Tjyylli

I'm trying to delay the startup of a specific program that loads at login. As per an answer in this question, I should be able to do it using Task Scheduler. The problem is, I can't find the program listed anywhere. Is there a particular pane I should be looking in? The program is Razer Synapse so I don't think it would be in the Microsoft or Western Digital folders.

If it's not in Task Scheduler, is there another way I can delay it at startup?

Out of curiosity how many ways are there for a program to be run at Startup in Windows?

I can't find the program listed anywhere.

There are many locations that can be used to run programs on startup. You need to check them all until you find the program you are looking for.

There are a few programs that allow easy checking of the startup locations.

1. 
   

   msconfig (Startup tab):

   
   
   

   

   
   


2. 
   

   Autoruns from SysInternals:

   
   
   

   

   
   


3. 
   

   WhatInStartup from NirSoft:

   
   
   

   

   
   


4. 
   

   WinPatrol:

   
   
   

   

   
   
   

   Note:

   
   
   
   
   
   • WinPatrol allows you to move programs from "Startup Programs" to "Delayed Start"
   
   
   • You can specify the delay time if you do this.
   
   
   
   

   
   

   
   

How many ways are there for a program to be run at Startup in Windows?

There are at least 17 locations from where programs can be started. See below.

Windows Program Automatic Startup Locations

Upon turning on the computer the following autostart locations are
processed in the following order:

1. 
   

   Windows Boot Device Drivers

   
   
   
   
   
   • These drivers are loaded first as they are required for the proper operation of hardware such as storage devices.
   
   
   • Boot device drivers will be located under the following key and have a Start value equal to 0.
   
   
   
   

   
   Registry Keys:

   
   
   

   HKEY_LOCAL_MACHINESystemCurrentControlSetServices
   
   

   
   
   

   Windows will now perform various tasks and then start the Winlogon
   process. Winlogon eventually starts the service control manager that
   loads services and drivers that are set for auto-start.

   
   


2. 
   

   Windows Auto-start Services & Drivers

   
   
   
   
   
   • The Service Control Manager (SCM) process (WindowsSystem32services.exe), will now launch any services or
     drivers that are marked with a Start value of 2.
   
   
   
   

   
   Registry Keys:

   
   
   

   HKEY_LOCAL_MACHINESystemCurrentControlSetServices
   
   

   
   


3. 
   

   RunServicesOnce

   
   
   
   
   
   • This key is designed to start services when a computer boots up.
   
   
   • These entries can also continue running even after you log on, but must be completed before the HKEY_LOCAL_MACHINE...RunOnce registry
     can start loading its programs.
   
   
   
   

   
   Registry Keys:

   
   
   

   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
   
   HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
   
   

   
   


4. 
   

   RunServices

   
   
   
   
   
   • This key is designed to start services as well.
   
   
   • These entries can also continue running even after you log on, but must be completed before the HKEY_LOCAL_MACHINE...RunOnce registry
     can start loading its programs.
   
   
   
   

   
   Registry Keys:

   
   
   

   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
   
   HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServices
   
   

   
   
   

   The Windows logon prompt is shown on the Screen. After a user logs in
   the rest of the keys continue.

   
   


5. 
   

   Notify

   
   
   
   
   
   • This key is used to add a program that will run when a particular event occurs.
   
   
   • Events include logon, logoff, startup, shutdown, startscreensaver, and stopscreensaver.
   
   
   • When Winlogon.exe generates an event such as the ones listed, Windows will look in the Notify registry key for a DLL that will
     handle this event.
   
   
   • Malware has been known to use this method to load itself when a user logs on to their computer. Loading in such a way allows the
     malware program to load in such a way that it is not easy to stop.
   
   
   
   

   
   Registry Key:

   
   
   

   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotify
   
   

   
   


6. 
   

   UserInit Key

   
   
   
   
   
   • This key specifies what program should be launched right after a user logs into Windows.
   
   
   • The default program for this key is C:windowssystem32userinit.exe. Userinit.exe is a program that
     restores your profile, fonts, colors, etc for your user name.
   
   
   • 
     

     It is possible to add further programs that will launch from this key by separating the programs with a comma. For example:

     
     
     

     HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogonUserinit
     =C:windowssystem32userinit.exe,c:windowsbadprogram.exe.

     
     
   
   
   
   

   This will make both programs launch when you log in and is a common
   place for trojans, hijackers, and spyware to launch from.
   Registry Key:

   
   
   

   HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonUserinit
   
   

   
   


7. 
   

   Shell Value

   
   
   
   
   
   • This value contains a list of comma separated values that Userinit.exe will launch.
   
   
   • The default shell for Windows is explorer.exe, though there are legitimate replacements that have been made. When userinit.exe starts
     the shell, it will first launch the Shell value found in
     HKEY_CURRENT_USER. If this value is not present, it will then launch
     the value found in HKEY_LOCAL_MACHINE.
   
