This list determines which programs will start automatically when the PC is turned on. It should be borne in mind that with a significant number of such programs, computer performance may noticeably decrease.
Of course, for full-fledged work, some programs need to be launched before the system is fully loaded (for example, an antivirus will not be able to protect the device otherwise), but most programs are not needed by the user so often.
Meet msconfig.exe
To manage the set of startup programs in Windows 7, the msconfig.exe utility is used, which can be called through the " Run” (available in the menu “ Start"or through a combination Win+R). This tool allows you not only to control startup, but also to carry out other system settings, however, in this case, you need to be careful, as you can disrupt Windows.
In the main window of the msconfig.exe program, you must activate the "" tab. A list of programs will open, some of which are marked with checkmarks, which means permission to autoload. The new settings take effect after a system reboot. This program also allows you to configure the services that are allowed to start automatically. However, it's best not to touch a service unless the user is sure of its purpose.
You can also edit the startup list using third-party software, for example, use the CCleaner utility. To configure programs in the main window, you must activate the section " Service”, then select the appropriate item. A table will appear in the window, in which various information will be displayed next to the programs, including permission to autoload.
Registry, here we need a registry
Advanced users can also remove programs from startup by editing the system registry. The registry editor can be activated by typing " Run» command « regedit" (the name of the program). A window will open, the main registry keys will be displayed on the left side with the ability to open subdirectories.
Autoload appears in two branches. In the first case, you need to open the section HKEY_CURRENT_USER and go along the path: Software\Microsoft\Windows\CurrentVersion\Run. In the second case, you need to select a branch HKEY_LOCAL_MACHINE and follow the same path.
But it's time to switch from Windows 7 to Windows 10, or even .
Today it is difficult to find an organization that has not been subjected to virus attacks. And although antivirus software is already installed almost everywhere, sometimes it becomes necessary to manually see where in the registry this or that malware starts.
Bezmaly V.F.
MVP Consumer Security
Today it is difficult to find an organization that has not been subjected to virus attacks. And although anti-virus software is already installed almost everywhere, sometimes it becomes necessary to manually see where in the registry this or that malware starts, and not even necessarily malicious. When searching for resident malware, we cannot help but worry about the following questions:
This is what this article will be devoted to.
There are many ways to autoload. Below are a few options. I hope this will help you find and remove malware from startup.
Autoload methods
Registry
In the Windows 7 registry, autoload is represented in several branches:
- Programs that run when you log in.
Programs that are launched in this section are launched for all users in the system (Fig. 1).
Figure 1 Autostart for all users
- programs that run only once when the user logs into the system. After that, the program keys are automatically removed from this registry key.
Programs that run in this section run for all users on the system.
- programs that run when the current user logs into the system
- programs that run only once when the current user logs in to the system. After that, the program keys are automatically removed from this registry key.
For example, to automatically start Notepad when the current user logs in, open the Registry Editor (regedit.exe), go to the section
and add the following key:
"NOTEPAD.EXE"="C:\WINDOWS\System32\notepad.exe"
Open the Group Policy snap-in (gpedit.msc), go to the Computer Configuration - Administrative Templates - System tab. On the right side of the snap-in, go to the "Login" item. (Fig. 2).
Figure 2 Usage group policy for autorun (for all users)
By default, this policy is not set, but you can add a program there: enable the policy, click the "Show - Add" button, specify the path to the program, and if the program being launched is located in the ..WINDOWS\System32\ folder, then you can only specify the name of the program , otherwise you will have to specify the full path to the program.
In fact, in this section of the local group policy, you can specify an additional program or document that will be executed when the user logs on to the system.
Attention! This policy item is available in Computer Configuration and User Configuration. If both policy items are set, then the program from Computer Configuration will be launched first, and then the user.
At the same time, in the system registry in the section [ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] a subsection is created \ explorer\Run with the keys of the added programs.
Example:
"1"="notepad.exe"
As a result, we get the launch of Notepad (Fig. 3).
