Startups - File-system plugin for Total Commander

# Startups

Startups is a file-system plugin that can list, disable, analyze, edit and delete system startups that are located in the Registry or Start Menu.

## Contents

1. Features
   1. General
   2. Advanced features
   3. Disadvantages
2. System Requirements
3. The user interface
   1. Extensions in TC panel
   2. Startup status check
   3. Copy or move startups
4. Plugin settings
   1. Location of plugin settings file
   2. The settings in detail
5. Internal and external tools
   1. How to configure external tools
   2. The keys in detail
   3. An important note on 64 bit systems
   4. A special note on Windows XP x64 Edition
6. Known Issues and limitations
   1. Known issues
   2. Limitations
7. Frequently Asked Questions
8. License
9. Thanks to
10. Contact

## 1. Features

### 1.1. General

- List system startups that are located in the Registry (HKCU, HKLM in Run and RunOnce, respectively) and Start Menu folders (All Users and current user)
- Disable startups so they don't start automatically, but can easily be re-enabled
- Run startups manually on request
- Delete startups

Startups is - in some aspects - similar to the old StartupGuard plugin written by Sergey Puljajev. It uses the same approach to disable startups and has some advantages over StartupGuard, but doesn't have all of the features as those of lesser importance were left out.

### 1.2. Advanced features

- Manage startups in 32 and 64 bit Registry branches on 64 bit Windows
- Show correct executable information in the file list of Total Commander (32 bit) on Windows 64 bit, i.e. file date/time and sizes
- Show information about the executable like file size, company name, file version, description and so on
- Edit startups, e.g. command line parameters, name etc.
- Ability to show startups with the same name in different locations as each startup will have a unique name.
- Copy or move startups to a different location, even across Registry and Start Menu (with some limitations)
- Unicode capable
- 64 Bit version to use in Total Commander x64
- Translation to other languages possible
- Support for custom columns (default view available)
- View and edit properties specific to Start Menu shortcuts like comments and window state
- Check if a startup is currently running, with matching process names and matching command lines
- Jump to the startup's executable with Enter and/or Shift+Enter

### 1.3. Disadvantages

- Startups in the following Registry locations are not included: RunOnceEx, RunServices and RunServicesOnce.
  I don't know whether to support RunOnceEx at all. The last two don't apply to NT based systems.

## 2. System Requirements

- Windows 2000 or later, both 32 and 64 bit
- Total Commander 7.50 or later, both 32 and 64 bit

## 3. The user interface

### 3.1. Extensions in TC panel

Since the plugin supports startups with the same name in different locations, all names must have unique file names. Hence all file extensions are built from the startup location they represent, in abbreviated form. The following table shows the extensions and their meaning.

Extension | Meaning / Startup location
--- | ---
SA | Start Menu: All Users, i.e. %AllUsersProfile%\Start Menu\Startup directory
SU | Start Menu: Current User, i.e. %UserProfile%\Start Menu\Startup directory
M32R | Registry: All Users, Run (32 bit), i.e. HKLM\Software\Microsoft\Windows\CurrentVersion\Run (32 bit Windows) or HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run (64 bit Windows).
M64R | Registry: All Users, Run (64 bit), i.e. HKLM\Software\Microsoft\Windows\CurrentVersion\Run (64 bit Windows only).
M32RO | Registry: All Users, RunOnce (32 bit), i.e. HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce (32 bit Windows) or HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce (64 bit Windows).
M64RO | Registry: All Users, Run (64 bit), i.e. HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce (64 bit Windows only).
UR | Registry: Current User, Run, i.e. HKCU\Software\Microsoft\Windows\CurrentVersion\Run
URO | Registry: Current User, RunOnce, i.e. HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

### 3.2. Startup status check

The check is available in the "Status" tab of the startup properties dialog. In simple terms it allows to determine whether a startup is currently running, although this is not quite correct. This feature looks for active processes that match the startup's executable name. Furthermore, it uses WMI (Windows Management Instrumentation) to check whether these processes match the startup's command line. When a command line matches, there is a very high probability that it is the startup itself that's currently running. All matching command lines are highlighted in bold.

The check for matching command lines only works if the user running the plugin has sufficient rights to open processes that match the startup's executable name. Users without administrative privileges can only open their own processes, so the plugin will not be able to analyze processes running in a different user context. When executing the plugin in a TC running as administrator the plugin can check all processes.

Note that the check for matching command lines is not available on Windows 2000, but only on XP and higher!

### 3.3. Copy or move startups

The feature is available from the "Location" combobox of the startup properties dialog.

Move a startup to a different location:

1. Select another location
2. Click Apply or OK

and the startup will be moved to the new location.

Copy a startup:

1. Select another location
2. Check the "Copy startup to new location" checkbox next to the combobox
3. Click Apply or OK

and the startup will be copied to the new location.

