|
|
|
Win98 |
WinME |
WinXP |
All discussion is Paul speaking in the first person. |
The intention of these pages is to provide a central resource for PC users and Tech Support staff alike who are concerned about the poor performance of their PCs due to the number of programs that run at system start-up. The following information is provided:
Background to the problem
Techniques that can be used to identify and disable start-up programs from running
A comprehensive list of programs that are loaded at start-up
A request for additional programs or updated information
DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.
Paul Collins
(aka Pacman)
Pacman's Portal
------------------
Virtually all applications you install using the default installation these days decide that they should start-up when Windows starts. If you allow these to take control, you can end up with a situation where (unless you have sufficient memory installed) every other program slows down to be unusable.
The reason for this is that all of these programs use a portion of the system memory and resources which leaves a smaller percentage for other programs once they're opened. On my old system for example, prior to tweaking I had 33 programs running at start-up with the system resources at 59% and Windows took an age before it was ready for use. Post tweaking I had a mere 10, with system resources back to 92% and Windows was up and running within a minute.
Win9x/Me/2K/XP users:
Use the "System Configuration
Utility" (MSCONFIG) to identify startup programs. MSCONFIG is available for all
Win9x/Me/2K/XP users (Win95/2K user can use the respective versions from
here).
You invoke it by clicking Start then Run. In the Open box, type msconfig.exe followed by enter. Once displayed, click on the "Startup" tab. You will see a list of items and the 2 columns that we're interested in are "Name" (WinME) or "Startup Item" (WinXP) and "Command". For Win98 the columns aren't named but the one on the left is the equivalent of "Name" and the one on the right is the equivalent of "Command":
|
|
|
Win98 |
WinME |
WinXP |
WinNT users:
Use a free utility from SysInternals called
AutoRuns which displays all the startup locations. Highlight an item and
click on "Jump to" and it will take you to the appropriate startup
location, including the registry keys where appropriate:
If the registry editor is opened (REGEDIT), you will see a list of items and the 2 columns I'm interested in are "Name" and "Data":
Alternatively, you can use a startup manager.
Notes:
(1) The "Close Program" window in Win9x/Me and "Task Manager" window in WinNT/2K/XP (both can be accessed via the CTRL+ALT+DEL key combination) displays some startup programs AND other background tasks and "Services". This site is concerned with startup programs ONLY (from the common startup locations). For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork.
(2) I won't be including "Services" from the WinNT/2K/XP operating systems. I fully understand that some programs with these OS's use "Services" as an alternative to load their component parts at startup but I don't have the time available to include these as well. For Win2K services information see TechSpot's article here or Black Viper's article here. For WinXP services see TechSpot's article here or Black Viper's article here
A number of methods can be prevent programs from running at startup. What these are how you use them is described here.
My recommendations are that you try each of the methods listed below in that order. Each method has an indication of which Windows operating system it is applicable to.
The best option is to check if a program gives you an option to disable the function you're interested in - via a right-click on a System Tray icon or maybe an "options" menu within the program. If this isn't available then you have to try something else.
For example, Norton SystemWorks has an "Options" tab on the main start-up screen that allows you to configure the utilities in the suite - Norton Utilities, Norton AntiVirus and Norton Cleansweep.
If you click on Start -> Programs -> StartUp (Win9x/Me/NT/2K) or Start -> All Programs -> StartUp (WinXP) you may find programs loading from here via shortcuts. If this is the case, you have two options :-
Delete the shortcut from the StartUp directory (based on your OS):
Win9x/98/Me - C:\Windows\Start Menu\Programs\StartUp
WinNT/2K - C:\Winnt\Profiles\All Users\Start Menu\Programs\StartUp
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Create a temporary directory for your OS called "Disabled StartUp Programs" and move the shortcuts there. If a program doesn't work as expected you can always move the relevant shortcut back again
Win9x/98/Me - C:\Windows\Start Menu\Programs
WinNT/2K - C:\Winnt\Profiles\All Users\Start Menu\Programs
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs
Work your way through the list of programs included here and deselect the appropriate boxes in your version then click OK followed by re-starting Windows.
WinME and WinXP display items for the same program in different ways in MSCONFIG. WinME uses the same descriptive text under the MSCONFIG "Name" and registry Run keys "Name" columns. WinXP often uses the first part of the filename under the "Startup Item" column and the equivalent descriptive part in the "Name" column of the registry "Run" keys. For instance, on my WinXP Home machine I have ZoneAlarm and see:
Virus entries in the program list are only shown using the registry version in this case to prevent unnecessary duplication due the number of them.
