I love the Windows system tray. It displays icons of programs that run in the background, such as my antivirus program and Windows Update. I like knowing that these applications are running. But lately I've noticed that more and more icons are unexpectedly appearing in my system tray. These icons represent programs that seem to monitor my CD-ROM and DVD drives, prevent browser pop-up ads, and magically manage my downloads. I don't remember installing these applications, so what other applications might I have unwittingly installed that don't display icons in the system tray?
I expect an application to launch only when I manually start it, when I add it to my startup directory, or when it asks me whether I want it to start automatically. However, some programs start without my knowledge because their installation programs added them to a registry key that works like a startup directory. You can view the startup directories, but you can't easily see programs that have been configured to start up through the registry. To help manage this madness, I wrote a Perl script that lets you easily manage all applications that run when a user logs on.
The Startup Directories
Users who want a program to run every time they log on to their machines can place a shortcut to the application or a copy of the application in their personal startup directories. Administrators who want a particular application to run for any user who logs on to the machine can place a shortcut or copy of the application in each user's personal startup directory or in the All Users startup directory. These applications can be any type of executable file, such as a program, a batch file, or a script.
When a user logs on to a Windows computer, the OS runs all the applications that are stored in the startup directories. To display a list of these applications, select Start, All Programs (or Start, Programs for older OSs), Startup. The list includes the items in the startup directory for the logged-on user and in the common startup directory for All Users. Typically, you'll find a user's personal list of startup applications in %USERPROFILE%\start menu\programs\startup and the All Users startup applications in %ALLUSERSPROFILE%\start menu\programs\startup.
Startup Applications in the Registry
Some vendors choose instead to add their applications to a registry subkey. Vendors use this approach for several reasons, but in my opinion such applications simply appear to be hiding the fact that they run automatically. Furthermore, spyware often uses this method to install itself on systems.
Several registry subkeys can run programs automatically. (For a list of those subkeys, see Top 10, "Windows Program Startup Locations," December 2002, http://www.winnetmag.com, InstantDoc ID 27100.) However, programs most commonly use the Run or RunOnce subkey, each of which has two versions: one for a specific user and one for All Users. The Run subkey contains a list of programs that run every time a user logs on. The RunOnce subkey contains a list of programs that run only the next time the user logs on. After a program in the RunOnce subkey runs, it's automatically removed from the list; hence, the program runs only once. The RunOnce subkey is used primarily by setup routines that reboot the machine and continue setup after the user has logged back on. The Run subkey for a specific user is HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, and the user's RunOnce subkey is HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. The All Users subkeys are HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce.
DumpStartups.pl
DumpStartups.pl helps you manage all the applications that run when a user logs on. The script queries the disk directories and the Run and RunOnce registry subkeys, then displays the programs that are configured to run at start-up and lets the user selectively remove entries. The script relies on several modules and extensions (all of which are free) that might not be installed by default with all Win32 Perl packages. Table 1 lists these modules and extensions, as well how you can obtain them. You can download and install ActiveState's ActivePerl for free at http://www.activestate.com.
Because of space constraints, Listing 1 contains only the callout excerpts. To view the full script, see Web Listing 1 (http://www.winnetmag.com, InstantDoc ID 41663). You can download the script, DumpStartups.pl, from http://www.winnetmag.com. (Enter 41663 in the InstantDoc ID text box, click the Download the Code link, and download the 41663.zip file.)
The code at callout A in Listing 1 loads the Shell32.dll library and exposes the SHGetFolderPath() function, which discovers the startup path both for the current user and for All Users. This code also defines some variables that the SHGetFolderPath() function will use later in the script.