Use Msconfig to log which drivers get loaded during system boot - gHacks Tech News

Use Msconfig to log which drivers get loaded during system boot

Nothing really beats the excellent Autoruns when it comes to analyzing the files that get loaded during a system's boot process. For some users, Autoruns with its 18 different tabs may look like overkill when it comes to that, and new users will certainly spend some time using the program before they really understand how they can utilize the program.

The system tool Msconfig on the other hand is different. First because it is very limited in comparison to Autoruns when it comes to functionality, and second because it is an internal tool that ships with Windows.

One of the things that Windows users can use Msconfig for is to log which drivers get loaded during system boot. The feature is disabled by default and needs to be activated first. Before I explain how this is done, I should probably first answer why someone would want to use Msconfig and not a program like Autoruns for that. There is not really a reason for using Msconfig if you also have access to Autoruns. If Autoruns is not on the PC yet and if you do not have an Internet connection to download it, or are not permitted to use third party software, then Msconfig may be the alternative that you may want to use.

Press Windows-r to bring up the run box in Windows, enter msconfig.exe and hit the return key to load the interface. Switch to the boot tab here and locate the boot log parameter here.

msconfig boot log

When you check the boot log box and hit apply or ok, you will receive a prompt that you can use to restart the PC right now or at a later time. No matter what you select, the boot process will be logged the next time the PC is started.

The protocol is saved in the ntbtlog.txt file in the Windows directory, which usually is located in c:\Windows\. Just open it in a text editor to see all drivers that get loaded.

system boot log

Most of the drivers are found in the System32\drivers folder, and it is often a good idea to look at drivers not located here when you start your analysis. The analysis may help you find faulty drivers, malicious drivers, and drivers used by devices or programs that you may not be using anymore.

I'd suggest you save the data into a different location for safe keeping, even though additional log entries are usually added to the existing log.

Keep in mind that Windows will log each boot process from that moment on until you uncheck the boot log option again in the Msconfig program.

We need your help

Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats or subscription fees.

If you like our content, and would like to help, please consider making a contribution:

Comments

  1. Steve said on July 22, 2012 at 8:54 pm
    Reply

    Thanks for the info, i use msconfig a lot but have never noticed that option even though its right in your face lol

  2. Clade said on December 10, 2017 at 5:36 pm
    Reply

    H Martin!

    Great job! .

    Can you explain the following situation:?

    Some drivers loaded and the same drivers do not loaded:

