This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup.
WHAT IS THE PROBLEM?
Virtually all applications you install using the default installation these days decide that they should start-up when Windows starts. If you allow these to take control, you can end up with a situation where (unless you have sufficient memory installed) every other program slows down to be unusable.
The reason for this is that all of these programs use a portion of the system memory and resources which leaves a smaller percentage for other programs once they're opened. On my old system for example, prior to tweaking I had 33 programs running at start-up with the system resources at 59% and Windows took an age before it was ready for use. Post tweaking I had a mere 10, with system resources back to 92% and Windows was up and running within a minute.
HOW CAN I IDENTIFY THESE PROGRAMS?
Win9x/Me/2K/XP users:
Use the "System Configuration Utility" (MSCONFIG) to identify startup programs. MSCONFIG is available for all Win9x/Me/2K/XP users (Win95/2K user can use the respective versions from here).
You invoke it by clicking Start then Run. In the Open box, type msconfig.exe followed by enter. Once displayed, click on the "Startup" tab. You will see a list of items and the 2 columns that we're interested in are "Name" (WinME) or "Startup Item" (WinXP) and "Command". For Win98 the columns aren't named but the one on the left is the equivalent of "Name" and the one on the right is the equivalent of "Command":
WinNT users:
Use a free utility from SysInternals called AutoRuns which displays all the startup locations. Highlight an item and click on "Jump to" and it will take you to the appropriate startup location, including the registry keys where appropriate:
If the registry editor is opened (REGEDIT), you will see a list of items and the 2 columns I'm interested in are "Name" and "Data":
Alternatively, you can use a startup manager.
Notes:
(1) The "Close Program" window in Win9x/Me and "Task Manager" window in WinNT/2K/XP (both can be accessed via the CTRL+ALT+DEL key combination) displays some startup programs AND other background tasks and "Services". This site is concerned with startup programs ONLY (from the common startup locations). For a list of tasks/processes you should try WinTasks 5 Standard/Professional from Uniblue Systems Ltd or the list at AnswersThatWork.
(2) I won't be including "Services" from the WinNT/2K/XP operating systems. I fully understand that some programs with these OS's use "Services" as an alternative to load their component parts at startup but I don't have the time available to include these as well. For Win2K services information see TechSpot's article here. For WinXP services see TechSpot's article here or The Elder Geek's article here.
HOW CAN I DISABLE THEM FROM RUNNING AT START-UP?
A number of methods can be prevent programs from running at startup. What these are how you use them is described here.
My recommendations are that you try each of the methods listed below in that order. Each method has an indication of which Windows operating system it is applicable to.
1) Using a program's own configuration options - Windows 95/98/Me/NT/2000/XP
The best option is to check if a program gives you an option to disable the function you're interested in - via a right-click on a System Tray icon or maybe an "options" menu within the program. If this isn't available then you have to try something else.
For example, Norton SystemWorks has an "Options" tab on the main start-up screen that allows you to configure the utilities in the suite - Norton Utilities, Norton AntiVirus and Norton Cleansweep.
2) Windows StartUp folder - Windows 95/98/Me/NT/2000/XP
If you click on Start -> Programs -> StartUp (Win9x/Me/NT/2K) or Start -> All Programs -> StartUp (WinXP) you may find programs loading from here via shortcuts. If this is the case, you have two options :-
Delete the shortcut from the StartUp directory (based on your OS):
Win9x/98/Me - C:\Windows\Start Menu\Programs\StartUp
WinNT/2K - C:\Winnt\Profiles\All Users\Start Menu\Programs\StartUp
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Create a temporary directory for your OS called "Disabled StartUp Programs" and move the shortcuts there. If a program doesn't work as expected you can always move the relevant shortcut back again
Win9x/98/Me - C:\Windows\Start Menu\Programs
WinNT/2K - C:\Winnt\Profiles\All Users\Start Menu\Programs
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs
3) System Configuration Utility (MSCONFIG) - Windows 95/98/Me/2000/XP
Work your way through the list of programs included here and deselect the appropriate boxes in your version then click OK followed by re-starting Windows.
WinME and WinXP display items for the same program in different ways in MSCONFIG. WinME uses the same descriptive text under the MSCONFIG "Name" and registry Run keys "Name" columns. WinXP often uses the first part of the filename under the "Startup Item" column and the equivalent descriptive part in the "Name" column of the registry "Run" keys. For instance, on my WinXP Home machine I have ZoneAlarm and see:
MSCONFIG : "Startup Item" = zlclient & "Command" = zlclient.exe
REGISTRY : "Name" = Zone Labs Client & "Data" = zlclient.exe
Virus entries in the program list are only shown using the registry version in this case to prevent unnecessary duplication due the number of them.
