managers.

Ignore startup lists of programs executed once

Configured using Group Policy: "Computer Configuration - Administrative Templates - System - Logon - Do not process the list of one-time programs"

If you enable this policy, programs launched from the list will not start
If this policy
is enabled, the following key is created in the registry:

"DisableLocalMachineRunOnce"=dword:00000001

The policy for current users is also configured: "User Configuration - Administrative Templates - System - Login - Do not process the list of one-time program launches" Registry settings:

"DisableLocalUserRunOnce"=dword:00000001

Assigned Tasks

Programs can be launched using the "Task Scheduler". You can view the list of installed tasks, as well as add a new one, as follows: “Start - All Programs - Accessories - System Tools - Task Scheduler” - this will open the Task Scheduler window, which displays the assigned tasks (Fig. 4).

Figure 4 Task Scheduler window

To add a new task, you need to select “Create” from the “Actions” menu simple task"(Fig. 5).

Figure 5 Creating a simple task in Task Scheduler

You can run programs using this wizard once, when you log into Windows, when you turn on the computer, or according to a schedule.

Startup folder

The folder in which shortcuts are stored for programs launched after the user logs in. Shortcuts to this folder can be added by programs during installation or by the user independently. There are two folders - common for all users and individual for the current user. By default these folders are located here:

.. \Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup is the folder from which programs will be launched for all users of the computer.

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup is the folder from which programs will be launched for the current user.

You can see which programs you run in this way by opening the menu "Start - All Programs - Startup". If you create a shortcut to a program in this folder, it will launch automatically after the user logs in.

Changing startup folder

Windows reads the path to the Startup folder from the registry. This path is described in the following sections:

“Common Startup”=“%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup”- for all system users.

"Startup"="%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
- for the current user. By changing the path to the folder, we will get all programs from the specified folder to autoload.

"Startup"="c:\mystartup"- the system will load all programs whose shortcuts are located in the c:\mystartup\ folder, while the “Startup” folder will still be displayed in the “Start” menu, and if the user did not have anything in it, he will not notice the substitution .

Replacing a shortcut for a program from the startup list

Let's say you have Acrobat installed. Then in the Startup folder you will have a shortcut " Adobe Reader Speed ​​Launch" - this shortcut is installed there by default. But this shortcut does not necessarily refer specifically to the corresponding application - any other program can be launched instead, especially since this will not affect the functionality of Acrobat.

Adding a program to a program launched from the startup list

Modification of the previous option - simultaneously with loading any program from the startup list, you will start another program - the fact is that you can “glue” two executable file into one and they will run simultaneously. There are programs for such “gluing”. Or the shortcut could refer to batch file, from which both the original program from the list and added third-party programs will be launched.

You can view the list of automatically downloaded programs by opening the "System Information" program (open "Start - All Programs - Accessories - System Information - System Information" or type msinfo32.exe in the command line) and going to " Software environment‐ Automatically loaded programs." The "System Properties" program displays startup groups from the registry and the "Startup" folders (Fig. 6).

Figure 6 Automatically downloaded programs

Another program that allows you to view a list of startup programs is “System Configuration” (to run, type msconfig.exe from command line). In addition to viewing the startup list, this program provides the ability to disable all startup items (the "General" tab) or selected programs (the "Startup" tab).

Conclusion

Of course, the information provided in this article cannot be considered exhaustive, however, I hope it will help you in the difficult task of fighting malware.