Investigation should include configuration management techniques, such as
Config.sys files
Autoexec.bat files
System.ini files.