How does a program "run itself" at windows startup?

C

Chris

I have a utility program installed.

When windows starts up, I get a message from my firewall that
"<program> is trying to access the internet". Ok, I know what it is trying to do
and why (update its data), and I know it's not anything dubious and I can easily
block it, but just HOW does it do this?

It is not installed as a service.
It is not listed in my startup folder.
It does not appear in the registry under any of the Run, RunOnce, RunOnceEx or
RunServices keys even under an alias (all entries are accounted for).
It does not appear in Services section of WindowsXP Admin tools.

So just how does it "run itself" at windows startup?

Chris.
 
S

Smirnoff

Chris said:
I have a utility program installed.

When windows starts up, I get a message from my firewall that
"<program> is trying to access the internet". Ok, I know what it is
trying to do
and why (update its data), and I know it's not anything dubious and I
can easily
block it, but just HOW does it do this?

It is not installed as a service.
It is not listed in my startup folder.
It does not appear in the registry under any of the Run, RunOnce,
RunOnceEx or
RunServices keys even under an alias (all entries are accounted for).
It does not appear in Services section of WindowsXP Admin tools.

So just how does it "run itself" at windows startup?

Chris.
Click to expand...

Is the <program> a secret? What is it called?
Have you looked in its options (untick "run on start up")
What about Start>Run>msconfig>startup?
 
G

Gotde T Shirt

Chris said:
I have a utility program installed.

When windows starts up, I get a message from my firewall that
"<program> is trying to access the internet". Ok, I know what it is trying
to do
and why (update its data), and I know it's not anything dubious and I can
easily
block it, but just HOW does it do this?

It is not installed as a service.
It is not listed in my startup folder.
It does not appear in the registry under any of the Run, RunOnce,
RunOnceEx or
RunServices keys even under an alias (all entries are accounted for).
It does not appear in Services section of WindowsXP Admin tools.

So just how does it "run itself" at windows startup?

Chris.
Click to expand...

Try running HiJackThis on your system...
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis
 
C

Chris

Is the <program> a secret? What is it called?
Have you looked in its options (untick "run on start up")
What about Start>Run>msconfig>startup?
Click to expand...

No, it's not a secret, just not relevant. I don't want to know about this program
specifically, or start an off-topic discussion about how good/bad it is, or how I
should be using something else! :)

I just want to know how a program (any program) can start itself up *without*
appearing in any of the usual places. I am assuming I have missed one of the ways a
program can start itself up at windows startup.
Have you looked in its options (untick "run on start up")
Click to expand...
Yes, and it is NOT ticked to run at startup or to automatically update itself. If
it was, then surly it (or its updater prog) should appear in my "startup folder" or
in one of the usual registry "run" keys, and would also appear in msconfig\startup.
It does not.

Chris.
 
D

Detlev Dreyer

Chris said:
When windows starts up, I get a message from my firewall that
"<program> is trying to access the internet".
Click to expand...

Note that malware knows how to bypass these toy firewalls and won't
show up there in most cases. You might be better off when using the
WinXP firewall (stateful packet filter) instead.
Ok, I know what it is trying to do and why (update its data), and I
know it's not anything dubious and I can easily block it, but just HOW
does it do this?
Click to expand...

There are several automatic startup locations. In addition, any driver
and loaded software is capable to launch any other programs at any time.
So just how does it "run itself" at windows startup?
Click to expand...

See above. You might see its startup location via MSCONFIG > Startup tab
or when installing this utility: "AutoRuns for Windows"
http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx
 
D

Daave

Chris said:
No, it's not a secret, just not relevant. I don't want to know about
this program specifically, or start an off-topic discussion about how
good/bad it is, or how I should be using something else! :)
Click to expand...

Telling us the name of the program would be the opposite of off-topic!
By mentioning what it is, we could help you configure it so that it
doesn't start automatically at bootup -- or at least explain how it
happens (if you choose to keep it this way).
 
