Discovering and controlling load order of services

Discussion in 'other anti-malware software' started by SamSpade, Nov 24, 2007.

Thread Status:
Not open for further replies.
  1. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415
    Is there any way to find out the order of loading services (and/or processes) when one's XP computer boots up?? I'm asking because many firewalls now are running as services and the time the FW service loads will determine when the protection of the FW starts.

    Are there any ways to find out and even control the load order? Any ini file or something like that, something that may be amended??


    |||
     
  2. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    Have a look at the "layout.ini" file that resides within the Prefetch folder.

    It should open with notepad.

    C:\Windows\Prefetch
     
  3. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Have a look at Icesword the Kernal module will show you the load order of drivers.

    Changing this order, I cannot remember correctly. I know each service is placed into a group, then each group is started in order:- HKEY_LOCAL_MACHINE / SYSTEM / CurrentControlset / Control / serviceGroupOrder
     
  4. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415
    OK, I found it. It shows at the top: "Optimal LayoutFile". Then a long list of files.

    1) Is this the *actual* order of boot-up, or just a hoped-for order??

    2) My firewall (OA) program files seem to loading rather late, about 3/5 of the way down the list. I do not see any OA drivers listed earlier (but I haven't gone over with a fine tooth comb). Is this the actual load sequence?

    Can you decipher it?

    Sam


    |||
     
  5. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    No sorry I can't.

    All I know is that Perfectdisk, if set to control the layout.ini, defrags using the order of the layout.ini for optimal boot.
    PD Article
     
  6. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415

    I checked this registry item and yes, there is a list of services within the serviceGroupOrder entry.

    Now, the question: can I alter this list, these entries by moving one up or down, without messing up everything (causing lock-up, freeze, no boot, etc)??

    Do you or anybody know?


    |||
     
  7. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415

    Thanks. I may give this a try. ( Another application!! Ugh.) I'm trying to do this manually, if possible.


    |||
     
  8. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    I would not change the order within that key, unless you know what you are doing.
    Is the service you are checking/ wanting to change within a group?
    Use Autoruns and see what group the service is in (run Autoruns, go to the services tab, double left click the service, this will bring up the reg entries, have a look for a "Group" entry)

    Example:-

    service.gif



    Edit:-
    The firewall may already be protecting (as soon as it is possible).
    Which firewall are you looking at?
     
    Last edited: Nov 24, 2007
  9. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    976
  10. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415
    I'm trying to load Online Armor as soon as possible.

    On the key you originally mentioned,
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder (list)
    I have the following under the "list" entry:

    System Reserved
    Boot Bus Extender
    System Bus Extender
    SCSI miniport
    Port
    Primary Disk
    SCSI Class
    SCSI CDROM Class
    FSFilter Infrastructure
    FSFilter System
    FSFilter Bottom
    FSFilter Copy Protection
    FSFilter Security Enhancer
    FSFilter Open File
    FSFilter Physical Quota Management
    FSFilter Encryption
    FSFilter Compression
    FSFilter HSM
    FSFilter Cluster File System
    FSFilter System Recovery
    FSFilter Quota Management
    FSFilter Content Screener
    FSFilter Continuous Backup
    FSFilter Replication
    FSFilter Anti-Virus
    FSFilter Undelete
    FSFilter Activity Monitor
    FSFilter Top
    Filter
    Boot File System
    Base
    Pointer Port
    Keyboard Port
    Pointer Class
    Keyboard Class
    Video Init
    Video
    Video Save
    File System
    Event Log
    Streams Drivers
    NDIS Wrapper
    COM Infrastructure
    UIGroup
    LocalValidation
    PlugPlay
    PNP_TDI
    NDIS
    TDI
    NetBIOSGroup
    ShellSvcGroup
    SchedulerGroup
    SpoolerGroup
    AudioGroup
    SmartCardGroup
    NetworkProvider
    RemoteValidation
    NetDDEGroup
    Parallel arbitrator
    Extended Base
    PCI Configuration
    MS Transactions

    Can you decipher if any of these are related to OA?

    (Don't spend a lot of time on this. :) )

    SamSpade

    |||
     
  11. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415
    Thanks, Espresso (can you send me one right about now?? :) ).

    OK, I ran this little prog and it shows a list of drivers and services. I am assuming that this list is *the order* of loading/starting my drivers and services (??). Yes?

    (Where's that help file.... )

    Is there any way to CHANGE this load order without blowing up my computer??


    Sam

    |||
     
  12. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    976
    If the driver loads as Boot, then it's one of the first to load (Boot->System->Automatic). You might be able to safely load a System driver as boot with no ill effects but some of them might depend on other generic drivers like fltrmgr and won't work so it's usually best to leave them as they are.
     
  13. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    The OA service is showing as being in the NetBIOSGroup.
    edit:
    OA also has a driver (OAdriver.sys) loading, this is in the PNP_TDI group, so changing the service startup will probably cause problems.
     
    Last edited: Nov 24, 2007
  14. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415

    Sounds smart.


    |||
     
  15. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415

    I agree. Thanks for the interpretation.


    //
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.