Windows – Bat file added to registry not working on windows

msconfig stores its configuration in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig. The sub key startupreg contains information about the (location=) registry startup entries that you disabled, the sub key startupfolder contains information about the (location=) folder startup entries.

This is not normal behavior. A 3rd party program is changing this setting--possibly a malicious one.

To determine what program is undoing your setting change, use Process Monitor to watch changes made to the system when you modify the Show Hidden Files option.

The basic process will look like this:

1. Determine what setting is changed when you enable Show Hidden Files. You can probably do this by filtering the events ProcMon displays to only those actions performed by explorer.exe, then changing the setting in the UI.

   Note: Alternately, you could just start by monitoring the Registry value you've already determined you're being prevented from changing.

2. Once you know what actions are triggered by changing the setting, adjust ProcMon's filters to watch for any changes made to the setting. For example, if the setting is a value stored in the Registry, set the filter to only show actions that modify that Registry value.
3. Enable the setting and see what processes touch the setting. You should see the legitimate process followed by the unwanted process.

OR you could go with the likely guess that it's a malicious change and run a full virus scan.