Notes:
When you have deselected an item in MSCONFIG, you will be starting in "Selective startup" mode. This can be seen under the "General" tab. Working in "Selective startup" mode is perfectly acceptable - I do and don't have a problem. Warning: If you subsequently decide to choose "Normal startup", all disabled items will be re-enabled
Some disabled items may disappear from MSCONFIG when you re-start Windows
MSCONFIG is intended to be used to temporarily disable programs from running at system start-up. In some cases, disabled items may be added to a new category under Start -> Programs (Win9x/Me/NT/2K) or Start -> All Programs (WinXP) called "Disabled Startup Items". If the entry has disappeared from MSCONFIG and is available here they can be copied back into the appropriate OS StartUp directory:
Win9x/98/Me - C:\Windows\Start Menu\Programs\StartUp
WinNT/2K - C:\Winnt\Profiles\All Users\Start Menu\Programs\StartUp
WinXP - C:\Documents and Settings\All Users\Start Menu\Programs\Startup
There are a number of programs widely available as shareware or freeware that achieve the same purpose. Each can identify what programs are running at startup and allow you to control them to differing degrees. I cannot personally recommend an individual program as I don't use them and am happy enough with MSCONFIG (even though it is only intended to be a temporary solution while troubleshooting - see above).
Want to try a start-up manager? Try from the list given here.
Note: if you are running NT and don't have a startup manager you only have this choice remaining, which is a last resort.
You can both disable and permanently stop programs from running during start-up by editing the relevant entries from the System Registry using REGEDIT. This option isn't for the faint hearted and should only be used by those who are comfortable with editing the System Registry and understand what implications any changes may have. If you delete something from the System Registry accidentally, it may be corrupted to the extent that Windows may not re-start at all so beware.
For information about the Windows registry and editing its contents try the Windows Guide Network registry pages.
To invoke the Registry Editor, click Start then Run.
In the Open box, type regedit.exe followed by enter.
The keys you're interested in are as follows:-
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
For Windows 98 & Me, disabled items were placed in the registry keys named above with a "-" after it, ie:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run-
For Windows XP this is changed:-
For items that were in the Start -> Programs -> Startup folder:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
You'll find a subkey for each disabled item.
For items loaded from the Registry:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
Again, you'll find a subkey for each disabled item.
The WIN.INI file is located in C:\Windows (Win9x/Me/XP) or C:\Winnt (WinNT/2k) and can be seen if you have enabled "Show hidden files and folders" via My Computer -> Tools -> Folder Options then the "View" tab. This file is executed at Windows startup.
Some valid programs and a lot of viruses load at startup via this method under the [windows] section via "run=" or "load=" as follows:
[windows]
run=hpfsched
run=%Windows%\CapsideRed.pif
load=asistat.exe
Load = "C:\Windows\System32.exe"
In the first example, "hpfsched" is a valid entry to remind you to clean the cartridges in your HP DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini file if you do not want that feature.
In the second example, "CapsideRed.pif" has been added by the CASPID virus and is obviously not desired (where %Windows% is C:\Windows or C:\Winnt).
In the third example, "asistat.exe" is a valid entry that is the status monitor for an NEC SuperScript printer. It can be removed from the load line in win.ini if you do not want that feature.
In the final example, "System32.exe" has been added by the MARI virus and is obviously not desired.
Note: From WinMe onwards MSCONFIG includes the "run=" and "load=" entries so this section is only included for completeness. Only valid "run=" entries are included in the programs list to save against repetition from the many viruses that use this method.
The SYSTEM.INI file is located in C:\Windows (Win9x/Me/XP) or C:\Winnt (WinNT/2k) and can be seen if you have enabled "Show hidden files and folders" via My Computer -> Tools -> Folder Options then the "View" tab. This file is executed at Windows startup.
The only valid entry under the "shell=" line here is:
[boot]
shell=Explorer.exe
However, some viruses use this line to execute themselves at startup. For example:
[boot]
shell=Explorer.exe %Windows%\Capside.exe
This has been added by the CASPID virus and is obviously not desired (where %Windows% is C:\Windows or C:\Winnt).
Go to Paul Collins'
Introduction page with downloadable Startup Programs List files
(opens in a new browser window)
PLEASE READ THIS before submitting new programs to be added to the list. Submissions can be made via E-mail or the Message Board:
The following information would be useful:
Program name: This is the descriptive part of the program entry, such as "NAV Agent" in this example and NOT the "<filename>.exe" or similar part as below. Some entries may be blank - if so just let me know
File name: This is the actual file loaded by at start-up by the descriptive part above, such as NAVAPW32.EXE in this example. If possible include the location of the file as well. Some entries may be blank - if so just let me know
Description: If you know what the program does then please include a simple description, referring to a host web-site if known. You can also use Start -> Search (or Find) to locate the executeable on your PC and
Note the folder it's in
See if there's a "readme" file or similar
Right-click on the executable and check the "properties" for its name and who wrote it
Is it needed: There are 4 options available
If the program must run at start up for correct operation the answer is Yes
If it's optional and could be useful the answer is User's Choice
If it's not needed at all or can be accessed via Start -> Programs or a Desktop Shortcut the answer is No
If it's known to be a wasteful "resource hog", spyware or a virus the answer is Ditch It
Is there a shortcut available: See if the program is available via Start -> Programs and/or a Desktop shortcut
-----------------------------
MIRROR SITES:
Thanks to Michael Preslar for providing the following mirror:
http://www.michaelpreslar.com/sysinfo/startupinfo.html
Thanks to Paul Laudanski at Castlecops for providing the following mirror:
http://castlecops.com/StartupList.html
Other mirrors:
http://www.rockymountain.com/ref_startup.htm - Rocky Mountain Software
http://www.tsfclan.be/startups_all.htm - The Subspace Fighters
http://members.shaw.ca/austin.powers/ - by Bert
An alternative way of displaying the information in my full startup list:
http://www.lafn.org/webconnect/mentor/startup/index.html - by John Mayer
Spanish translation by Miguel Conde:
http://mundopc.net/actual/cibererrante/2002/08/080802.php
French translation by Pierre Pinard/NickW at Assiste.com:
http://assiste.free.fr/p/pacman/startup_list.php
OTHER LINKS:
Startups:
http://support.microsoft.com/support/kb/articles/q177/2/85.asp - By Microsoft.