No feature without some limitations ;).

- Properties specific to start menu startups like comments and window state can not be copied when the new location is somewhere in the registry.
- Start menu startups that use real files (like .txt, .pdf, .exe etc) instead of shortcuts can only be copied/moved within the start menu locations.

## 4. Plugin settings

You can change most of the options in the plugin's settings dialog (Alt+Enter on the "Startups" entry in TC's Network Neighborhood).

### 4.1. Location of plugin settings file

If you want to change any plugin settings manually you can use either

a) Startups.ini in the plugin's directory, or

b) fsplugin.ini in the directory where wincmd.ini is located (default).

Option a) is good for portable mode, option b) is useful on systems where Total Commander is installed in a directory where users can't write to (like %ProgramFiles%).

Important: If Startups.ini exists in the plugin's directory it is preferred over fsplugin.ini!

The full path of the INI file currently in use is shown in the settings dialog. Furthermore there is a button that allows the user to open the plugin settings file in the editor defined in TC, so it can be edited directly without the need to navigate to it by hand.

### 4.2. The settings in detail

The settings are explained in the Startups.sample.ini file, but they're listed here for the sake of completeness.

Section [Startups]

Setting and default | Description
--- | ---

ActionEnter = 0
ActionShiftEnter = 3

Define what will happen when ENTER (ActionEnter) or SHIFT+ENTER (ActionShiftEnter) is pressed on a startup:
0 - Toggle the state of startups, i.e. enable or disable them
1 - Show startup properties, the same as calling the properties with Alt+Enter
2 - Run the startup
3 - Go to the startup's executable location in current or new tab, depending on ActionEnterNewTab/ActionShiftEnterNewTab settings.

ActionEnterNewTab = 1 ActionShiftEnterNewTab = 1 | 1 - Open a new tab on ENTER or SHIFT+ENTER 0 - Don't open a new tab, i.e. jump to the startup's executable in current tab
AllowDeleteInPanel = 1 | 1 - Allow deletion of startups in TC's file panel 0 - Disable deletion of startups in TC's file panel. Note that TC will ask for confirmation if F8/DEL is pressed in the file list, but the plugin will not actually delete the startup. Startups can still be deleted via the startup properties dialog.

LoadCustomColumns = 0

1 - Automatically load custom columns view when entering the plugin. Note that this setting only affects the default custom columns view which this plugin provides! More specifically the setting controls whether the plugin reports a custom columns default view to TC or not.
0 - Don't report a default view to TC. See FAQ section on how to completely disable custom columns view

AddTxtExtensionOnDownload = 0 | 1 - Append an additional '.txt' extension when a startup "file" is downloaded. This is a way to control whether the startup "files" are loaded into TC's Lister plugins (if any are installed). 0 - Don't append '.txt' extension.
AutoRefreshStatus = 0 | 1 - Automatically refresh the startup status when switching to "Status" tab in the startup properties dialog. Since the status determination uses WMI it may take a few seconds to complete. 0 - Don't refresh status automatically.
VistaStyleFileDialogs = 1 | 1 - Use Vista style open/save dialogs. They have a breadcrumb bar, but an (IMO) ugly directory tree. 0 - Use open dialogs from XP and earlier Windows versions with the places bar on the left.
ShowDisabledIcon = 1 | 1 - Show a stop icon instead of the executable's icon when a startup is disabled 0 - Show startup's executable icon even when a startup is disabled
ShowDisabledExtension = 1 | 1 - Show an additional extension ".Disabled" when a startup is disabled 0 - Don't change the file name of disabled startups
Monitor = 0 | 0 - Show all plugin dialogs/windows on the active monitor, i.e. the monitor TC is on. 1..4 - Show all dialogs on the primary, secondary, tertiary or quaternary monitor, respectively. Note: If you specify an invalid monitor, the value will be reset to 0, i.e. the active monitor will be used instead.
Language = English.lng | Specifies the language file to use by the plugin. Note: Strings missing in the specified language file are replaced with default English ones!

Section [Startups.Tools]

Setting and default | Description
--- | ---
ShowIcons = 1 | 1 - Show icons in the list of tools. This might slow down the list's opening operation because the plugin extracts the icon of every internal and external tool. Disable this setting if that's the case. 0 - Don't show icons in the list of tools.

