Jump to content

Registry Locations to Check for Autoruns


Recommended Posts

From what I have gathered, CCleaner checks

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

and

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

as well as the user Startup directories for the Startup Tool

 

The following locations contain single programs that are also executed during logon...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms

 

These are slightly more system critical entries, so if they are added, they should only appear if an advanced option for them is checked.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.