Probably at the usual places of:

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
or
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

Of course, HijackThis looks there, so if you don't want to futz with the registry, that'd be the way to go.