Figure 3 Launching Notepad using Local Group Policy
Similarly, autorun is set for current users, in the "Group Policy" snap-in, this is the path "User Configuration - Administrative Templates - System" (Fig. 2), and in the registry, the section
Attention! At the same time, programs from this list are not displayed in the list of programs available for disabling in msconfig.exe, and are also not detected by all startup managers.
Ignore startup lists of programs executed once
Configured using Group Policy: "Computer Configuration - Administrative Templates - System - Logon - Do not process the list of one-time start programs"
If this policy is enabled, then programs launched from the list will not run.
If this policy
enabled, the following key is created in the registry:
"DisableLocalMachineRunOnce"=dword:00000001
The policy for current users is also configured: "User Configuration - Administrative Templates - System - Logon - Do not process the list of one-time launch programs" Registry settings:
"DisableLocalUserRunOnce"=dword:00000001
Scheduled tasks
Programs can be started using the "Task Scheduler". You can view the list of installed tasks, as well as add a new one: "Start - All Programs - Accessories - System Tools - Task Scheduler" - this will open the Task Scheduler window, which displays scheduled tasks (Fig. 4).
Figure 4 Task Scheduler window
To add a new task, you need to select the item "Create a simple task" from the "Actions" menu (Fig. 5).
Figure 5 Creating a simple task in the Task Scheduler
You can start programs using this wizard once, when you log on to Windows, when you turn on the computer, and also according to a schedule.
Folder "Startup"
A folder that stores shortcuts to programs that are launched after the user logs on to the system. Shortcuts to this folder can be added by programs during their installation or by the user himself. There are two folders - common for all users and individual for the current user. By default, these folders are located here:
.. \Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup is the folder from which programs will be launched for all users of the computer.
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup is the folder from which programs will be launched for the current user.
You can see which programs you run in this way by opening the "Start - All Programs - Startup" menu. If you create a shortcut for a program in this folder, it will start automatically after the user logs in.
Change startup folder
Windows reads the path to the Startup folder from the registry. This path is described in the following sections:
"Common Startup"="%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"- for all users of the system.
"Startup"="%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
- for the current user. By changing the path to the folder, we will get autoloading of all programs from the specified folder.
"Startup"="c:\mystartup"- the system will load all programs whose shortcuts are located in the c:\mystartup\ folder, while the "Startup" folder will still be displayed in the "Start" menu, and if the user had nothing in it, he will not notice the change .
Changing the shortcut for a program from the startup list
Let's say you have the Acrobat package installed. Then in the "Startup" folder you will have a shortcut "Adobe Reader Speed Launch" - this shortcut is installed there by default. But it is not at all necessary that this shortcut refers specifically to the corresponding application - any other program can be launched instead of it, especially since this will not affect the functionality of Acrobat.
Adding a program to a program launched from the startup list
Modification of the previous version - simultaneously with the loading of any program from the startup list, you will start another program - the point is that you can "glue" two executable files into one and they will run at the same time. There are programs for such "gluing". Or the shortcut may refer to a batch file, from which both the original program from the list and the added third-party programs will be launched.
You can view the list of automatically loaded programs by opening the "System Information" program (open "Start - All Programs - Accessories - System Tools - System Information" or type msinfo32.exe at the command prompt) and go to "Program Environment - Startup Programs" . The "System Properties" program displays startup groups from the registry and "Startup" folders (Fig. 6).
Figure 6 Automatically loaded programs
Another program that allows you to view a list of startup programs is "System Configuration" (to run, type msconfig.exe from command line). This program, in addition to viewing the startup list, provides the ability to disable all startup items (the "General" tab) or selective programs (the "Startup" tab).
Conclusion
Of course, the information provided in this article cannot be considered exhaustive, but I hope it will help you in the hard work of fighting malware.