Notes:
When you have deselected an item in MSCONFIG, you will be starting in "Selective startup" mode. This can be seen under the "General" tab. Working in "Selective startup" mode is perfectly acceptable - I do and don't have a problem. Warning: If you subsequently decide to choose "Normal startup", all disabled items will be re-enabled
Some disabled items may disappear from MSCONFIG when you re-start Windows
MSCONFIG is intended to be used to temporarily disable programs from running at system start-up. In some cases, disabled items may be added to a new category under Start -> Programs (Win9x/Me/NT/2K) or Start -> All Programs (WinXP) called "Disabled Startup Items". If the entry has disappeared from MSCONFIG and is available here they can be copied back into the appropriate OS StartUp directory:
Win9x/98/Me - C:\Windows\Start Menu\Programs\StartUp
WinNT/2K - C:\Winnt\Profiles\All Users\Start Menu\Programs\StartUp
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs\Startup
For WinME users - If you have disabled items in MSCONFIG and at a later date uninstall the program they are associated with, you can click on the "Cleanup" button to verify and remove all invalid entries from the startup sections of the reigistry
For Win9x/XP user - If you have disabled items in MSCONFIG and at a later date uninstall the program they are associated with, you can try a free application from Virtuoza called MSConfig Cleanup
If there is an option within a program to disable parts of it running at start-up (see here) and you don't use that method to disable them, you may find they are re-enabled in MSCONFIG the next time the program runs
4) Use a 3rd party utility to control start-up programs - Windows 95/98/Me/NT/2000/XP
There are a number of programs widely available as shareware or freeware that achieve the same purpose. Each can identify what programs are running at startup and allow you to control them to differing degrees. I cannot personally recommend an individual program as I don't use them and am happy enough with MSCONFIG (even though it is only intended to be a temporary solution while troubleshooting - see above).
Want to try a start-up manager? Try from the list given here.
5) The System Registry - Windows 95/98/Me/NT/2000/XP
Note: if you are running NT and don't have a startup manager you only have this choice remaining, which is a last resort.
You can both disable and permanently stop programs from running during start-up by editing the relevant entries from the System Registry using REGEDIT. This option isn't for the faint hearted and should only be used by those who are comfortable with editing the System Registry and understand what implications any changes may have. If you delete something from the System Registry accidentally, it may be corrupted to the extent that Windows may not re-start at all so beware.
For information about the Windows registry and editing it's contents try the Windows Guide Network registry pages.
To invoke the Registry Editor, click Start then Run. In the Open box, type regedit.exe followed by enter.
The keys you're interested in are as follows:-
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
For Windows 98 & Me, disabled items were placed in the registry keys named above with a "-" after it, ie:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run-
For Windows XP this is changed:-
For items that were in the Start -> Programs -> Startup folder:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
You'll find a subkey for each disabled item.
For items loaded from the Registry:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
Again, you'll find a subkey for each disabled item.
6) WIN.INI - Windows 95/98/Me
The WIN.INI file is located in C:\Windows (Win9x/Me/XP) or C:\Winnt (WinNT/2k) and can be seen if you have enabled "Show hidden files and folders" via My Computer -> Tools -> Folder Options then the "View" tab. This file is executed at Windows startup.
Some valid programs and a lot of virusses load at startup via this method under the [windows] section via "run=" or "load=" as follows:
[windows]
run=hpfsched
run=%Windows%\CapsideRed.pif
load=asistat.exe
Load = "C:\Windows\System32.exe"
In the first example, "hpfsched" is a valid entry to remind you to clean the cartridges in your HP DeskJet from time to time in
order to keep print quality high. It can be removed from the run line in win.ini file if you do not want that feature.
In the second example, "CapsideRed.pif" has been added by the CASPID virus and is obviously not desired (where %Windows% is C:\Windows or C:\Winnt).
In the third example, "asistat.exe" is a valid entry that is the status monitor for an NEC SuperScript printer. It can be removed from the load line in win.ini if you do not want that feature.
In the final example, "System32.exe" has been added by the MARI virus and is obviously not desired.
Note: From WinMe onwards MSCONFIG includes the "run=" and "load=" entries so this section is only included for completeness. Only valid "run=" entries are included in the programs list to save against repitition from the many virusses that use this method.
7) SYSTEM.INI - Windows 95/98/Me
The SYSTEM.INI file is located in C:\Windows (Win9x/Me/XP) or C:\Winnt (WinNT/2k) and can be seen if you have enabled "Show hidden files and folders" via My Computer -> Tools -> Folder Options then the "View" tab. This file is executed at Windows startup.
The only valid entry under the "shell=" line here is:
[boot]
shell=Explorer.exe
However, some virusses use this line to execute themselves at startup. For example:
[boot]
shell=Explorer.exe %Windows%\Capside.exe
This has been added by the CASPID virus and is obviously not desired (where %Windows% is C:\Windows or C:\Winnt).
No comments:
Post a Comment