AutoRuns is a free utility for displaying all processes in the autorun of the Windows operating system, a startup monitor on a computer. This is the most complete tool with which you can manage programs, processes, drivers, modules, services or jobs, and other system components related to autorun.
The Autoruns program shows everything that starts on the PC when Windows starts. In the application, you can see the startup properties and settings, and cancel startup of unnecessary applications and components.
Autoruns was created at Sysinternals by Mark Russinovich. Subsequently, Microsoft acquired Sysinternals, and Mark Russinovich became a Microsoft employee (currently CTO of Microsoft Azure). Mark Russinovich continues to develop the Autoruns program with Bryce Cogswell.
During system startup, third-party software is launched along with Windows, system services and applications. Autostarting applications is not always justified, because there is no need for many programs to constantly run in the background.
A large number of running applications affects the system boot speed; running in the background, programs uselessly waste computer resources and take up memory space. Therefore, some programs should be disabled from startup; the user can independently launch the application on his PC when he needs it.
Setting up Windows startup will help improve the performance of your computer. One way: use the Autoruns program to disable autorun of unnecessary applications.
Autoruns features
Using the Autoruns utility, the user can take advantage of the following features:
- Monitoring of all places from which programs start automatically.
- Display programs, drivers, system services, tasks in the Scheduler, Winlogon notifications.
- Autorun monitor for built-in Windows applications (Explorer extensions, Internet Explorer, browser hidden objects, hijackers).
- Search for running applications in the operating system, and separately in the Startup folder, in Windows services, in the registry (Run, RunOnce), in Explorer.
- Temporarily suspending the autorun of programs while saving the settings, and then restoring the autorun of applications.
- Disable autorun of programs and components.
- Ability to use different accounts on your computer.
- Check startup files for viruses in VirusTotal.
- There is a command line version of Autorunsc.
Autoruns system requirements:
- Operating system Windows XP and higher (Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista).
- 32 bit (x86) and 64 bit (x64) editions of the OS are supported.
The Autoruns program can be downloaded from the official Sysinternals website. The program does not require installation on your computer; it is launched from a folder. The application works in English.
Autoruns download
Quite often, Autoruns is used to search for and neutralize malicious software. Conducting a study of autorun objects in the program will help you find a virus and disable its autorun.
Startup folder
Let's now consider how to add a program file to Windows startup. In fact, this list in the form of program shortcuts is stored in the StartUp folder. Not everyone knows where it is, so we give the full path:
%user_profile%\AppData\Roaming\Microsoft\Windows\Main Menu\Programs\Startup
You can get to this folder through Explorer by copying this line and entering it in the search bar. You can do it differently: call the “Run” console (Win + R combination) and enter the shell:startup command, confirming its launch by pressing OK.
How to add a program to startup using this folder? A common mistake is copying the executable file itself. This method will not work - you need to create a shortcut for the desired program in this directory.
ATTENTION. This method is simple and very visual, but it does not work in all cases; it cannot be called reliable. It is much more efficient to use the system registry for this.
Launching Autoruns
After downloading the program to your computer, to launch the utility you must perform the following steps:
- Unzip the ZIP archive.
- Open the Autoruns folder.
- Run the “Autoruns” or “Autoruns64” file as administrator, depending on the bitness of your system.
- In the “AutoRuns License Agreement” window, click on the “Agree” button.
What programs should I disable?
First of all, you need to “cut out” everything that does not belong to the official Microsoft software. Then we carefully study the list and see what is needed and what just happened by chance.
Some users disable GoogleUpdate, Java, Skype, Viber, Steam, CCleaner, Bandicam and other applications to achieve optimal download speed.
Perhaps all this will not give noticeable loading speed, but as they say: “ten old ladies is already a ruble.” Does the program raise doubts? Read about it in Yandex or Google to safely remove or disable its autoloading.
Autoruns interface
The Autoruns window will open, displaying all running processes in the Windows operating system. By default, the main window opens in the “Everything” tab.
At the very top of the program window there is a menu bar. The program is controlled from the menu, various actions are performed in the application using commands: searching for a file, saving to a file, opening a previously created snapshot of autorun locations, etc.
Below is a toolbar with which you can access some popular functions of the program: saving, searching, moving to another level, properties, updating, deleting. There is a “Filter:” field here for quickly searching for startup objects in the application window.
Next comes the tab bar. After scanning the system, Autoruns distributes the received information across different tabs (autorun locations). After going to the desired tab, it is easier to find the necessary information than in the general list.
The main place is occupied by the work area, which displays information about running programs, services, drivers, etc.
Below is the details panel, which displays information about the selected object.
The status bar shows information about the collection or completion of collection of information about autorun locations.
Some autorun elements in Autoruns are highlighted in different colors:
- Red - This item does not have a Microsoft digital signature.
- Yellow color - missing or moved files, information about which remains in the registry.
If a container is marked red, this does not mean that the file is malware. For some reason, the item does not have a verified Microsoft digital signature. Pay attention to these files, get information about them on the Internet.
Disable items highlighted in yellow from startup by unchecking the box next to this item. These recordings can then be deleted from your computer.
How to watch and disable programs from startup
The easiest way to access the startup list in Windows 10 is to use Settings (launched through the Start menu or using the Win + I combination). Click on the “Applications” tab and select the “Startup” menu item.
A list of applications launched when the operating system starts will appear. You can inspect it and exclude the launch of those programs that you consider unnecessary. If you come across something unfamiliar, it is better not to touch it, but first find out what kind of program it is. But in general, everything that is present here is not critical for the operation of the operating system. True, without some utilities, certain functions may not work (for example, managers for working with the monitor often end up in startup), but in any case, the functionality of Windows will not be lost. Another thing is that excluded programs will have to be launched manually.