    Microsoft (R) Windows (R) Version 10.0 (Build 16299)
    12 10 2017 11:42:51.485
    BOOTLOG_LOADED \SystemRoot\system32\ntoskrnl.exe
    BOOTLOG_LOADED \SystemRoot\system32\hal.dll
    BOOTLOG_LOADED \SystemRoot\system32\kd.dll
    BOOTLOG_LOADED \SystemRoot\system32\mcupdate_GenuineIntel.dll
    BOOTLOG_LOADED \SystemRoot\system32\HalExtIntcLpioDma.dll
    BOOTLOG_LOADED \SystemRoot\System32\drivers\msrpc.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\ksecdd.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\werkernel.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\CLFS.SYS
    BOOTLOG_LOADED \SystemRoot\System32\drivers\tm.sys
    BOOTLOG_LOADED \SystemRoot\system32\PSHED.dll
    BOOTLOG_LOADED \SystemRoot\system32\BOOTVID.dll
    BOOTLOG_LOADED \SystemRoot\System32\drivers\FLTMGR.SYS
    BOOTLOG_LOADED \SystemRoot\System32\drivers\clipsp.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\cmimcext.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\ntosext.sys
    BOOTLOG_LOADED \SystemRoot\system32\CI.dll
    BOOTLOG_LOADED \SystemRoot\System32\drivers\cng.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\Wdf01000.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\WDFLDR.SYS
    BOOTLOG_LOADED \SystemRoot\system32\drivers\WppRecorder.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\SleepStudyHelper.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\acpiex.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\ACPI.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\WMILIB.SYS
    BOOTLOG_LOADED \SystemRoot\System32\drivers\intelpep.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\WindowsTrustedRT.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\pcw.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\DsArk64.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\msisadrv.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\pci.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\vdrvroot.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\pdc.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\CEA.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\partmgr.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\spaceport.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\volmgr.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\volmgrx.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\mountmgr.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\iaStorA.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\storport.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\EhStorClass.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\fileinfo.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\Wof.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\FBFsmon.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\Fastboot.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\NTFS.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\Fs_Rec.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\ndis.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\NETIO.SYS
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\ksecpkg.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\tcpip.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\fwpkclnt.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\wfplwfs.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\fvevol.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\volume.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\volsnap.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\TWZDISK.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\rdyboost.sys
    BOOTLOG_LOADED \SystemRoot\system32\pwdrvio.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\mup.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\KSafeDISK.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\iorate.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\hwpolicy.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\disk.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\CLASSPNP.SYS
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\BTOWSVF.sys
    BOOTLOG_LOADED \SystemRoot\system32\ambakdrv.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\cdrom.sys
    BOOTLOG_LOADED \??\C:\WINDOWS\System32\Drivers\TWZFILE.sys
    BOOTLOG_LOADED \??\C:\WINDOWS\System32\Drivers\BTOWSFF.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\filecrypt.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\epp64.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\360FsFlt.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\360Box64.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\Null.SYS
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\Beep.SYS
    BOOTLOG_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\BasicDisplay.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\BasicRender.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\wsddfac.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\Npfs.SYS
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\Msfs.SYS
    BOOTLOG_NOT_LOADED \SystemRoot\system32\drivers\gbpddfac64.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\tdx.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\netbt.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\afd.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\wsddntf.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\vwififlt.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\pacer.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\netbios.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\360Camera64.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\rdbss.sys
    BOOTLOG_LOADED \??\C:\WINDOWS\System32\drivers\zamguard64.sys
    BOOTLOG_LOADED \??\C:\WINDOWS\System32\drivers\zam64.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\nsiproxy.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\npsvctrig.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\mssmbios.sys
    BOOTLOG_LOADED \??\C:\WINDOWS\system32\drivers\HWiNFO64A.SYS
    BOOTLOG_LOADED \SystemRoot\System32\drivers\gpuenergydrv.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\dfsc.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\CLVirtualDrive.sys
    BOOTLOG_LOADED \??\C:\windows\system32\drivers\cbfs6.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\BAPIDRV64.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\bam.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\ahcache.sys
    BOOTLOG_LOADED \SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_9c1fb8f4db31c348\CompositeBus.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\serscan.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\ksthunk.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\kdnic.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\umbus.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\CAD.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\igdkmd64.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\HDAudBus.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\ucx01000.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\USBXHCI.SYS
    BOOTLOG_LOADED \SystemRoot\System32\drivers\TeeDriverW8x64.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\rt640x64.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\athw8x.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\vwifibus.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\CmBatt.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\AcpiVpc.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\i8042prt.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\SynTP.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\kbdclass.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\mouclass.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\intelppm.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\acpipagr.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\UEFI.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\NdisVirtualBus.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\swenum.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\vpnpbus.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\BazisVirtualCDBus.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\rdpbus.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\IntcDAud.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\UsbHub3.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\CHDRT64.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\CAD.sys
    BOOTLOG_LOADED \SystemRoot\system32\Drivers\RtsUer.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\btfilter.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\BTHUSB.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\hidusb.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\mouhid.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\usbccgp.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\rtsuvc.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\fastfat.SYS
    BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\monitor.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\WUDFRd.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\mshidumdf.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\mmcss.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\wcifs.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\luafv.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\cldflt.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\storqosflt.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\lltdio.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\mslldp.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\rspndr.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\wanarp.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\ndisuio.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\nwifi.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\HTTP.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\bowser.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\mpsdrv.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\mrxsmb.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\vwifimp.sys
    BOOTLOG_LOADED \??\C:\Windows\system32\ammntdrv.sys
    BOOTLOG_LOADED \??\C:\Windows\system32\amwrtdrv.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\srvnet.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\peauth.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\srv2.sys
    BOOTLOG_LOADED \??\C:\Windows\system32\Drivers\FBNetFlt.sys
    BOOTLOG_LOADED \SystemRoot\system32\drivers\Ndu.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\srv.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\tcpipreg.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\rassstp.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\NDProxy.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\AgileVpn.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\DRIVERS\NDProxy.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\rasl2tp.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\DRIVERS\NDProxy.sys
    BOOTLOG_LOADED \??\C:\Program Files\CheckMAL\AppCheck\AppCheckD.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\raspptp.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\DRIVERS\NDProxy.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\raspppoe.sys
    BOOTLOG_NOT_LOADED \SystemRoot\System32\DRIVERS\NDProxy.sys
    BOOTLOG_LOADED \SystemRoot\System32\DRIVERS\ndistapi.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\ndiswan.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\tunnel.sys
    BOOTLOG_LOADED \??\C:\Program Files\Diebold\Warsaw\wsddin64.sys
    BOOTLOG_LOADED \??\C:\WINDOWS\system32\drivers\wsddprm.sys
    BOOTLOG_LOADED \SystemRoot\System32\Drivers\360AntiHacker64.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\condrv.sys
    BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\360AvFlt.sys
    BOOTLOG_LOADED \SystemRoot\System32\drivers\MSKSSRV.sys

    Thanks!

    Clade

    1. Martin Brinkmann said on December 15, 2017 at 5:18 pm
      Reply

      The drivers that were not loaded appear to have been loaded before. I’m not an expert on this though, maybe someone else could chime in?

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

Please note that your comment may not appear immediately after you post it.