◆ 1. System Optimization settings
◆ 1. General System Optimization
1) Disable special effects in system properties, which is a simple and effective way to speed up. Click "start"> "Control Panel"> "system"> "advanced"> "performance"> "set to" optimal performance ">" OK.
2) "My Computer"-"properties"-"advanced"-"Error Report"-select "Disable Error Report ".
3) Click "Start and fault recovery"-"set" to remove the "Write events to system logs", "Send management alarms", and "auto restart" check boxes. Set "Write debugging information" below to "NONE ".
4) "My Computer"-"properties"-"advanced"-"performance"-"Settings"-"advanced", set the virtual memory value to 2.5 times the physical memory value, set the initial size and maximum value to the same value (for example, if your memory is 256 MB, you can set it to 640 MB) and set the virtual memory outside the system disk (note: after moving, delete the original file ).
5) switch the "My Documents" folder to another partition: Right-click "My Documents"-"property"-"move" and set it to a partition other than the system disk.
6) Transfer the IE Temporary Folder to another partition: Open IE and select "tool"-"Internet Options"-"general"-"Settings"-"Mobile folder ", set partitions other than the system disk.
◆ 2. Enable and disable acceleration XP
1) First, open the "System Properties" and click the "advanced" tab, open "Settings" in the "Start and fault recovery" area, and remove the two √ in the "system startup" area, if a multi-system user retains the √ of "display operating system list time. Click "edit" to confirm that the additional attribute of the startup Item is/fastdetect instead of/nodetect. Do not add the/noguiboot attribute first, Because guiboot will be used later.
2) Next, this step is critical. Open the hardware tab in "System Properties", open "Device Manager", and expand "Ide ATA/atapi controller ", double-click the "secondary ide channel" attribute, click the "Advanced Settings" tab, and change the transfer modes of devices 1 and 2 to "DMA (if available )", if you can select none, select none. Click OK to complete the settings. Set "Main ide channel" in the same way ".
3) set pre-read to improve boot speed, open the registry, and find HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ prefetchparameters, in the right window, change the value of enableprefetcher to 1 (0-Disable preread, 1-preread Application Program , 2-the system starts the pre-read, and 3-the first two are pre-read ). If the computer is piII 800 MHz or above, you can try to change the value to 4 or 5.
4) Speed up shutdown. Open the Registry (START-run-Regedit), click "my computer", open "Search" in the "edit" menu, enter autoendtasks, and click "find next ". Double-click the found result and change "value data" to 1 (this option enables the system to automatically stop the Response Program ). Then find hungapptimeout under autoendtasks (set its "value data" to 2000 or smaller, and it is recommended to set it to 200 ), then find waittokillapptimeout (set its "value data" to 2000 or smaller, and it is recommended to set it to 1000 ). Here, we also modify the menu delay time. In the autoendtasks, We can find menushowdelay. The value is in milliseconds. If we want to remove the menu delay, we can set it to 0. After modification, click the "edit" menu, open "find next" (shortcut: F3), continue the search, and set the results to the method in the previous step (Note: The values must be the same ).
5) use the preceding method to locate waittokillservicetimeout and set the value to be the same as waittokillapptimeout.
6) after enjoying the fast restart, we can further accelerate the startup speed and enable the "system attributes"-"advanced"-"Start and fault recovery" settings, open the "system startup" area and add/noguiboot to the end of fastdetect, so that the scroll bar will not be displayed at startup. If you really like the display of this scroll bar, you don't need to do it.
7) msconfig. Select "run"-"msconfig ". Click the "Start" tab to show all programs running during Windows startup. There is no program here, which is a matter of life and death for Windows.
◆ 3. reduce the waiting time for disk Scanning
Select Start> Run. In the run dialog box, type CHKNTFS/T: 0 to set the disk scan wait time to 0; if you want to ignore scanning a partition, such as a drive C, when starting a computer, you can run the "CHKNTFS/x C:" command. If You Want To Resume scanning a drive C, you can use the "CHKNTFS/d c:" command to restore all default CHKNTFS settings, except for the countdown of automatic file check.
