HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\RunOnce
He says he's missing his. I don't think I've ever run across a Windows machine without these...
Yes, they *should* be there. Maybe he's just looking in the wrong place?

Have him run "msconfig" from start, run.

Then click on the startup tab. He should also see his startup items in there. He can check/uncheck what he wants starting up. This is for troubleshooting purposes. I'd still delete the registry entries if you find some you don't like.

To help prevent this in the future, have him get the freeware regprot. When a new registry key is going to be added, it will ask him to allow/deny it.

It is a bit of a pain when installing software, so he can just kill the "regprot.exe" process in task manager and then when he reboots, it will be running again. It takes up VERY little memory. Right now, it is using 112k memory. That is the smallest amout of memory that ANY of my other processes are currently using.