Many programs are created with the automatic addition of a shortcut to the autorun menu. This factor is specific to software that needs to run in the background. Thus, after turning on the computer, the application starts automatically.Over time, the accumulated programs can affect the performance and speed of the Windows 7 system (it is worth noting that autoloading the Steam and Skype applications can significantly increase the download operating system). If, after turning on the system, only one antivirus functions in the processes, then the computer works without loss of performance, but if several applications are running, various problems may occur, including general slowdown and instability of the PC, which is especially noticeable on ordinary or weak computers.
Removing a program from the startup folder
To get rid of the problems present and improve the overall functionality of the PC, Windows 7 autorun is configured. There are several methods for controlling applications that are integrated into the OS during installation. By default, Windows 7 startup shortcuts are located in the main menu, familiar to each user. To find this section, you need (Fig. 1):- Click on the button on the desktop Start.
- Then select the "All Programs" subcategory.
- Among the abundance of various shortcuts to applications and folders, you need to go to the section "Autostart".
It opens exactly those applications that have been operating since the OS was loaded. If you delete shortcuts from this folder, they will no longer work in the background on the next boot. Thus, you can remove applications from startup. But what if the label desired program is not in this list, and the program itself is loaded along with the operating system?
There are a number of different tools that can be used to set up autoruns for third-party or system software. The simplest and most understandable method is the use of standard resources integrated into the OS. There are two methods for configuring applications participating in autorun - this is the registry and the command line (the command line is only required to run the utility msconfig). As intimidating as the second way may sound, msconfig- a very simple and versatile utility that helps you perform a wide variety of changes in the system with simple commands.
How to disable autorun applications registered in the Windows registry using a convenient program built into Windows 7
msconfig is a serious system utility with great capabilities for managing the operating Windows system 7, but anyone can master it. You can find it in Windows by name through the usual search in the menu Start. You can also press the keyboard shortcut Win+R, then enter its name in the line and press Enter(Fig. 2).
Figure 2. Launching the msconfig utility through the Run window. After turning on the application, we go to the startup tab. In this menu, we carefully examine each item to determine the specific purpose. You should not disable all applications, since antivirus and similar programs must be active. By checking the boxes next to the applications, make the settings. The presence of a check mark means that the program is executed when the operating system boots. The absence, respectively, deactivates it.
Setting method using msconfig quite effective and relevant, because it provides a fine, efficient and most understandable configuration of autoload and other manipulations.
How to View Startup Applications in the Windows 7 Registry
To open the registry editor, you need to press the keys Win+R, then in the opened window "Run" write a command regedit and press the key Enter(Fig. 4).
Figure 4. Launching the Registry Editor by pressing the Win+R keys and entering the regedit command. The Registry Editor window that opens up looks intimidating, but actually resembles Windows Explorer.
To change the automatic start of the current session, you need to find in the list (in the left column) a folder called "HKEY_CURRENT_USER" and follow the path HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run(Fig. 5).
Figure 5. Finding the necessary registry keys to configure application startup.
Thus, you can easily configure the launch of applications.
List of Windows 7 registry keys where you need to look for applications registered in startup:
What do you need to add a new application to autostart?
To implement the solution to this problem, you will need to create a shortcut to the desired software in the startup folder. This is easy to do. From the desktop, copy the shortcut of the required application to the above path, and after the next reboot software will start with the operating system.This is how debugging of autorun applications in Windows 7 is done. Do not forget to save restore points so that if you do something wrong, you can return the system to its original state.
What are the autoload methods? Where can I find a list of programs loaded automatically by Windows? How to disable autoload lists? These topics are the focus of this article.
There are many ways to autoload programs. Below are a few options for review, perhaps this will help you if you need to find and remove any program from startup.
Registry
- - programs that run when you log on to the system. This section is responsible for launching programs for all users of the system.
- - programs that run only once when the user logs on to the system. After that, the program keys are automatically removed from this registry key. This section is responsible for launching programs for all users of the system.
- - programs that run only once, when the system boots. This section is used when installing programs, for example, to run configuration modules. After that, the program keys are automatically removed from this registry key. This section is responsible for launching programs for all users of the system.