◆ 4. Disable the debugger dr. Watson.
Run drwtsn32 to remove all except "dumping all thread contexts. Otherwise, once a program error occurs, the hard disk will ring for a long time and occupy a lot of space. If you have encountered this problem before, find the user. dmp file and delete it, which may save dozens of MB of space. This is the scene of the wrong program, and it is useless to us. Open the registry, find the HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ AeDebug sub-key branch, double-click the auto key value name under it, and change its "value data" to 0, finally, press F5 to refresh and make the settings take effect. In this way, the operation is completely canceled. In addition, memory. dmp displayed on the blue screen can also be deleted. Go to "my computer> Properties> advanced> Settings> write debugging information> select none ".
◆ 5. Disable system restoration"
Right-click "my computer" on the desktop, select "properties", and find "System Restore" to save a lot of space.
◆ 6. Disable "Sleep support"
The sleep function occupies a lot of hard disk space. If you use it less, disable it. Open the control panel-power options-sleep tab and deselect the enable sleep check box.
◆ 7. Cancel the support for zip compressed files
Click Start> Run and enter "regsvr32/u zipfldr. DLL "in the middle of double quotation marks, and then press enter to confirm the success. A Prompt window appears, with the content roughly zipfldr. DLL unrgisterserver succeeded.
◆ 8. Do not load DLL files (uninstall useless dynamic links)
Find the Registry location: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer, and create a dubyte value named alwaysunloaddll with a value of 1. If you want to remove this optimization, you only need to set the key value to 0 (you can also simply delete the key ).
◆ 9. Disable the error report
In the "System Properties" dialog box, select the "advanced" tab and click the "Error Report" button. In the displayed "Error Report" dialog box, select the "Disable Error Report" option, click OK.
◆ 10. Speed up window display
Open the Registry Editor, find HKEY_CURRENT_USER \ Control Panel \ Desktop \ windowmetrics, and change minanimate to 0 in the right window.
◆ 11. Disable Automatic Updates.
Right-click "my computer", select "properties"-"automatic update"-"Disable Automatic update, I will update the computer manually", and click "OK ".
◆ 12. Speed up the display of the Start Menu
Open the Registry Editor and find the "HKEY_CURRENT_USER \ Control Panel \ Desktop \ menushowdelay" primary key. Adjust the key value appropriately. The minimum value can be set to "0 ". If this method is invalid, deselect the "show menu shadow" option from "Control Panel"-"Display Properties"-"Display Effect"-"advanced, you can speed up the display of the Start Menu.
◆ 13. Disable disk Indexes
Open my computer-right-click the drive-"properties"-cancel "use index to quickly find files ".
◆ 14. Accelerate auto-renewal rate
Run the Registry Editor, find HKEY_LOCAL_MACHINE \ ystem \ CurrentControlSet \ Control \ update \, and change the value of DWORD [updatemode] to [0].
◆ 15. Disable auto restart
When Windows XP encounters a serious problem, it will suddenly reboot. You can cancel this function from the registry. Open the Registry Editor and find "HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ crashcontrol \" to change the value of the DWORD of the AutoReboot key to 0.
◆ 16. Delete the attachment.
Use NotePad to modify \ winnt \ INF \ sysoc. INF: use the search/replace function. In the search box, enter ", hide" (an English comma following hide), set "Replace with" to null, and replace all. In this way, remove all hide, save and exit, and run "Add-delete program". Several more options are displayed in "Add/delete Windows Components, in this way, you can delete useless attachments.
◆ 17. Automatic calling of "Windows Messenger" is prohibited at startup"
Run the Registry Editor and find and delete the key "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ MSMSGS.
◆ 18. The desktop settings remain unchanged at each startup
Open the Registry Editor, find the hkey_current_users \ Software \ Microsoft \ Windows \ CurrentVersion \ elastes \ Explorer sub-key branch, find nosavesettings under it, and change its key value to "0 ", or you can directly Delete the key value.
