RunServiceOnce subkey : designed to start service programs before user logs on and before other registry subkeys start.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce registry key

RunServices subkey : loads immediately after RunServicesOnce and before user logon.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices registry key

Run subkey : The Run subkey in HKLM runs immediately before the Run subkey in HKCU.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key

RunOnce subkey : primarily used by Setup programs. The HKLM subkey version of RunOnce runs programs immediately after logon and before other registry Run entries. The HKCU subkey version of RunOnce runs programs after Run subkeys and after the Startup folder.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key XP also has RunOnceEx:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx registry key

RunOnce\Setup subkey : specifies programs to run after the user logs on

Explorer\Run subkey :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run registry key

Userinit subkey : there is an entry for userinit.exe but subkey can accept multiple comma- separated values. Can't find where program starting? Look here.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit registry key
load subkey :
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key

All Users Startup folder : very common place to find autostart programs for whoever logs on
Documents and Settings\All Users\Start Menu\Programs\Startup folder

Startup folder : the most common location for programs to automatically boot from
Documents and Settings\user\Start Menu\Programs\Startup folder If you migrated from NT, the path is Profiles\user\Start Menu\Programs\Startup 

                                                                                                    | Infinite Flow..                              |
                                                                                                    | mail :         |
                                                                                                    | Blog :       |
                                                                                                    | twitter : @unpacker                      |
                                                                                                    | CISSP                                        |

Posted by By. PHR34K