Startup Folder, HKCU/.../Run, HKLM/.../Run. Where Else to Look to Track Down a Mysterious Login Event?

Question

Starting around the time I installed the Office 2010 Beta, Whenever I login, Windows tries to open a file named "Bob", coincidentally the first part of my username. Selecting Notepad to open it, and it contains TCP/IP network settings.

I've looked for and deleted unrecognized entries in my StartUp folder, in HKLM/.../CurrentVersion/Run and in HKCU/.../CurrentVersion/Run with no luck.

Is there any other place I should be looking for errant entries?

Answer 1

Get thee a copy of Sysinternals' Autoruns and use to root out all manner of things that get injected into your system.

Most likely is that there's a program attempting to start that's using an unquoted path. The shell attempts to parse the filename and fails. Double-check anything in Autoruns that references (or starts from) your profile.

Answer 2

Check out your MSConfig (Run-->MSconfig) or grab Autoruns from Microsoft.

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them.

Answer 3

Click 'Start' and type msconfig in the search box and hit Enter.

This should bring up a dialog. On this dialog, click 'Startup'. That tab will list everything that is run at startup.

Answer 4

If you are running Windows 7 64 bit, check HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run