◆ 19. Run the defrag (Disk cleaning) program when the computer is started.
Open the Registry Editor, find the HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ dfrg \ bootoptimizefunction key, set the key value enable to Y to enable, and set N to disable.
◆ 20. Clear pre-read files
Regularly delete all files in this folder, In the \ windows \ prefetch folder of the installation disk.
◆ 21. disk capacity cancellation warning
Open the Registry Editor, find the HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer key, double-click the nolowdiskspacechecks key, change its value to 1, and then click OK. If this key value does not exist, create a New DWORD Value named nolowdiskspacechecks, set the value to 1, and then click OK.
◆ 22. Clear page files (Clear Virtual Memory) When Shutdown)
Open "Control Panel", click "Administrative Tools"> "Local Security Policy"> "Local Policy"> "Security Options", and double-click "shutdown: clear Virtual Memory Page files, click the "enabled" option in the pop-up menu, and click "OK.
◆ 23. disable unnecessary services
Alerter
Microsoft: Notifies selected users and Computer System Management warnings. If you stop this service, programs that use system management alerts will not be notified. If this service is disabled, all services dependent on it cannot be started.
Supplement: Generally, home computers do not need to send or receive warnings from Computer System Management (administrative alerts) unless your computer is used on a local network.
Dependency: Workstation
Suggestion: Disable
Application Layer Gateway Service
Microsoft: supports third-party communication protocol plug-ins for internet online sharing and internet online firewall.
Supplement: if you do not use Internet-based online sharing (ICS) to provide Internet access and Internet-based firewall (ICF) software for multiple computers, you can disable
Dependency: internt Connection Firewall (ICF) Internet Connection Sharing (ICS)
Suggestion: Disable
Application Management)
Microsoft: Provides software installation services for assignment, release, and removal.
Supplement: The software installation and change service mentioned above
Suggestion: Manual
Automatic Updates
Microsoft: enables download and installation of important windows updates. If you disable this service, you can manually update the operating system from the Windows Update Website.
Supplement: Allow Windows to automatically check and download the update patch from Microsoft servers when the background is automatically online.
Suggestion: automatic
Background Intelligent Transfer Service
Microsoft: Uses idle network bandwidth to transmit data.
Supplement: transfers data via http1.1 in the background. For example, Windows Update is one of the tasks.
Dependency: Remote Procedure Call (RPC) and workstation
Suggestion: Disable
Clipbook)
Microsoft: enables the clipboard viewer to store information and share it with remote computers. If this service is stopped, the clipboard viewer cannot share information with a remote computer. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: The information in the clipboard is shared with other computers.
Dependency: Network DDE
Suggestion: Disable
COM + Event System (COM + Event System)
Microsoft: supports the System Event Notification Service (SENS), which allows events to be automatically distributed to the subscribed COM component. If the service is stopped, sens will shut down and cannot provide logon and logout notifications. If this service is disabled, any service that obviously depends on it cannot be started.
Supplement: Some programs may use COM + components, such as the optimize system application of bootvis. For example, the DCOM shown in the Event Viewer is not enabled.
Dependency: Remote Procedure Call (RPC) and System Event Notification
Suggestion: Manual
COM + System Application
Microsoft: manages the configuration and tracking of COM + components. If you stop this service, most COM + components cannot be operated properly. If this service is disabled, any service that explicitly depends on it cannot be started.
Supplement: If the COM + Event System is a vehicle, the COM + system application is the driver. If the DCOM shown in the Event Viewer is not enabled
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual
Computer Browser)
Microsoft: maintains the updated computer list on the network and provides it to the computer used as a browser. If you stop the service, the configuration will not be updated or maintained. If this service is disabled, all services dependent on it cannot be started.
Supplement: Generally, you do not need a home computer unless your computer is used on a local area network. However, is it necessary to enable this function on a large area network to slow down the speed?
