How did Windows 95 decide that a setup program ran?
Summary
Raymond Chen explains how Windows 95 guessed whether a program was a setup program by checking the executable name for magic words like 'setup' or 'install'.
<p>A little while ago, I mentioned that <a title="Windows 95 defenses against installers that overwrite a file with an older version" href="https://devblogs.microsoft.com/oldnewthing/20260324-00/?p=112159"> Windows 95 had some defenses against installers that overwrite a file with an older version</a>. These defenses kicked in whenever it detected that a setup program had finished. But <a href="https://devblogs.microsoft.com/oldnewthing/20260324-00/?p=112159&commentid=143974#comment-143974"> how does it know that a setup program was running</a>?</p>
<p>It guesses.</p>
<p>If the name of the program contains the word “setup”, “install”, or some other magic words, then it is considered to be a setup program. Here’s the list of magic words.</p>
<table class="cp3" style="border-collapse: collapse;" border="1" cellspacing="0" cellpadding="3">
<tbody>
<tr>
<th>Magic word</th>
<th>Notes</th>
</tr>
<tr>
<td><tt>setup</tt></td>
<td> </td>
</tr>
<tr>
<td><tt>install</tt></td>
<td>Redundant</td>
</tr>
<tr>
<td><tt>inst</tt></td>
<td> </td>
</tr>
<tr>
<td><tt>imposta</tt></td>
<td>Italian?</td>
</tr>
<tr>
<td><tt>ayarla</tt></td>
<td>Turkish?</td>
</tr>
<tr>
<td><tt>felrak</tt></td>
<td>Hungarian?</td>
</tr>
</tbody>
</table>
<p>The entry for <tt>install</tt> is redundant with <tt>inst</tt>, because anything that contains “install” will also contain “inst”. My guess is that “install” came first, and then later somebody found that a lot of setup programs were called “<span style="border: solid 1px currentcolor;">blah</span>inst” for various values of “blah” so they added an entry for “inst”, but failed to remove the redundant entry for “install”.</p>
<p>If there are no matches on the program name, Windows 95 also checks whether the path to the executable contains the word “Setup”.</p>
<p>In the above two cases, the file check is delayed until the next start, because some setup programs will realize that the file is in use and cannot be replaced, so they use <code>ExitWindowsExec</code> to exit Windows back to MS-DOS, run a batch file, and then start Windows back up. We have to wait until the restart of Windows to catch any files that were improperly modified by the batch file.</p>
<p>As a special bonus, Windows 95 does a live file check after any multimedia driver installs via an INF file. I guess the multimedia team discovered that a lot of drivers overwrite system DLLs in their INF files, so they asked for a cleanup pass afterward.</p>
<p>The post <a href="https://devblogs.microsoft.com/oldnewthing/20260707-00/?p=112508">How did Windows 95 decide that a setup program ran?</a> appeared first on <a href="https://devblogs.microsoft.com/oldnewthing">The Old New Thing</a>.</p>
View Cached Full Text
Cached at: 07/07/26, 10:35 PM
# How did Windows 95 decide that a setup program ran? - The Old New Thing
Source: [https://devblogs.microsoft.com/oldnewthing/20260707-00?p=112508](https://devblogs.microsoft.com/oldnewthing/20260707-00?p=112508)
A little while ago, I mentioned that[Windows 95 had some defenses against installers that overwrite a file with an older version](https://devblogs.microsoft.com/oldnewthing/20260324-00/?p=112159)\. These defenses kicked in whenever it detected that a setup program had finished\. But[how does it know that a setup program was running](https://devblogs.microsoft.com/oldnewthing/20260324-00/?p=112159&commentid=143974#comment-143974)?
It guesses\.
If the name of the program contains the word “setup”, “install”, or some other magic words, then it is considered to be a setup program\. Here’s the list of magic words\.
Magic wordNotessetupinstallRedundantinstimpostaItalian?ayarlaTurkish?felrakHungarian?The entry forinstallis redundant withinst, because anything that contains “install” will also contain “inst”\. My guess is that “install” came first, and then later somebody found that a lot of setup programs were called “blahinst” for various values of “blah” so they added an entry for “inst”, but failed to remove the redundant entry for “install”\.
If there are no matches on the program name, Windows 95 also checks whether the path to the executable contains the word “Setup”\.
In the above two cases, the file check is delayed until the next start, because some setup programs will realize that the file is in use and cannot be replaced, so they use`ExitWindowsExec`to exit Windows back to MS\-DOS, run a batch file, and then start Windows back up\. We have to wait until the restart of Windows to catch any files that were improperly modified by the batch file\.
As a special bonus, Windows 95 does a live file check after any multimedia driver installs via an INF file\. I guess the multimedia team discovered that a lot of drivers overwrite system DLLs in their INF files, so they asked for a cleanup pass afterward\.
### Category
### Topics
## Author
Raymond has been involved in the evolution of Windows for more than 30 years\. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie\-jeebies\. The Web site spawned a book, coincidentally also titled The Old New Thing \(Addison Wesley 2007\)\. He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information\.
Similar Articles
A sample use of the winstart.bat file in Windows 95
The article discusses the historical use of winstart.bat in Windows 95 for loading TIGA graphics drivers, referencing earlier documentation from Windows 3.1 and a Siemens recommendation for Windows 95.
Windows brings out the Rorschach test in everyone
The blog post recounts humorous incidents where Windows 95 and XP packaging and wallpapers were misinterpreted by the public, leading to design changes. Author Raymond Chen shares these stories from Microsoft's history.
Windows 95 released August 24, 1995
Windows 95 was released on August 24, 1995, as a highly anticipated operating system that introduced modern pre-emptive multitasking and improved scalability over previous versions.
As a Windows user, it's a surreal way to install a program
An essay exploring the surreal experience of installing apps on macOS via DMG files, and celebrating the creative design of 'drag to Applications' Finder windows.
How did we conclude that CcNamespace.dll was the ringleader of a group of DLLs that unloaded prematurely?
Raymond Chen explains how he identified CcNamespace.dll as the key DLL in a chain of prematurely unloaded DLLs by analyzing the debugger's unloaded DLL list and noting naming patterns and order.