One thing HijackThis does is read the registry keys that are used for startups. Note that the registry doesn't start anything itself, it is pure data. The operating system looks in the registry to find out what it should start. One of the keys that HijackThis looks at is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run That key looks like this on my PC:

The HijackThis scan shows it this way:

This was the facet that sparked the interest in the connection between HjT and the ease of general registry usage. There is a leap of faith that some old time users of the registry fail to pick up on. Some see HjT as some new gizmo toy that doesn’t follow the rules of direct regedit manipulation and therefore they don’t trust it. Some just have a deep fear and loathing of the registry. This user below has obviously come face to face with the kraken of legend.

lmao, but I do feel sympathy for his feelings of rage – Microsucks does have a special talent for developing this amongst users…… As another user puts it: “It is very unfortunate that Microsoft has chosen to deal with the Registry and Registry editing as a "black art," leaving many people in the dark as to the real uses of all the settings in the systems. Microsoft's refusal to adequately, and publicly, supply information about the correct settings is extremely frustrating and added further mystery to registry. Certainly, more damage has and will be done because of lack of knowledge than because of too much information.” Sad but true. To classify the keys would have been hard enough. To explain the resultant system taxonomy in detail would be problematic at best. There must have been some serious arguments sorting out the initial organisation of the keys and sub keys. Some seem coherently grouped; others seem bizarre imho. Enough ranting…. One question arises; are there plans to extend the categories that HjT looks at to other areas of the registry? or will that be on an ‘as required’ basis as things develop..….. thanks for the terrific responses, Ice

This seems to be something overlooked in all of the logs fixed here and the other forums. Just last week was my first introduction to XP (Which I hate, only because I could not find my way around. Argh.). It wasnt until I understood the seperation/isolation of all of the User areas that I was able to do anything. For instance, after running Trojan scan and HJT on that computer, (which was my aunts, and you would not believe the amount of Trojans and crapware I found.) I went to cleanup/delete some files, I thought I was pretty much finished. But, then, she wanted me to clean her master drive because it was almost full. So I started moving some stuff to the slave. Then I came across a few files that should have gotten fixed by HJT and the deletion process (That's when the understanding of the seperate areas REALLY clicked into my head). I didnt understand how the files I deleted could still be there, (in one of the other accounts), after the fix. If I remember right they were empty, but I think that demonstrates exactly what you are talking about (the seperation of user accounts). Then I started wondering if the virii/trojans could still be hiding somewhere in those other accounts, which I discounted because I sat there and watched it scan through all of the individual accounts. What I'm thinking and maybe need someone to answer for sure, is that the trojan and virus scans should find everything because they scan every file individually, but what about Spybot, HJT etc. that only scans (I am guessing here) the registry of the user account you are using. I did use the main account when doing the fixes, but does this matter. From what you say, it sounds like it may not.

So a question. Why havent I seen any experts or admin ask someone to scan on all accounts if this is true (what you say, somehow makes sense to me too) Let me know what you all think, and thanks, this was a very nice thread. Boney

Good point, boneychil This weekend I was over at a friend's and installed AdAware for them. Then I tightened up some of their Internet Explorer settings, and installed IE-Spyad. Then I realized that it had to be done for each user. And it made me wonder about how some things that are cleaned up are only user specific. I agree that we should ask about other user accounts. However, this may lead to an increase in the volume of HJT logs!!!