Dependency: Server and workstation
Suggestion: Disable
Cryptographic Services
Microsoft: provides three management services to confirm the Windows archive signatures for the [Category directory database service]; add and remove [protected root directory service] For Trusted Root Certificate authorization creden from this computer, and [key service] for assisting in registering this computer for obtaining creden。. If this service is stopped, these management services will not work properly. If this service is disabled, any service explicitly dependent on it cannot be started.
In short, Windows Hardware Quality Lab (WHQL) is a type of Microsoft authentication. If you use automatic update, you may need this
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual
DHCP Client)
Microsoft: Manages network settings by logging on to and updating IP addresses and DNS names.
Supplement: dslcable, ICS, and IPSec users need to specify Dynamic IP addresses.
Dependency: AFD network supports environment, netbt, symtdi, TCPIP protocol driver, and NetBIOS over TCPIP
Suggestion: Manual
Distributed Link Tracking Client (Distributed Link tracing client)
Microsoft: maintains connections between NTFS files on different computers in a computer or network domain.
Supplement: Maintain the file links between different computers in the area network.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Distributed Transaction Coordinator (Distributed Transaction Coordinator)
Microsoft: Coordinates transactions across multiple resource administrators, such as databases, message queues, and file systems. If the service is stopped, these transactions will not occur. If a service is disabled, any service that obviously depends on it cannot be started.
Supplement: As mentioned above, it is generally not suitable for household computers unless you enable Message Queuing.
Dependency: Remote Procedure Call (RPC) and security accounts manager
Suggestion: Disable
DNS Client)
Microsoft: resolve and cache the Domain Name System (DNS) name of this computer. If you stop this service, the computer will not be able to resolve the DNS name and find the location of the Active Directory domain control site. If this service is disabled, all services dependent on it cannot be started.
Supplement: As mentioned above, IPSec also needs to be used
Dependency: TCPIP protocol driver
Suggestion: Manual
Error Reporting Service
Microsoft: Allows error reporting for services and applications executed in non-standard environments.
Supplement: Microsoft application error report
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Event Log (event record file)
Microsoft: event messages sent from Windows-based programs and components can be viewed in the event viewer. This service cannot be stopped.
Supplement: Allow event messages to be displayed on the Event Viewer
Dependency: Windows Management Instrumentation
Suggestion: automatic
Fast User Switching Compatibility
Microsoft: provides application management in a multi-user environment.
Supplement: It is similar to the switching User Function in the logout screen.
Dependency: Terminal Services
Suggestion: Manual
Help and Support
Microsoft: enables the instruction and support center to run on this computer. If this service is stopped, you will not be able to use the instructions and support center. If the service is disabled, all its dependent services cannot be started.
Supplement: if it is not used, it will be disabled.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
HTTP SSL
Microsoft: this service uses Secure Sockets Layer (SSL) to implement Secure Hypertext Transfer Protocol (https) for HTTP Services ). If this service is disabled, any service dependent on it cannot be started.
Supplement: As shown above
Dependency: HTTP
Suggestion: Manual
Human Interface Device Access
Microsoft: enables universal input access to the human interface device (HID). The HID device starts and maintains the use of the keyboard, remote control, and other preset shortcuts on the multimedia device. If the service is stopped, the shortcut of the service control will no longer work. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: As mentioned above
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Imapi CD-Burning COM Service
Microsoft: Uses Image Mastering Applications Programming Interface (imapi) to manage CD recording. If the service is stopped, the computer cannot record the CD. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: XP integrated CD-R and CD-RW drive drag and drop burning function, but unfortunately not comparable to burning software, turn off can also accelerate the speed of Nero
Suggestion: Disable
Indexing Service (Index Service)
Microsoft: indexing content and file attributes of local and remote computers; Fast File Access through elastic query languages.
Supplement: simply put, it can help you speed up search, but I think few people can search with remote computers.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Internet Connection Firewall (ICF) Internet Connection Sharing (ICS)
Microsoft: Provides network address translation, addressing and name resolution services for your home network or small office network, or services that prevent interference.
