How can I track what programs come and go on my machine?

Windows XP includes several auditing options which can provide a list of activities you can view in the event viewer.

Process tracking can slow your machine down, so you'll not want to have it on all the time, but it's a useful tool to turn on for a while to see what's happening.

To turn on process auditing:

• Click on Start, and then Run.
• Enter "gpedit.msc" and press OK. This starts the group policy editor.
• Expand Computer Configuration, Windows Settings (by clicking on the boxed plus sign to its left.
• Expand Security Settings, then Local Policies and then click on Audit Policy.
• Double click on Audit process tracking.
• Check the box labeled Success for Audit these attempts.
• OK your way back out.

Now, run whatever scenario you're concerned about. If it's a startup issue, go ahead and reboot.

Now fire up the Event Viewer (Start, Run and "eventvwr" will do it.) Click on the Security item, and the right hand pane will contain a list of events, most recent first. Double click on one and the details, including the name of the executable, will be displayed. Use the arrow buttons to move through the list.

Be sure to turn process tracking off when you're done, by unchecking the Success checkbox for Audit these attempts that you checked earlier.