   
   
   

   
   Registry Key:

   
   
   

   HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon\Shell
   
     HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon\Shell
   
   

   
   
   

   The rest of the Autostart locations will now be processed.

   
   


8. 
   

   RunOnce Local Machine Key

   
   
   
   
   
   • These keys are designed to be used primarily by Setup programs.
   
   
   • Entries in these keys are started once and then are deleted from the key.
   
   
   • If there is an- exclamation point preceding the value of the key, the entry will not be deleted until after the program completes,
     otherwise it will be deleted before the program runs. This is
     important, because if the exclamation point is not used, and the
     program referenced in this key fails to complete, it will not run
     again as it will have already been deleted.
   
   
   • All entries in this key are started synchronously in an undefined order.
   
   
   • Due to this, all programs in this key must be finished before any entries in HKEY_LOCAL_MACHINE...Run, HKEY_CURRENT_USER...Run,
     HKEY_CURRENT_USER...RunOnce, and Startup Folders can be loaded.
   
   
   • The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe Mode. The RunOnce keys are not supported by Windows NT 3.51.
   
   
   
   

   
   Registry Keys:

   
   
   

   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnceEx
   
   

   
   


9. 
   

   Run

   
   
   
   
   
   • These are the most common startup locations for programs to install auto start from.
   
   
   • By default these keys are not executed in Safe mode. If you prefix the value of these keys with an asterisk, *, it will run in Safe Mode.
   
   
   
   

   
   Registry Keys:

   
   
   

   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
   
   HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
   
   

   
   


10. 
    

    All Users Startup Folder

    
    
    
    
    
    • For Windows XP, 2000, and NT, this folder is used for programs that should be auto started for all users who will login to this computer.
    
    
    
    

    
    It is generally found at:

    
    
    
    
    

    • Windows XP C:Documents and SettingsAll UsersStart
MenuProgramsStartup

    
    

    • Windows NT C:wontProfilesAll UsersStart
MenuProgramsStartup

    
    

    • Windows 2000 C:Documents and SettingsAll
UsersStart MenuProgramsStartup

    
    
    
    


11. 
    

    User Profile Startup Folder

    
    
    
    
    
    • This folder will be executed for the particular user who logs in.
    
    
    
    

    
    This folder is usually found in:

    
    
    
    
    
    • Win 9X, ME c:windowsstart menuprogramsstartup
    
    
    • Windows XP C:Documents and SettingsLoginNameStart MenuProgramsStartup
      
    
    
    
    


12. 
    

    RunOnce Current User Key

    
    
    
    
    
    • These keys are designed to be used primarily by Setup programs.
    
    
    • Entries in these keys are started once and then are deleted from the key.
    
    
    • If there is an exclamation point preceding the value of the key, the entry will not be deleted until after the program completes,
      otherwise it will be deleted before the program runs. This is
      important, because if the exclamation point is not used, and the
      program referenced in this key fails to complete, it will not run
      again as it will have already been deleted.
    
    
    • The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe Mode.
    
    
    • The RunOnce keys are not supported by Windows NT 3.51.
    
    
    
    

    
    Registry Key:

    
    
    

    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
    
    

    
    


13. 
    

    Explorer Run

    
    
    
    
    
    • These keys are generally used to load programs as part of a policy set in place on the computer or user.
    
    
    
    

    
    Registry Keys:

    
    
    

    HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
    
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
    
    

    
    


14. 
    

    Load Key

    
    
    
    
    
    • This key is not commonly used anymore, but can be used to auto start programs.
    
    
    
    

    
    Registry Key:

    
    
    

    HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindowsload
    
    

    
    


15. 
    

    AppInit_DLLs

    
    
    
    
    
    • This value corresponds to files being loaded through the AppInit_DLLs Registry value.
    
    
    • The AppInit_DLLs registry value contains a list of dlls that will be loaded when user32.dll is loaded.
    
    
    • As most Windows executables use the user32.dll, that means that any DLL that is listed in the AppInit_DLLs registry key will be loaded
      also. This makes it very difficult to remove the DLL as it will be
      loaded within multiple processes, some of which can not be stopped
      without causing system instability.
    
    
    • The user32.dll file is also used by processes that are automatically started by the system when you log on. This means that
      the files loaded in the AppInit_DLLs value will be loaded very early
      in the Windows startup routine allowing the DLL to hide itself or
      protect itself before we have access to the system.
    
    
    
    

    
    Registry Key:

    
    
    

    HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWindows
    
    

    
    


16. 
    

    ShellServiceObjectDelayLoad

    
    
    
    
    
    • This Registry value contains values in a similar way as the Run key does.
    