Supplement: if you do not use internet online sharing (ICS) or internet online firewall (ICF) contained in XP, you can turn it off.
Dependency: Application Layer Gateway Service, Network Connections, Network Location Awareness (NLA), Remote Access Connection Manager
Suggestion: Disable
IPSec services (IP Security Service)
Microsoft: Manages IP Security Principles and starts isakmpoakley (IKE) and IP Security drivers.
Supplement: assists in protecting data transmitted over the network. As an important part, IPSec provides security for Virtual Private Networks (VPNs), while VPN allows organizations to transmit data over the Internet securely. Some domains may be needed, but most users do not need it.
Dependency: IPsec Driver, Remote Procedure Call (RPC), TCPIP protocol driver
Suggestion: Manual
Logical Disk Manager (Logical Disk administrator)
Microsoft: detects and monitors new hard disk and transmits Disk Area Information to the Logical Disk Management System for configuration. If the service is stopped, the dynamic disk status and settings may be out of date. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: the disk administrator is used to dynamically manage disks, such as displaying available disk space and using the Microsoft Management Console (MMC) console functions.
Dependency: Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager Administrative Service
Suggestion: automatic
Logical Disk Manager Administrative Service (Logical Disk Administrator System Management Service)
Microsoft: Set the hard disk and disk area. The service only executes the setting program and then stops.
Supplement: Microsoft Management Console (MMC) is used only when features of the console are used.
Dependency: Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager
Suggestion: Manual
Messenger)
Microsoft: transmits network and [Alerter] service messages between clients and servers. This service has nothing to do with Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, all services dependent on it cannot be started.
Supplement: This function allows mutual message transmission between networks, such as the net send function. If you do not want to be harassed, you can turn it off.
Dependency: NetBIOS interface, Plug and Play, Remote Procedure Call (RPC), and workstation
Suggestion: Disable
MS Software Shadow Copy Provider
Microsoft: manages the shadow replication service in the disk area. If you stop this service, you cannot manage shadow replication in the software-based Disk Area. If this service is disabled, any service that explicitly depends on it cannot be started.
Supplement: As mentioned above, the #124; West used for backup, such as the MS backup program needs this service
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Net Logon
Microsoft: supports pass-through verification for account logon events of computers on the domain.
Supplement: Generally, household computers are unlikely to use the domain name review service.
Dependency: Workstation
Suggestion: Disable
NetMeeting Remote Desktop Sharing (NetMeeting Remote Desktop Sharing)
Microsoft: allows authorized users to remotely access the computer using netmeeting over the company's internal network. If this service is stopped, the Remote Desktop Sharing function will be unavailable. If the service is disabled, any services dependent on it cannot be started.
Supplement: As mentioned above, users can share control of computers with other users on the Internet or the Internet. if you pay attention to security and do not want to open more backdoors, just close them.
Suggestion: Disable
Network Connections (Online Network)
Microsoft: Manages objects in online network and dial-up folders. You can view local network and remote connection in this folder.
Supplement: control your network connection
Dependency: Remote Procedure Call (RPC), Internet Connection Firewall (ICF) Internet Connection Sharing (ICS)
Suggestion: Manual
Network DDE)
Microsoft: Provides network transmission and security for Dynamic Data Exchange (DDE) programs executed on the same or different computers. If this service is stopped, DDE transmission and security cannot be used. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: the average person does not seem to be able to use it.
Dependency: Network dde dsdm, Clipbook
Suggestion: Disable
Network dde dsdm (Network dde dsdm)
Microsoft: Information Dynamic Data Exchange (DDE) network sharing. If the service is stopped, the DDE network sharing will be unavailable. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: the average person does not seem to be able to use it.
Dependency: Network DDE
Suggestion: Disable
Network Location Awareness (NLA)
Microsoft: Collects and stores network settings and location information, and notifies the application when this information is changed.
Supplement: if you do not use ICF or ICS, you can disable it.
