What are Run Keys?

As an essential component of any computer system employing one of the Windows operating systems, Windows users should be aware of their system's registry, its fundamental contents, and their importance.

Briefly defined, the Windows Registry is a hierarchical catalog that stores important data, such as a computer's configuration settings and system options. All computer systems that Run one of the Microsoft Windows operating systems can claim a Windows Registry, and Run keys are a part of the Windows Registry and is a type of registry key.

A Windows Registry contains several different types of keys, many of which are meant to launch particular programs when Windows is booted up (i.e. startup keys). Run keys are one such type of startup registry keys.

Defining a Windows Registry's Run Keys

Run keys are startup registry keys that cause certain programs to launch automatically each time Windows is launched on a computer system that utilizes a Windows OS. Even more, Run keys are the particular type of registry keys most often employed as startup locations for computer applications to install auto start from. Auto start is utilized by programs that either need to be, or configured by users to be, automatically launched whenever a system is booted up. For instance, computer security software and security tools are usually automatically configured during the installation process to launch and remain constantly running while their corresponding computer systems are turned on and Running.

In other words, Run keys are what allow certain computer programs and applications to begin Running and continue Running while a computer system is running. Without applications like Run keys and auto start, computer users would have to launch manually each and every one of their computers' essential, core applications every time they started their Windows system.
The following provides the location of Run keys for computers running in Windows operating systems:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

By default, Run keys are not implemented in Windows Safe Mode. To have Run keys executed in Safe Mode, you can prefix the values of Run keys with an asterisk (*). All of this makes Run keys a fundamental part of the booting up process of a Windows operating system.

The Importance of Understanding Run Keys

Usually and in most cases, the type of behavior exerted by Run keys and other startup registry keys is useful, safe, and legitimate.

The problem, though, is that some programs – such as, fake computer security applications, other malware programs, spyware, hijackers, Trojan, worms, and other breeds of harmful computer infections – take advantage of startup registry keys, namely useful auto start functions provided by Run keys, and employ them to load automatically their malicious applications, as well.

For this reason, it pays to know what Run keys are, what they do, and how to inspect regularly your startup registry keys for unwanted intruders.

To this end, Windows supplies users with an application that will provide a list of programs that are automatically launched from some of its startup registry keys' locations. This supplied program is titled Msconfig.exe. The unfortunate part of this application is that it does not offer such lists of program from all startup keys' locations. Msconfig.exe only offers lists of programs from a limited number of startup keys.