    
    • The difference is that instead of pointing to the file itself, it points to the CLSID's InProcServer, which contains the information
      about the particular DLL file that is being used.
    
    
    • The files under this key are loaded automatically by Explorer.exe when your computer starts. Because Explorer.exe is the shell for your
      computer, it will always start, thus always loading the files under
      this key. These files are therefore loaded early in the startup
      process before any human intervention occurs.
    
    
    
    

    
    Registry Key:

    
    
    

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
    
    

    
    


17. 
    

    SharedTaskScheduler

    
    
    
    
    
    • This section corresponds to files being loaded through the SharedTaskScheduler registry value for XP, NT, 2000 machines.
    
    
    • The entries in this registry value run automatically when you start windows.
    
    
    
    

    
    Registry Key:

    
    
    

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
    
    

    
    

The following are files that programs can autostart from on bootup:

1. c:autoexec.bat


2. c:config.sys 3 . windirwininit.ini - Usually used by setup programs to have a file run once and then get deleted.


3. windirwinstart.bat


4. windirwin.ini - [windows] "load"


5. windirwin.ini - [windows] "run"


6. windirsystem.ini - [boot] "shell" 8 . windirsystem.ini - [boot] "scrnsave.exe"


7. windirdosstart.bat - Used in Win95 or 98 when you select the "Restart in MS-DOS mode" in the shutdown menu.


8. windirsystemautoexec.nt


9. windirsystemconfig.nt

Source Windows Program Automatic Startup Locations

Disclaimer

I am not affiliated with SysInternals, Nirsoft or WinPatrol in any way, I am just an end user of the software.

If your program isn't available in Task Scheduler, then it could be residing in the Registry or in the startup folder, or running as a background service.

Startup folder's location for all users is as follows:
C:ProgramDataMicrosoftWindowsStart MenuProgramsStartUp

Startup folder's location for current user is as follows:
C:UsersUsernameAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

Startup registry's location for all users is as follows:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce

Startup registry's location for current user is as follows:
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce

Once you find your program name, you can safely disable it, and make a new task in the Task Scheduler and delay it as you need.

If you are not able to find your program is the above locations, the it could be residing in the services console. Hit start button and type services.msc and get services management console and you'll find your program there.

You can download Autoruns from Microsoft's SysInternal suite and check for yourself a whole bunch of startup programs.

There is a BIG, very BIG indeed, problem with some "programs".

Each time they run, they set / touch the registry to add an entry on SoftwareMicrosoftWindowsCurrentVersionRun so next boot they will run again as soon as login, and they do not have any option to disable such thing.

I hate such way of doing things, but sometimes such program must run (drivers related).

Just as an example: a document/paper flat scanner that without a program running (has no GUI) on background does not work at all, that program get installed when drivers are installed (it is not twain compatible, sorry!, just in case some expert think on that other way of getting arround the problem)... now the bad part, such program put it self into registry, so it allways runs as soon as login, now the worst part, if i delete the registry entry while such program is running, it re adds the entry.

I have a very ugly workarround (mix of automated and manual tasks) to avoid having it running all the time (most days i do not use such scanner, also more, a lot of days i have it not connected to USB port)... it is based on running a script that does two things or three... launch the .lnk for starting that program, launch a wait/sleep for two minutes (the time that program freeze the Windows while it is being starting) so the script waits for such program to be enterly loaded, then launch the .lnk of the scanner front-end gui so i can scan papers. After i finish i manually use ProcessExplorer to kill auch program, then run a .reg i created to delete the entry from the registry, so it will not run on next boot.

Since when i delete the registry entry such program is not running (i killed it before) it can not add to the registry, the entry to lauch it self on next boot... if i forgot to kill it, as soon as i delete the entry (press F5 to refresh registry entries) it has been re-created.

If i do it that way i gain each day more than two minutes on each boot.

So how can any tool get arround that ugly (to not say any worst word) way of doing things: The program add it self to start up, not only each time it is run, as soon as the entry is deleted.

I had use a tool (very similar to the RegMon from SysInternals, but with a different GUI so it tells you the time took from one event to next event on same registry "folder" that is been monitorized), from when i delete the entry till such ugly program re-create it, only pass beteween 0.00001 and 0.0002 seconds (yes less than two miliseconds), so such program must use a hook to the registry to monitor changes (indeed it has, a debugger i used also show it has).

So how can anyone run a program that monitors registry to add it self to startup list if it is not there.

I tried one more thing (not so stupid as you may think, it is just a test), i rename (not delete) the entry and see what happens... the entry is renamed back to what such program wants.

If such program only monitorize the "deletion" of the named "X", there is a "trick", based on rename it prior to delete the renamed one; in this case it does not work... the program also monitorize anything done to the entry and revert back it to what it wants... so while program is working, there is no other option ... it will be re-run on next boot, unless after killing it the registry key is deleted.

