Startup routines

Posted on 2005-04-17
Last Modified: 2013-12-29
On a W98SE machine, I had a problem with shutdown (hanging). Did the usual trouble shooting -- Task manager to disable each process and restart, then MSCONFIG. Discovered the problem in MSCONFIG: to wit, a blank line with absolutely nothing on it. I uncheck the box on the black line and the computer shuts down fine now. But I sure would like to find the registry value or leftover garbage that is causing that blank line when I run MSCONFIG. In other words, I'd like to delete that non-value from the registry...or wherever else it is. Any ideas on the blank line in MSCONFIG?
Question by:normanml
    LVL 15

    Expert Comment

    hey chief -

    Run Regedit and go to :

    \HKEY Local Machine\Software\Microsoft\Windows\CurrentVersion\Run

    LVL 9

    Accepted Solution

    If you have a blank entry in MSCONFIG it is likely to be as a result of one of two things:

    (1) A program install/uninstall has not completed properly and therefore not updated the registry "Run" keys. Looking at these registry keys may in some cases reveal an entry with a Name but no Data, others may have neither:


    Check these keys and see if there's an entry under Name and it may give a clue. As no program isn't being loaded in the Data column then the registry entry can safely be deleted.

    (2) Disabling an entry in MSCONFIG hasn't updated the resgitry properly. If you check the registry keys you can often find one with a valid "Name" but no "Data"

    (3) A virus or other maliscious piece of software has compromised the system. Many virusses modify various registry keys, including the "Run" keys.

    Make sure any virus scanners you have are using up-to-date virus definitions and perform a full system scan of all files.
    LVL 23

    Expert Comment

    by:Mohammed Hamada
    Actually Chances are you won't be able to spot it when you launch Regedit and navigate to that location.
    One way to fix it it is through a regfile that deletes, then recreates the entire Run key.
    The unchecked items in Msconfig (those starting from the registry) are subkeys to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg, and that's were you can remove them.

    Make sure you backup your registry before doing anything.

    check this forum for more informations about it,6927435

    And good luck.
    LVL 38

    Expert Comment

    For an instant list of startups, do this:

    1. Start menu > Run > and type MSINFO32 > click "OK"
    2. In the left pane, find "Software Environment"
    3. For each of the following sections, click on it and then use the menu as follows:
               Edit > Select All > Edit Copy
    4. Paste each into NotePad and save by the name of the section in MSINFO32

    Software Environment\
                                     Startup Programs

    "Startup Group" = a Shortcut in your Start menu's "Startup" folder (a .lnk file)
    "Machine Run" = HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    "Per user Run" = HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    "Machine Service" = HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    As paraghs has stated, the "RunOnce" keys can hold the clue.  Installers, or making some configuration change that require a reboot, writes an entry to the "RunOnce" or "RunOnceEx" keys and this SHOULD ONLY be executed at the next reboot and then removed.  Ocassionally, entries can remain.

    As explained in moh10ly's linked page, the unchecked items in MSCONFIG are actually the original entries from the Run or RunServices keys that are recreated in a Run- or RunServices- key.  When you check the entry in MSCONFIG and reboot, the entries are moved back to the Run or RunServices keys.  For that reason, uninstalling and then reinstalling a program while one of its components is disabled in one of those Run- or RunServices- keys will often create 2 entries to the same startup.  One checked and the other unchecked.

    Where a startup folder shortcut is disabled in MSCONFIG, it will create a new folder on the Start menu named "Disabled Startup Programs" (or similar name) while it is disabled.

    NOTE:  I am puzzled by moh10ly's quoted registry key.
    On my Win98se machine, there is no such registry key as:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

    I don't know whether this is a Windows XP-specific key.  I would have to check this.

    Author Comment

    Thanks, Paraghs. Actually in using your list I found the culprit in RunServices- (What's the difference betwee RunServices and RunServices-?) Anyway it was the default key, which had a *""* instead of *(no value set)*. I imported the key just in case, then deleted it and Registry created another, and the line was gone from MSConfig.
    LVL 9

    Expert Comment

    The "-" after a registry key having "Run" means that the particular item has been disabled from loading at startup.

    Check this MSKB article on Run keys :

    Glad to help :)
    LVL 38

    Expert Comment


    Every registry key has a [Default] StringValue (the value with the burgundy "ab" on the icon).  If you create a new key, it automatically creates a [Default] = [value not set].  It would appear that something has previously been set as the [Default], but has been subsequently removed.  Possibly some form of Spyware, or maybe a badly-written but legitimate installation process that should have used the RunOnce key to do something at reboot.

    Well spotted.  

    Normally, if you RIGHT-Click on a StringValue in Regedit (where it has a data value other than [value not set]), you can "Modify" the data value to something else.

    You will no doubt now be aware that, if you RIGHT-Click on the [Default] StringValue in any key (where it shows as [value not set]) and choose "Modify" from the sub-menu, the  "Value Data" field shows nothing ata all.  Typing in the words [value not set] only creates a text string [value not set] enclosed in " " , which is not a valid command when used in the Run or RunServices keys.

    Good work and happy computing.

    Author Comment

    Thanks paraghs and BillDL for your comments and help.
    LVL 38

    Expert Comment

    A pleasure, Norman

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    Join & Write a Comment

    The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
    A Bare Metal Image backup allows for the restore of an entire system to a similar or dissimilar hardware. They are highly useful for migrations and disaster recovery. Bare Metal Image backups support Full and Incremental backups. Differential backup…
    This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now