Dependency: AFD network supports environment, TCPIP procotol driver, and Internet Connection Firewall (ICF) Internet Connection Sharing (ICS)
Suggestion: Disable
Nt lm Security Support Provider (NTLM security support provider)
Microsoft: provides security for Remote Procedure Call (RPC) programs that do not use named pipeline transmission.
Supplement: If Message Queuing or telnet server is not used, disable it.
Dependency: Telnet
Suggestion: Disable
Performance Logs and alerts (performance record files and alerts)
Microsoft: Collects performance data from the local computer or remote computer based on preset schedule parameters, and then writes the data into records or #124; sends alerts. If the service is stopped, performance information is not collected. If this service is disabled, any service explicitly dependent on it cannot be started.
Supplement: Services of no value
Suggestion: Disable
Plug and Play (plug-and-play)
Microsoft: enables computers to identify and adapt to hardware changes without or without input from users. Stopping or disabling this service will cause system instability.
Supplement: As the name implies, it is the PNP environment.
Dependency: Logical Disk Manager, Logical Disk Manager Administrative Service, messenger, smart card, telephony, Windows Audio
Suggestion: automatic
Portable Media Serial Number
Microsoft: retrieves the serial number of any portable music player connected to your computer
Supplement: Can I retrieve any music dial numbers through an online computer? No value services
Suggestion: Disable
Print Spooler (print multi-task buffer processor)
Microsoft: load the file into memory for printing later.
Supplement: If there is no printer, you can turn it off.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Protected Storage (protected storage device)
Microsoft: Provides protected storage areas for storing sensitive data such as private keys to prevent unauthorized services, processing, or users from accessing them.
Supplement: services used to store passwords on your computer, such as outlook, Dialup programs, other applications, master-slave architecture, etc.
Dependency: Remote Procedure Call (RPC)
Suggestion: automatic
QoS RSVP (QoS licensing control, RSVP)
Microsoft: Provides network signal and Regional Traffic Control Installation functions for programs that can identify QoS and control applets.
Supplement: the service is used to retain the 20% bandwidth. If your network card does not support 802.1 p or you do not have an ACS server on your computer's domain, you don't need to talk about it.
Dependency: AFD network supports environment, TCPIP procotol driver, Remote Procedure Call (RPC)
Suggestion: Disable
Remote Access Auto Connection Manager (Remote Access automatic online administrator)
Microsoft: when the program references the remote DNS or NetBIOS name or address, it establishes a remote network connection.
Supplement: Some dslcable providers may need to use this to process the login program.
Dependency: Remote Access Connection Manager, telephony
Suggestion: Manual
Remote Access Connection Manager (remote access online administrator)
Microsoft: establishes network connection.
Supplement: online network use
Dependency: telephony, Internet Connection Firewall (ICF) Internet Connection Sharing (ICS), Remote Access Auto Connection Manager
Suggestion: Manual
Remote Desktop Help Session Manager
Microsoft: manages and controls Remote Assistance. If the service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the [dependency] label in the content dialog box.
Supplement: The Remote Management and Control assistance mentioned above can be disabled if it is not used.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable
Remote Procedure Call (RPC) (Remote Procedure Call, RPC)
Microsoft: Provide the end point corresponding program and other RPC? /CN>
Respondent: Shi Lin 123-assistant level 2 11-16
1. Classic startup-"Startup" folder
Click "Start> program" and you will find a "start" menu, which is the most typical Windows Startup location. Right-click the "Start" menu and select "open" to open it, the programs and shortcuts run automatically when the system starts.
2. Famous startup-Registry Startup item
The Registry is the place where the startup program hides the most, mainly including the following items:
1. Run key
The run key is the most favored self-starting place for viruses. The key location is [hkey_current _
User \ Software \ Microsoft \ Windows \ CurrentVersion \ Run] and [hkey _
LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run], all programs under it will be automatically executed in order each time the login is started.
There is also an unnoticed run key, which is located in the registry [hkey_current _
User \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ Run] and [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \
Policies \ Explorer \ Run.
