Windows – the “registry editing” equivalent to disabling Windows-7 startup programs with MSCONFIG

A start-up key such as:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Run"="C:\users\bob\desktop\run.bat"

...where "run.bat" contains:

mkdir new

..will start in the following directory: "C:\windows\system32\".

The command line will be:

C:\WINDOWS\system32\cmd.exe /c ""C:\Users\bob\Desktop\run.bat" "

and it will be running as the user "bob".

Trying to create a directory in "C:\WINDOWS\system32\" will get you access denied.

If you like, you can put the command:

pause

in the batch file "before" and "after" your command(s) so you can see it happen at logon. You can even run Process Monitor (https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx) after the first pause to see the outcome.

This is not normal behavior. A 3rd party program is changing this setting--possibly a malicious one.

To determine what program is undoing your setting change, use Process Monitor to watch changes made to the system when you modify the Show Hidden Files option.

The basic process will look like this:

1. Determine what setting is changed when you enable Show Hidden Files. You can probably do this by filtering the events ProcMon displays to only those actions performed by explorer.exe, then changing the setting in the UI.

   Note: Alternately, you could just start by monitoring the Registry value you've already determined you're being prevented from changing.

2. Once you know what actions are triggered by changing the setting, adjust ProcMon's filters to watch for any changes made to the setting. For example, if the setting is a value stored in the Registry, set the filter to only show actions that modify that Registry value.
3. Enable the setting and see what processes touch the setting. You should see the legitimate process followed by the unwanted process.

OR you could go with the likely guess that it's a malicious change and run a full virus scan.