D

Detlev Dreyer

Chris said:
Many thanks.
AutoRuns is a very interesting utility, and it showed my program had inserted an
"at startup" entry into the Windows task schedular.

Never thought of looking there. Problem solved!
Click to expand...

You're welcome!
 
R

Ramesh, MS-MVP

Adding to Detlev's excellent note:

You'd like to visit the link below, which covers all (or most of) the startup launchpoints in Windows.

http://silentrunners.org/sr_launchpoints.html

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


See above. You might see its startup location via MSCONFIG > Startup
tab
or when installing this utility: "AutoRuns for Windows"
http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx
Click to expand...


Many thanks.
AutoRuns is a very interesting utility, and it showed my program had inserted an
"at startup" entry into the Windows task schedular.

Never thought of looking there. Problem solved!

Chris.
 
P

Poprivet

Chris said:
I have a utility program installed.

When windows starts up, I get a message from my firewall that
"<program> is trying to access the internet". Ok, I know what it is
trying to do and why (update its data), and I know it's not anything
dubious and I can easily block it, but just HOW does it do this?

It is not installed as a service.
It is not listed in my startup folder.
It does not appear in the registry under any of the Run, RunOnce,
RunOnceEx or RunServices keys even under an alias (all entries are
accounted for).
It does not appear in Services section of WindowsXP Admin tools.

So just how does it "run itself" at windows startup?

Chris.
Click to expand...

A program doesn't "run itself". Something calls it to run. There are many
more paths to accomplish that than you have mentioned. Thus, without the
name of the application you're referring to, it's not logical or easy to
answer you since there could be many different answers depending on what the
application is. It could of course even be malware. It's also possible for
something that you DO see as having started to have started something else
that in turn is starting the app you're wondering about. Get the idea? For
an accurate answer you have to identify it or put up with guesses and gafs
until you find one you believe or like. Most applications start other
programs as part of their normal operation. It could even be malware which
wouldn't be in any of hte places you looked.
Perhaps what you really need is to ask for some way to monitor what is
starting the various apps on your machine.

Pop`
 
C

Chris

Telling us the name of the program would be the opposite of off-topic!
By mentioning what it is, we could help you configure it so that it
doesn't start automatically at bootup -- or at least explain how it
happens (if you choose to keep it this way).
Click to expand...

Thanks for your input.
However, I was not asking for help in configuring a particular program, but rather
for ideas of how any program could run at startup when it did not appear (to me) to
be in any of the normal registry keys or startup folders.

I deliberately did not mention the programs name because I did not want to start a
discussion about how good/bad that particular program was, and why was I using it,
etc.

The mystery has been resolved now. The program had put a "run at startup" entry
into the Windows task schedular, and I had not thought of looking there!

Thanks anyway.

Chris.
 
C

Chris

A program doesn't "run itself". Something calls it to run. There
are many more paths to accomplish that than you have mentioned.
Thus, without the name of the application you're referring to, it's
not logical or easy to answer you since there could be many different
answers depending on what the application is. It could of course
even be malware. It's also possible for something that you DO see as
having started to have started something else that in turn is
starting the app you're wondering about. Get the idea? For an
accurate answer you have to identify it or put up with guesses and
gafs until you find one you believe or like. Most applications start
other programs as part of their normal operation. It could even be
malware which wouldn't be in any of hte places you looked.
Perhaps what you really need is to ask for some way to monitor
what is starting the various apps on your machine.

Pop`
Click to expand...

Ok thanks. I do realise that something has to start a program and that they don't
"just run". I also now appreciate there are far more ways for a program to be
started up than I was aware of!

My particular mystery has been resolved now. The program had put an entry into the
Windows task schedular, and I had not thought of looking there!

Chris.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

program startup mechanisms - apologies for previosu empty post 1
How to run program after startup 30 min 2
run a program at startup 3
Program Startup 3
Install program at startup 3
Internet Explorer shortcust auto-launches at Startup 2
In what order to startup programs start? 3
Last date a program was run 29

Top