- - programs that run when the current user logs into the system
- - programs that run only once when the current user logs on to the system. After that, the program keys are automatically removed from this registry key.
- - programs that are loaded at system startup before the user logs into Windows.
- - programs from here are loaded only once, when the system boots.
For example, to automatically start Notepad when the current user logs in, open the Registry Editor (regedit.exe), go to the section and add the following key:
"NOTEPAD.EXE"="C:\WINDOWS\System32\notepad.exe"
Using group policy for autorun:
Open the Group Policy snap-in (gpedit.msc), go to the Computer Configuration - Administrative Templates - System tab. On the right side of the snap-in, select "Run the specified programs at logon". By default, this policy is not set, but you can add a program there: turn on the policy, click the "Show - Add" button, specify the path to the program, and if the program being launched is located in the ..WINDOWS\System32\ folder, then you can only specify the name of the program , otherwise you will have to specify the full path to the program. At the same time, the subkey \Explorer\Run with the keys of the added programs is created in the system registry in the section. Example:
"1"="notepad.exe"
"2"="iexplore.exe"
As a result, we get the launch of Notepad and Internet Explorer for all users. Similarly, autorun is set for current users, in the Group Policy snap-in this is the path "User Configuration - Administrative Templates - System", and in the registry the section
At the same time, programs from this list are not displayed in the list of programs available for disabling in msconfig.exe, and are also not detected by all startup managers.
Autostart from a special list
Programs can also be launched from the following registry key:
Parameters:
"load"="programma" — programs that run before the user logs in:
"run"="programma" — programs that run after the user logs in to the system.
These parameters are analogous to autoloading from Win.ini in Windows 9x. Example: we start Internet Explorer before the user logs in and Notepad after the user logs in:
"load"="iexplore.exe"
"run"="notepad.exe"
Don't handle autoplay list for older versions
It is configured using Group Policy: "Computer Configuration - Administrative Templates - System - Do not process the autorun list for older versions", if this policy is enabled, programs from the following registry keys will not start:
When this policy is used, the following key is created in the registry:
"DisableLocalMachineRun"=dword:00000001
Similarly, the policy for current users is set: "User Configuration - Administrative Templates - System - Do not process the autorun list for old versions" with the difference that this option is enabled in the registry in a different place:
"DisableLocalUserRun"=dword:00000001
Ignore startup lists of programs executed once
Configured using group policy: "Computer Configuration - Administrative Templates - System - Do not process the list of autorun programs that run once", if this policy is enabled, programs launched from the list will not start
If this policy is enabled, the following key is generated in the registry:
"DisableLocalMachineRunOnce"=dword:00000001
The policy for current users is also configured: "User Configuration - Administrative Templates - System - Do not process the autorun list of programs that run once" Registry settings:
"DisableLocalUserRunOnce"=dword:00000001
Scheduled tasks
Programs can be started using the "Task Scheduling Wizard". You can view the list of installed tasks, as well as add a new one: "Start - All Programs - Accessories - System Tools - Scheduled Tasks" - this will open the folder ..\WINDOWS\Tasks, which displays scheduled tasks. To add a new task, double-click on the "Add task" icon with the left mouse button. You can start programs using this wizard once, when you log on to Windows, when you turn on the computer, and also according to a schedule.
Folder "Startup"
This is a folder that stores shortcuts to programs that run after a user logs on to the system. Shortcuts to this folder can be added by programs during their installation or by the user himself. There are two folders - common for all users and individual for the current user. By default, these folders are located here:
- ..\ Documents and Settings \ All Users \ Main Menu \ Programs \ Startup is a folder from which programs will be launched for all users of the computer.
- ..\ Documents and Settings \ Username \Main Menu\Programs\Startup is the folder from which programs will be launched for the current user (here it is called Username).
You can see which programs you run in this way by opening the menu "Start - All Programs - Startup". If you create a shortcut for a program in this folder, it will start automatically after the user logs in. If you hold down the "Shift" key when a user logs in, programs from the "Startup" folders will not run.
