Hidden auto start programs

Question

Running up-to-date 32-bit Windows 7 Professional with an administrator account. On login I have several programs running either via the Registry (HCU and HLM) or from the All Users Startup menu (nothing in the User menu). However I also have three programs that run on login that don't appear here. Two of these I'm fine with, but the third is getting annoying.

As one of the three is Outlook it's not difficult to try and spot or search for the program name amongst the normal sections of automatically run programs and I've run through msconfig and "Autoruns for Windows" without luck. Beyond digging through the registry for every instance of outlook.exe where could it be?

If it helps as memory serves Windows asked me if I wanted to make Outlook a default startup programme and I said yes not expecting it to tuck it away in some far inaccessible corner or some batch file I'm not looking for.

Oh and it's not a 'run at login because it was open at shutdown/restart' either as I've manually shut it down each time and it still keeps reappearing nor is there an option to "run at startup" in the program. Even if it was I'd still be interested as to where the outlook startup is being kept.

Answer 1

When you configured Outlook you may have seen a msg on the lines of 'set outlook as default mail handler' but there would not have been any msg to set it as a start up.

To set Outlook as a start up you would have needed to manually add the outlook shortcut to the Start Up folder.

Its posible that a third party outlook add-in has created a win autostart, but I've never seen any outlook add-in do this.

Your statement that outlook is not run at log-in or pwer on of win is at odds with you stating that Outlook is running at log-on.

So when you power on is outlook actually running? or do you perhaps mean that you start outlook, then later close it, but its still a running process?

Answer 2

Here are a few more of the major keys that can be used:

1. Check all the \run, \runonce, \runservices and \runservicesonce keys (not all of them will necessarily be present).

2.. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit. This points to the program C:\WINDOWS\system32\userinit.exe and the entry ends with a comma. Other programs can be started from this key by appending them and separating them with a comma. Malware sometimes uses this key.

3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

This key is used to add a program that will run when a particular event occurs. When Winlogon.exe generates an event, Windows will look in the Notify key for a DLL to handle this event. Malware sometimes uses this key.

Answer 3

"but there would not have been any msg to set it as a start up."

Yes, yes there was it ran along the lines of "Windows has noticed you start this up when you log in would you like it to do so automatically?"

"Your statement that outlook is not run at log-in or pwer on of win is at odds with you stating that Outlook is running at log-on."

I didn't say Outlook did not run at log-in I stated that I made sure Outlook was closed down before I logged off so it wasn't simply restoring the original state. Despite this Outlook starts up.