Search notes:

Programs that might automatically be started in Windows

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup

Tasks that are executed by Task Scheduler.

The value of AlternateShell in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot

Programs listed in the registry under the «run keys»

Programs that are listed in the registry under the following «run keys» are also automatically started:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce (only when members of the Administrators group log on after the reboot)

Values listed in RunOnce are deleted before (or after if prefixed with a !) the command is run.

These commands are not executed when the computer is started in safe mode (except when their values are prefixed with a *).

See also