Knowledge Base article explains the purpose behind MSCONFIG and why you may see double entries
http://www2.whidbey.com/djdenham/index.htm - By DJDenham
Another list of applications good explanation of the background to this page
http://greatis.com/regrun3appdatabase.htm - Greatis Startup Application Database
List of startup applications organised by their executable filenames
The following startup managers and other utilities use the information from this site:
Absolute Startup from F-Group Software
Ace Utilities from Hari Krishnan
jv16 PowerTools from Jouni Vuorio
Perfect Process by VelociWare
RegRun 3 Security Suite from Greatis
Spybot - Search & Destroy from Patrick Kolla - select the "Advanced" mode
Windows Startup Inspector by William Yang
SpyFlush by Ricardo Ramirez
The following startup managers contain information that is also on this site:
SpeedUpMyPC from LIUtilities
In addition to controlling startup programs, SpeedUpMyPC can also optimize RAM and CPU usage, recover from crashes and increase internet connection speed
Other startup managers recommend by visitors to the site:
AutoRuns - from SysInternals
Autostart Viewer - from DiamondCS
InControl - from Virtuoza
Startup Control Panel - by Mike Lin
Startup Genie - from AMIC Utilities
A futher list of startup managers can be found here
Spyware:
Counterexploitation - "Actively protect your rights. Do not let the Man keep you down. Do what is good and right, not what some authority figure tells you is good and right. Challenge the belief systems of yourself and your society. Stay informed and keep others informed. Use logic and reason for positive social change. And above all, don't take crap from anybody!"
Good site for learning more about spyware, other silent install apps and "craputers". Slightly controversial in places but useful resource.
"Not sure if the free software you are about to download is in fact so called Spyware or Adware or otherwise advertising enhanced product that installed additional third party components on your system?"
"This site is dedicated to giving you the tools and knowledge you need to protect your privacy from the onslaught of spyware, adware, and corporate and government surveillance. Particular attention is paid to detecting and defeating spyware"
Sandra Hardmeier is one Microsoft's Most Valued Professionals (MVP) and this page on her site is dedicated to spware/adware/malware, hijackers and other annoyances
"PestPatrol is [a] product that provides protection against the full range of non-viral malware - trojan horses, denial-of-service zombies, hacker tools, spyware, and adware"
Free multi-spyware removal tool from Lavasoft
Free multi-spyware removal tool from Patrick Kolla
Aluria Software's multi-spyware removal tool - "detects and removes all known Spyware, Adware and Keyloggers. All New V3.0 now also prevents future attacks!"
Andrew Clover's web-site dealing with all sorts of spyware/adware/foistware and other unsolicited commerical software - commonly branded as "parasites". Includes free script that can check your browser for such parasites
WinPatrol from BillP Studios
"WinPatrol with Scotty the Windows Watch Dog will sniff out Worms, Adware, Spyware, Cookies, Trojan horses and other virus type, malicious, nasty programs that may attack your computer. WinPatrol puts you back in control of your computer with no need for constant updates"
SpyFlush by Ricardo Ramirez
"Spyflush is a free application that detects and removes spyware from your PC. It is a combination of startup manager and spyware remover. The startup manager capabilities will give the power of controlling applications that run at startup time"
Services:
For hardware and software tweaking, reviews and news. Includes their guides to Win2K and WinXP services
Features OS install guides and tricks. Includes guides to Win2K and WinXP services
Tasks/Processes:
An online helpdesk with answers to questions on hardware, software, configuration and others. Includes a companion list of background programs (or tasks) as listed by name when you press CTRL+ALT+DEL to display the "Close Program" or "Task Manager" windows
Another list of common tasks/processes as included in WinTasks 5 Standard/Professional from LIUtilities which provide for "efficient resource and task management"
Lists all running processes and uses information from the Startup List in the "AutoRun" section. In a planned release it will link directly to information on the site
Copyright © Paul Collins, 2001 -
2004
All rights reserved
updated 03 October 2004 1700 PDT
