Investigation should include configuration management techniques such as
Config.sys files
Autoexec.bat files
System.ini files.