AutoDetectArch = 1

1 - Automatically determine the architecture of all external tools. This adds some comfort to external tools management without having to check whether an executable is x86 or x64. However, it requires the plugin to open every external tool's executable file which can cause slowdowns by anti-virus software and the like.
0 - Disable automatic architecture detection. If this feature is disabled, the architecture of every external tools must be set in Startups.Tools section using the x64 key (see section The keys in detail)

## 5. Internal and External Tools

With this feature you can

- view the shortcut properties of Start Menu startups (if it uses a shortcut)
- jump to the registry key of Registry startups in RegEdit
- view the startup executable's properties
- view the startup executable in TC's Lister, including its plugins like FileInfo or PEViewer
- open the startup executable in any external tool like anti-virus scanner, the VirusTotal Uploader, a web browser, a hex editor, a debugger and so on

This greatly simplifies the analysis of (unknown) startups and their executables, especially such from vendors that are unable or unwilling to give their startups meaningful names and/or descriptions.

The first four items mentioned above are internal tools and are always available, provided that the startup executable is found, of course.
The "Jump to registry key in RegEdit" feature makes use of an external tool (JumpRegEdit.exe), which is part of the distribution package. You can delete that file if you don't need the feature. You can even replace it with your own tool (must have the same name) that takes two parameters: registry key and value name.

### 5.1. How to configure external tools

Create a new section named [Startups.Tools] in the plugin's INI file. See section Plugin settings above on how to find the correct INI file.

There can be several keys in this section:

n_Name
n_File
n_Params
n_x64
n_WWW
n_Shortcut

where n is a number from 1 to 15 (currently).

The values of some keys can contain the following placeholders:

Placeholder | is replaced with | Valid in key(s)
--- | --- | ---
{FileName} | the fully-qualified path of the startup executable | Params only
{FileNameOnly} | the file name only, i.e. path removed | Params and WWW
{StartupName} | the startup name | WWW only

Please note that case matters here, so {filename} is NOT replaced!

Quotes are automatically added to the File key value only, so they must be set explicitly in all other key values if they contain spaces!

### 5.2. The keys in detail

Name | A string which will be shown in the list of external tools. If it's empty the value of File is used instead (path removed, i.e. file name only). You can use an ampersand here to manually define a character that will be used as keyboard hotkey, e.g. "&Firefox" will create an item that can be called by pressing "f" when the list of tools is opened.
File | The path to the external tool. It can contain either a fully-qualified path or a simple file name that is located somewhere in the %PATH%. It can also contain environment variables like %ProgramFiles% or %SystemRoot% and so on.
Params | A string that contains any command-line parameters for File. The value can contain environment variables as well.
x64 | A Bool (either 0 or 1) that defines the architecture of File. 0 defines that File is a 32 bit executable 1 defines that File is a 64 bit executable Please note that this key is not required as long as AutoDetectArch is enabled in [Startups.Tools] section.
WWW | A string that can contain a web address that will be opened in the system's default web browser. Characters forbidden in URLs will be replaced by %hexvalue! This applies to the placeholders only, not the whole WWW string, of course.

Shortcut

A string that can contain any shortcut which is assigned to this external tool. Shortcuts allow quick access to internal and external tools using the keyboard. They are useful if you don't want to use the button to open the list of tools, too.
Important: Currently the shortcuts don't support special keys like Enter, Numpad keys and so on. In other words, they are limited to:

- F1 to F12
- A to Z
- 0 to 9
- Alt, Shift, Ctrl

The syntax is the same as in TC itself, for example "CA+F5" means Ctrl+Alt+F5. See section "Settings in the file wincmd.ini" of TC's help. The shortcut F3 is pre-defined and assigned to the function "View executable in Lister".

If File is not found at runtime the item of this external tool will be disabled. The minimal set of keys required for a working external tool consists of Name and WWW or File and Params.

See Startups.sample.ini, section [Startups.Tools], for some examples.

### 5.3. An important note on 64 bit systems

You may have wondered why there is an x64 key and the AutoDetectArch setting which the plugin uses to determine the architecture of external tools.

All 32 bit applications are subject to file-system redirection because of WOW64. There are numerous articles on the internet about this topic, see for example Wikipedia for an outline. When a 32 bit application accesses %SystemRoot%\system32 it is redirected to %SystemRoot%\SysWOW64 by the system.

Many startup executables are located in the %SystemRoot%\system32 directory and the startup points to this path in such cases. Now, with that in mind, what would happen if a 32 bit external tool is launched with "%SystemRoot%\system32\somefile.exe" as parameter? It would load the "wrong" file, i.e. %SystemRoot%\SysWOW64\somefile.exe. There are even cases where there's no file with the same name in %SystemRoot%\SysWOW64 but only %SystemRoot%\system32, so 32 bit external tools would not be able to load the startup executable at all.

Therefore Startups replaces "%SystemRoot%\system32" with "%SystemRoot%\SysNative" in the paths of all startup executables if the external tool's executable is a 32 bit binary, and the startup is not located in Wow6432Node registry key. Furthermore, Startups replaces "%SystemRoot%\system32" with "%SystemRoot%\SysWOW64" in the paths of all startup executables if the startup is located in Wow6432Node registry key and the external tool's executable is a 64 bit binary.

