Unsolved
This post is more than 5 years old
191 Posts
0
5304
November 25th, 2005 13:00
Running Processes
I'm working on computer using Windows 98SE and only has 64MB of memory. I would like to know exactly what processes are loaded to memory at startup. Which of these 3 places would I look to see this.
(1) hit Ctrl-Alt-Delete
(2) go to system information and look at Running Tasks
(3) go to system information and look at Starup Programs
All 3 of these show different information and I'm not sure exactly what is occupying memory.
Thanks Doogie
No Events found!
Majestic
2 Intern
•
9.4K Posts
0
November 25th, 2005 14:00
jimmymac_4
155 Posts
0
November 26th, 2005 02:00
There are many locations from which a program can be launced at startup as well as after startup, but I'm thinkin' that this level of detail is somewhat more than you expected or required...
________________
FOLDER LOCATIONS
________________
Win9x/98/Me - C:\Windows\Start Menu\Programs\StartUp
WinNT/2K - C:\Profiles\User\Start Menu\Programs\StartUp
WinNT/2K - C:\Profiles\All Users\Start Menu\Programs\StartUp
WinXP - C:\Documents and Settings\User\Start Menu\Programs\Startup
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs\Startup
windir\system\iosubsys
windir\system\vmm32
windir\Tasks
________________________
FILE AUTOSTART LOCATIONS
________________________
c:\explorer.exe
c:\autoexec.bat
c:\config.sys
windir\wininit.ini
windir\winstart.bat
windir\win.ini - [windows] "load"
windir\win.ini - [windows] "run"
windir\system.ini - [boot] "shell"
windir\system.ini - [boot] "scrnsave.exe"
windir\dosstart.bat
windir\system\autoexec.nt
windir\system\config.nt
__________________
REGISTRY LOCATIONS
__________________
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnceEx
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_CLASSES_ROOT\vbsfile\shell\open\command
HKEY_CLASSES_ROOT\vbefile\shell\open\command
HKEY_CLASSES_ROOT\jsfile\shell\open\command
HKEY_CLASSES_ROOT\jsefile\shell\open\command
HKEY_CLASSES_ROOT\wshfile\shell\open\command
HKEY_CLASSES_ROOT\wsffile\shell\open\command
HKEY_CLASSES_ROOT\exefile\shell\open\command
HKEY_CLASSES_ROOT\comfile\shell\open\command
HKEY_CLASSES_ROOT\batfile\shell\open\command
HKEY_CLASSES_ROOT\scrfile\shell\open\command
HKEY_CLASSES_ROOT\piffile\shell\open\command
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Microsoft\InbternetExplorer\UrlSearchHooks
HKEY_CURRENT_USER\Policies\Microsoft\Windows\Sytem\Sripts\Logon
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_LOCAL_MACHINE\Policies\Microsoft\Windows\Sytem\Sripts\Logon
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellShell Extensions\Approved
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKEY_LOCAL_MACHINE\System\Control\WOW\cmdline
HKEY_LOCAL_MACHINE\System\Control\WOW\wowcmdline
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog\Catalog_Entries
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
I may have missed something, but you get the general idea. Applications and services can be launched from many different places in many different ways both before and after startup. To keep on top of what starts at bootup and what processes are actively running, here are a few freeware tools that you should find useful.
Startup Control Panel - mlin.net/StartupCPL.shtml
Startup Manager - f2.org/archive/software/startupmgr.html
Autoruns - www.sysinternals.com
Process Explorer - www.sysinternals.com
Jim McNamara
Message Edited by jimmymac_4 on 11-25-2005 10:25 PM