Change startup folder
Windows reads the path to the Startup folder from the registry. This path is described in the following sections:
"Common Startup"="%ALLUSERSPROFILE% \ Main Menu \ Programs \ Startup" - for all system users.
"Startup"="%USERPROFILE% \ Main Menu \ Programs \ Startup" - for the current user.
By changing the path to the folder, we will get autoloading of all programs from the specified folder. For example:
"Startup"="c:\mystartup" - the system will load all programs whose shortcuts are located in the c:\mystartup\ folder, while the "Startup" folder will still be displayed in the Start menu, and if the user has there was nothing, then he will not notice the substitution.
Changing the shortcut for a program from the startup list
Let's say you have a Russian-language package installed Microsoft office. Then in the "Startup" folder you will have a shortcut "Microsoft Office Quick Launch" - this shortcut is installed there by default. But it is not at all necessary that this shortcut refers specifically to the "Microsoft Office Quick Launch" - any other program can be launched instead, especially since this will not affect the functionality of Office.
Adding a program to a program launched from the startup list
Modification of the previous option - at the same time as loading any program from the startup list, you will start another program - the fact is that you can "glue" two executable files into one and they will run simultaneously. There are programs for such "gluing". Or the shortcut may refer to a batch file, from which both the original program from the list and the added third-party programs will be launched.
You can view the list of automatically loaded programs by opening the program "System Information"(open "Start - All Programs - Accessories - System Tools - System Information" or type msinfo32.exe in the command line) and going to the item "Programming environment - Automatically loaded programs". The System Properties program displays startup groups from the registry and Startup folders.
Another program that allows you to see a list of startup programs is "System Setup"(to start, type msconfig.exe from the command line). This program, in addition to viewing the startup list, provides the ability to disable all startup items (the "General" tab) or selective programs (the "Startup" tab).
Note
The information provided is for reference purposes only. All the information above applies primarily to advanced users who are able to restore the system after erroneous changes to the registry. If you are not sure that in case of erroneous actions you will be able to restore the system, do not use the information provided for practical purposes, erroneous actions when making changes to the registry can seriously damage the system and even lead to a system reinstallation. Novice users should only use the Startup folder or the Scheduled Task Wizard to add programs to the startup list.
If you need to make sure that some application or program is loaded automatically when the operating system is loaded, and even to be sure, then there is no more reliable and accurate way than to register the loading of this program in the system Windows registry. Yes, there are simpler ways to solve this issue, but I do not take them into account because of their low interest.
A few words about - this is a complex database system parameters and key settings in operating systems from Microsoft. Which, by the way, is undesirable to change and edit. Especially for beginners and ordinary computer users. I will warn you right away if you change some parameters, you can get to the system restore or its complete reinstallation. But if you know where to go and what to do, then in general, nothing bad will happen.
The first thing to start with is to launch a program for editing the system registry. This little utility, which is almost always installed with Windows, is called . To run it, you need to go to the start windows screen, click on the right mouse button and select the item All applications where to find the label Run .
In the command window, write and press OK.
To the question of making a change to this computer, answer Yes. A window for editing the registry should appear.
You can also launch the registry editor by going to the disk C:\ usually the operating system is installed there. Next enter the folder C:\Windows\ and in this folder find the startup file with the name and run it.
In the system registry editor window that opens, you need to go some way to the place where you can specify the program that will be loaded automatically. You need to go to \HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run .
In this registry entry Run you can see what programs and services are registered in Windows startup. And to create our own program, which will be loaded automatically at system startup, we need to do the following.
Right-click in an empty area and select Create -> String Parameter.
Next, come up with a name for it. I will have it notepad. Double-click on the created parameter with the left button. In the opened window in the form Meaning- write the path to the executable file of your program, which should be loaded at system startup, I have it in this example "C:\WINDOWS\notepad.exe". Be sure to quote! . And push OK.
All now, when you boot the operating system, your program will load automatically. Accordingly, to remove it from startup, you need to go to the registry and delete the string parameter you created.