With this approach all internal and external tools always load the correct file, regardless of the architecture of TC, this plugin, the external tool or the startup itself.

### 5.4. A special note on Windows XP x64 Edition

By default, there is no %SystemRoot%\SysNative pseudo-directory available for 32 bit applications on this OS. That may result in non-working internal and external tools. You have two options here:

- Get a patch from Microsoft
  Unfortunately this patch is NOT publicly available. There may be other sources for this hotfix, but you don't want to install patches from an unknown source, do you?
- Create an NTFS junction from %SystemRoot%\system32 to %SystemRoot%\SysNative. You can do this with tools like Sysinternals Junction or NTFS Links

Sysinternals Junction:

1. Launch a 64 bit command prompt (CMD) and navigate to the folder where junction.exe is located
2. type "junction %SystemRoot%\SysNative %SystemRoot%\System32" (without the quotes) and hit Enter
3. the tool should say something like

   Created: C:\WINDOWS\SysNative
   Targetted at: C:\WINDOWS\system32

NTFS Links:

1. Install the tool according to its help file, e.g. on a button or start menu in TC
2. Navigate to %SystemRoot% in both of TC's panels
3. Set the cursor on system32 directory (doesn't matter if left or right panel)
4. Call the tool from the button/start menu create in first step
5. Important: Replace the "*.*" at the end of the target path with "SysNative" so that the path points to "C:\Windows\SysNative"
6. Confirm the creation of the junction

## 6. Known issues and limitations

### 6.1. Known Issues

- The feature "Configure" of TC Plugins Manager does not work with this plugin. This is a limitation of TC Plugins Manager. It calls only the ANSI functions exported by the plugins. Since Startups is a Unicode only plugin (regarding the relevant functions) it does not work.
- The shortcuts assigned to external tools items are not translated. Currently I don't think I will translate them as it is quite some work for relatively small benefit.
- When trying to save a Start Menu startup containing a command line without a path specification that points to an executable that doesn't exist anywhere in the directories specified by %PATH% variable, you may get an error message "[EOleSysError: Invalid argument (0x80070057)]".
  Example: "calc.exe" will work while "foo.exe" will not unless "foo.exe" exists somewhere in the %PATH%.
  The issue lies somewhere in Windows' IShellLink interface, but the exact cause is still unknown. Hence, it can't be fixed (yet).
  However, you can work around it by specifying an existing file and/or putting a path in front of the file name.

### 6.2. Limitations

- On Windows 2000 the status check in the startup properties dialog is limited to the check for matching process names; the check for matching command lines is not performed because it's not available (via WMI).
- There are tables in the startup properties dialog that can be sorted. The display of the sort order - the little sort arrow in the column headers - is not available on Windows 2000, but only on XP and higher.

## 7. Frequently Asked Questions

Why does the plugin load the custom columns view although the option "Load Custom Columns View upon entering the plugin" is disabled?

The option controls whether the plugin reports a default custom columns view to TC or not. In case the default custom columns view is changed by the user, TC switches to this custom columns view automatically when the plugin is entered, regardless of the plugin's setting, because the option "Switch to this view when entering the plugin" in TC's custom columns view is enabled by default. So, to really disable the loading of custom columns view the option "Switch to this view when entering the plugin" in TC's custom columns view must be disabled as well.

Why does the properties dialog and TC Lister show "C:\Windows\SysNative" as location although the startup properties show "C:\Windows\system32"?

Take a look at An important note on 64 bit systems section above for a detailed explanation.

I get an error message "[EOleSysError: Invalid argument (0x80070057)]" when trying to save/copy a startup. Why? How to fix it?

Take a look at Known Issues section above.

## 8. License

The plugin's icon "Fatcow-Farm-Fresh-Application-form", part of the "Farm-Fresh Web Icons" package:
(C) Fatcow Web Hosting, licensed under CC Attribution 3.0

All other icons (except the Delphi main icon) were made by my brother.

This software is provided "as is". No warranty provided. You use this program at your own risk. The author will not be responsible for data loss, damages, etc. while using or misusing this software.

The software must not be modified, you may not decompile or disassemble it.

This plugin is copyrighted freeware.

## 9. Thanks to

- Christian Ghisler, the author of Total Commander, for developing this great program that I use every day
- Sergey Puljajev for making the StartupGuard plugin. It would have been much more work to make my own plugin without it.
- The members of the Delphi-PRAXiS forum that helped me understand and fix some things

## 10. Contact

If you have found a bug, have a suggestion, improvement, criticism, translation, you can contact me, Dalai, in English or German, at:
Mail: dalai82@gmx.net

Please put "Startups" somewhere in the subject.

There is a discussion thread in the official TC forum which can be used, too: http://ghisler.ch/board/viewtopic.php?t=42374