AutoRuns

This tool, which checks more autorun locations than any other autorun monitor, shows which programs are configured to run during the boot or logon process, and when built-in Windows applications such as Explorer and media players start. Such programs can be located in the autoload folder or be registered in the registry sections of Run, RunOnce and others. Autoruns can also be configured to display other locations, such as shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and many more. Autoruns has a wider range of features than the MSConfig utility and the Startup tab of Task Manager built into Windows.

The Autoruns option Hide Signed Microsoft Entries lets you focus on automatically running third-party items that have been added to your system. You can also view the objects that are configured to run automatically for other accounts in the system. The download archive also includes a command line program, Autorunsc. The output data of this tool can be obtained in CSV, tab-delimited or XML format.

You'll probably be surprised how many executable files run automatically! Autoruns is freeware from Microsoft, written by Mark Russinovich, and runs on current 32-bit, 64-bit and ARM64 versions of Windows without installation. Its scan options can verify digital signatures and check files against VirusTotal, and the File menu can analyze an offline Windows system or compare the current state with a saved scan. Autoruns is also included in the Sysinternals Suite. Simply launch Autoruns and it will show you which applications are configured to run automatically and provide a complete list of registry keys and file system directories that can be used to set up automatic startup. The items shown in Autoruns belong to several categories: objects that start automatically when you log on, additional Explorer components, additional Internet Explorer components (including browser helper objects (BHO)), AppInit DLLs, image hijacks, boot execute images, Winlogon notification DLLs, Windows services, Winsock layered service providers, codecs, scheduled tasks and WMI entries. To view the automatically launched objects of the required category, just select the necessary tab.

AutoRuns precisely identifies and controls which programs run during your computer's startup, enhancing system performance and security.

To view the properties of the executable object configured for automatic launch, you should select this object and use the Properties menu item or toolbar button. If the Process Explorer program is running in the system and the selected executable file is used by some active process, then selecting the Process Explorer item in the Entry menu opens the properties dialog box of the process using the selected object.

To go to the registry key or file system directory where an auto-start item is configured, or to the location of its executable, just select the necessary item and use the Jump to Entry or Jump to Image menu command.

To disable an object that is launched automatically, clear the check box corresponding to it. You can delete such an object using the menu command or the Delete toolbar button. To view the automatically launched items for other user accounts, simply select the desired User menu item. The Options menu adds display filters such as hiding Windows entries; for more information on display options and other useful information, see the online help.