2. runonce key
Runonce is located in [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \
CurrentVersion \ runonce] and [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \
The Windows \ CurrentVersion \ runonce] key. Unlike run, programs under runonce are automatically executed only once.
3. runservicesonce key
The runservicesonce key is located in [HKEY_CURRENT_USER \ Software \ Microsoft \
Windows \ CurrentVersion \ runservicesonce] and [HKEY_LOCAL_MACHINE \
In SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runservicesonce], the program is automatically started and executed once when the system is loaded.
4. runservices key
The programs started after runservicesonce are located in the registry [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ runservices] and [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \
Runservices] key.
5. runonceex key
This key is a Windows XP/2003 self-starting registry key, located in [hkey _
CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ runonceex] and [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runonceex].
6. Load key
The load key value program under [HKEY_CURRENT_USER \ Software \ Microsoft \ WindowsNT \ CurrentVersion \ Windows] can also be started by itself.
7. Winlogon key
The key is located in the registry [HKEY_CURRENT_USER \ Software \
Microsoft \ Windows NT \ CurrentVersion \ Winlogon] and [HKEY_LOCAL_MACHINE \
SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]. Note that the values of notify, userinit, and shell can also be self-started, and their key values can be separated by commas, this allows you to start multiple programs during logon.
8. Other registry locations
There are also some other key values, and some programs will often run automatically here, such as: [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ shell]
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ shellserviceobjectdelayload]
[HKEY_CURRENT_USER \ SOFTWARE \ Policies \ Microsoft \ WINDOWS \ SYSTEM \ scripts]
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ WINDOWS \ SYSTEM \ scripts]
Common Startup-System Configuration File
The Windows configuration file (including the windows. ini, system. ini, and wininit. ini files) also loads some automatically running programs.
1. win. ini file
Use NotePad to open win. in the INI file, you can directly add executable programs after the "run =" and "load =" statements in the [windows] section, as long as the program name and path are written after "=.
Tips
The program after "load =" is minimized after self-startup, and the program runs normally after "run =.
2. system. ini file
. Virus is not welcome. For example, if the "kiss of the demon" virus is changed to "shell = c: \ yz1_exe133, if you force Delete the virus program yzw.exe, Windows will prompt an error, so that you can reinstall windows. Isn't it scary? There are also good viruses, such as changing the sentence into another program name ". In this case, the other program names that follow must be virus program 2.
3. wininit. ini
Wininit. the INI file is a system configuration file that is easily ignored by many computer users, because the file will be automatically deleted after it is automatically executed during Windows startup, this means that the commands in this file will be automatically executed only once. This configuration file is mainly generated by the software installer and cannot be deleted, updated, or renamed after the Windows GUI is started. If it is written into dangerous commands by viruses, the consequences are the same as those of drive C killer.
Tips
★If you do not know where they are stored, press F3 to open the "Search" dialog box for search;
★Click "Start> Run", enter sysedit, and press enter to open the "System Configuration Editor". Here, you can conveniently view and modify the above files.
5. Smart Start-on/shutdown/login/logout script
In Windows 2000/XP, click Start> Run and enter gpedit. MSC press enter to open the "Group Policy Editor". In the left-side pane, expand "Local Computer Policy> User Configuration> management template> system> Logon ", in the right pane, double-click "run these programs upon user logon" and click "show". The self-started programs are displayed under "projects running upon Logon.
6. Scheduled Start-Task Plan
By default, the "Task Scheduler" program is started with windows and runs in the background. If you add a program to the scheduled task folder and set the scheduled task to "system startup" or "Logon", the program can also be started automatically. Programs loaded with scheduled tasks generally have their icons in the system tray area of the taskbar. You can also double-click the "scheduled task" icon in the "control panel" to view the project.
Tips
The "Task Scheduler" is also a special system folder. Click "Start> program> attachment> System Tools> Task Scheduler" to open the folder for easy viewing and management.