Also worst... a driver update make things worst, much worst... now i can not kill such task after it is started... it does something very weird, so unless i kill a task called "system" (yes the main windows task) i can not kill it, but killing such task obviously would make a very beautifull BSOD.

Solution (that did not work at all): Unplug the USB scanner, uninstall driver, scanner application and all things related to it, remove device from USB list telling to remove all files used for it, etc. Use CCLeaner to clean invalid registry entries... since main program is running on background, i can not kill that task, i can avoid registry from having the launch entry, etc... rebooting into safe mode (the program also adds it self to registry for secure boot) is not a solution, program is again runned.

Also i had tried one cannon solution... use a tool to set such file to be deleted on next boot, but next boot told: The file can not e deleted, it is in use.

The last update of the driver put a lot barriers to disallow not having it running... so i would got to the "master" solution (if i not be catholic), go to the manufacter with the scanner and break it on the head of the responsible of such way of running the "driver"... since i am catolic... i do the other "master" solution... no, not format it... take a Linux Live and from Linux edit the partition of the Windows System and "delete" the program, that way it can not be running on next boot... if i do not forget to remove the +20 places where it is on the HDD... and remember, it is not a trojan, not a malware... it is a driver for a quite old scanner from a very welll known manufacture (two letters in abrev.)... and then boot into windows, clean registry, etc... and never ever again plug that scanner on any computer... since plugging it, it auto-install that driver without any option to avoid it... since Windows had downloaded last version of such driver (if no internet connection) it also install the last one (tested) and again the same problem... and same solution... delete all files using a Linux.

I know there is a tool to edit registry security, but it does not allow to chage locked entries, and changing the full SoftwareMicrosoftWindowsCurrentVersionRun security is too much harm, not to mention it is of no sence... such program that edits the registry is running in system account... more privilegies than administrator one... too much more, that it can jump all security.

Trully, it is the top most worst program i found to get rid of it... much more than virus, trojan, malware, etc... and it is a "driver" for a scanner.

Why i do not let it run on each boot: when it starts it takes a little more than two minutes where PC seem to be freezed, no matter if run at boot, or run manually after boot... in such two minutes you can not do anything, no screen refresh, no mouse pointer moving, etc.

Now i have a TWAIN compatible USB scanner, that other one i only use it to smash rocks on the yard! I won't let anyone to suffer what i suffer... and of course i will not buy anything from that manufacture again, no matter what ever say.

Well, said that, very, very extreme case... i must admit, i use a lot of programs that tend to run on start-up... a lot of them have an option to not auto-run on logon, but others do not have such option... any of them lock the registry, nor re-add to the registry... but there are a couple of them, that after lauched the re-add them selves to the start-up registry entry.

For such ones, i have my own launch script: launch the .lnk of the program, do a sleep of some minutes (enough to let them re-add to registry), launch the .reg to delete such entry... and voila, at next boot they are not run again.

But one of them, re add it self on exit, so i must use a very different aproach, my script is: launch the program with a /wait (use start to launch it), but ensure you launch the program not the .lnk... then the script is waiting / sleep till the program ends, then the script continue, and delete the registry entrie.

Another one is quite a bit more tricky... needs a shutdown task on taskmanager... since when it starts it launches another process in no wait way... so my script (with /wait) would only wait till main program ends (a few miliseconds) but not for the main one that is launched... so my shutdown script does: try to kill the program, then delete the registry.

In other words... if registry is not locked... my top very best fail proof solution is to use my own script (with a black list like) that runs on shutdown, it kills the programs involved and then delete teh registry keys i do not want on next boot to be run.

That way i can launch the programs only when i want and not on all the boots.

Side effect: some of them need to be run with elevated / admin rights... and since i do not want to disable ACM, i must press an OK for each one... if i let them on boot they run without need for such confirmation.

It would be glad from M$ to have implemented in another way... if something need elevated rights, ask for it and let the user tell (do not ask me more times in the future), as well as when editting a .lnk to tell need elevated rights / runas admin... have another option (do not ask) and to activate such option ask the user as when elevated asks... so can not be trapped and only be activated by the real user... etc.

Till then, if i must run an app that put it self onto registry, i will use a RegMon monitoring all such +8 places where an app can put an entry to auto-run on next boot... i do not know of any freeware that can do something similar for folders, neither for scheduler... except one very intrusive, that asks you for confirmation on ANY change... something that makes some apps to fail (time-out messages).

I leave all this info, for the rest to know and just in case any developer see it and would be able to create a great FreeWare tool for: lock the real registry auto run entries, directories, schedule tasks, but let apps think they had modified it, like a sand-box tool; then present to the user which one wants which change and let mark/check if allowed or not, so next boot would be as desired by user, not by each app.