how do i retreave all startup .exe names in xp home ?

[vhelp]

[Startup]
Startup Item ..:.. Command ..:.. Location
[ ] ALCMTR ..:.. ALCMTR.EXE ..:...... software\microsoft\windows\currentversion\run
[x] SkyTel ..:... SkyTel.EXE ..:......... software\microsoft\windows\currentversion\run
[ ] msmsgs ..:.. c:\program files\..:.. software\microsoft\windows\currentversion\run
[ ] iTunesHe.:.. c:\program files\..:.. software\microsoft\windows\currentversion\run
.
.
.

(so, i'm gonna remove skytel.exe because i think it is a trojan, for instance)

Hi, i am looking to develop a simple utility to show me what items i have in my xp home startup, the one reported in msconfig.exe tool. i want to start keeping a manual lookout for mysterious items that find their way there and remove them safely if possible. but for now i just want to find out how to retrieve this info through source code.

i want to be able to retrieve *all* the startup items that windows reports in the msconfig tool under the startup tab.

now, i know about backing up the registry, and have done so already: regedit\export from the topmost branch, my computer.

note, i want to do this through programming (delphi) code, not some shareware.

thanks in advance for any leads.

[betwixt]

Try CCleaner. (www.piriform.com) You can export the list.

Click on "Tools" then "Startup". It will list all startup applications and their registry keys and you can enable or disable them as you wish. Don't forget they are started already so you have to reboot to see the changes.

The more complicated method is by using the administrator options and looking at the services but be careful if you don't understand the implications of doing that.

Brian.

[Ai Haibara]

There's also SysInternals' Autoruns: Autoruns for Windows, along with a number of other utilities (I used to use Spybot S&D's startup entry list, as well as HiJackThis and Mike Lin's Startup Control Panel; at the moment, I'm using Autoruns alongside SysInternals' Process Explorer.)

I don't know that any of the utilities out there will include source code for you to take a look at and reference when creating your own such utility, though.

[classfour]

Ditto on Ccleaner

[jagabo]

It's telling you where in the registry each of those is located. For example:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

All you have to do is open the registry and read the list.

[vhelp]

ok, after some googling, i managed to put together something, to retrieve most of the details i'm looking for from the registry.

but it seems the msconfig gives more info (twice more) from these locations in its window list:

registry ..\run\..
common startup
startup

i haven't been able to figure out exactly how to pull the info from common startup and startup. if they are registry locations, they are decieving at the moment. the info that msconfig must be pulling from somewhere else.

also, when i remove any apps within the msconfig tool, they disapear from the registry ..\run\.. location when i run my tool, though the msconfig tool seems to *keep* the complete list, active or not, so this is what i want my tool to mimic in case i want to re-enable the apps. later, i want to include a feature to *kill* the process if necessary.

[jagabo]

C:\Documents and Settings\USERNAME\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Disabled items are stored in the registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\MSConfig\startupfolder

Look there for other hints too. Programs can autostart from WIN.INI and SYSTEM.INI too. Possibly BOOT.INI. And Services.

[usually_quiet]

skytel.exe is not a trojan. It is part of Realtek Voice Manager. http://www.liutilities.com/products/wintaskspro/processlibrary/skytel/ Always look up the process or application before passing judgement.

[jagabo]

And really good malware takes over the boot block and loads before Windows starts. You can't easily find rootkits like that from within Windows.