In previous versions of Windows, you can access startup by running the msconfig utility in the Run panel and selecting the Startup tab. As in the previous option, you can view the list and disable unnecessary lines.
But adding programs to startup in this way will not work; there are other ways to do this.
Overview of tabs in the Autoruns program window
For the convenience of obtaining information about autorun locations, Autoruns distributes launched objects into tabs, according to their functionality.
You may also be interested in:
- Autorun Organizer - startup manager
- Startup Windows 10: how to add or remove a program from startup
The program window displays containers (folders, files, settings and registry keys) used for autorun, and the contents of the container. The columns contain information about startup objects:
- The Autorun Entry column shows the autorun method. If there is a checkbox next to the element, this means that autorun is running.
- The Description column contains a description of the file.
- The Publisher column provides information about the manufacturer of the startup object.
- The “Image Path” column indicates the path to the file (image, object).
- The Timestamp column displays the time the file appeared on your computer.
- The “VirusTotal” column contains information about checking the file on the VirusTotal service.
Purpose of all program tabs:
- Everything - All records in one place.
- Logon - all startup items of the current user, programs from the Startup folder.
- Explorer - a list of programs and extensions listed in the Explorer context menu.
- Internet Explorer — elements of the Internet Explorer browser, extensions, toolbars are shown.
- Scheduled Tasks - Displays all Windows operating system maintenance tasks retrieved from the Task Scheduler.
- Services - Microsoft services and services that are launched at system startup.
- Drivers - a list of drivers whose parameters include autoloading.
- Codecs - information about audio and video codecs running on the system, necessary for playing multimedia files.
- Boot Execute - Applications that run when Windows boots, such as checking the disk for errors.
- Image Hijacks - so-called hijackers (hijackers, interceptors) that replace images are displayed here. They are executed along with the original files, replacing the real images. Used by viruses.
- AppInit—Displays applications used by programs.
- Known DLLs - List of registered DLLs.
- Winlogon (Windows Start) - event libraries when the system boots.
- Winsock Providers are components required for the network to operate.
- Print Monitors are components of printer drivers.
- LSA Providers - Handle network security events.
- Network Providers - Providers that handle network settings.
- WMI (Windows Management Instrumentation) - Elements from the WMI database.
- Office - Microsoft Office autorun elements if the office software package is installed on this computer.
Advice. To see the startup locations of only third-party applications, without affecting system objects, check the “Hide Windows Entries” option in the “Options” menu. This option is enabled by default. You can enable the Hide Microsoft Entries option, which additionally enables the Hide Windows Entries option.
Windows startup manager utilities
Using built-in operating system tools requires remembering their launch parameters, which, in general, is also not an easy task. It is much easier to run a specialized program installed on disk, the shortcut of which is always present on the desktop. There are many such utilities. Let's look at the most famous of them.
AnVir Task Manager
Quite functional, and most importantly - a free tool that allows you not only to clean up startup, but also to manage built-in Windows services and processes that are not displayed in the Task Manager. The utility provides all possible assistance in the fight against viruses, monitoring the activity of malicious programs and preventing their attempts to block the operation of the operating system. There are also functions to speed up your PC.
The application is designed for beginner and intermediate level users and does not require in-depth knowledge of Windows system processes.
Since the utility also works with built-in system services, it must be launched with administrator rights.
When you start the program, there are tabs under the toolbar, of which we are interested in the first one – “Startup”. In the upper left panel there is a tree of paths for the location of startup elements, this is the registry with branches, files and the Scheduler.
The upper right window displays the contents of the selected branch, which displays all elements of the corresponding autorun list indicating the main parameters:
- program name;
- name of the software manufacturer;
- current state;
- level of risk in terms of system security.
Of course, the latter estimate is purely heuristic, and a high orange/red percentage does not necessarily mean that it is a virus or contains malicious code. But you should pay attention to the entry by first examining in the bottom panel in the “Properties” tab why AnVir Task Manager assigned such a high risk rating to the program.
It often happens that quite harmless system components, for example, built-in Intel video driver programs, are included in the list of unreliable ones. To check for the presence of malicious code, you need to select a suspicious program and in the top menu click the tab with the image of a white arrow on a blue background.
Here is a list of actions that can be performed with the startup list:
- disable programs;
- open the folder with their location in Explorer;
- stop the execution of processes, restart them;
- add new programs to autorun;
- make registry edits;
- indicate a delay in starting the program (delayed start) after Windows boots.
The program interface is heavily loaded, this is a consequence of the functionality of the utility, so it will take time to master it.
Startup Delayer
This utility allows you not only to edit the startup list, but also to distribute the launch of programs over time. This is quite a valuable quality, since usually all programs present in autostart start at the same time when Windows boots.
If the computer is not very powerful, the system startup is very slow, and this can be annoying. Startup Delayer automatically creates time delays that allow the desktop to appear much faster. This means that the user can start working without waiting for all programs present in Startup to finish loading.
The program interface may also seem complicated at first glance, but the average user will master the utility without difficulty and quite quickly. The Startup Applications window contains three functions:
- launching programs with a delay (used for resource-intensive applications);
- normal startup;
- prohibition (disabling) of launching.
After installation and the first launch of the utility, all autorun elements will have the status of a normal launch. To make the program start with a delay, simply drag it from the second block to the first, and when the list is compiled, arrange its elements in the desired order.
To disable a program from autorun, move it to the bottom block.
Another advantage of Startup Delayer is the creation of separate startup profiles for all PC users.
Autoruns
This utility from Sysinternals, a subsidiary of Microsoft, can be called a classic of the genre. This is where you will see the most detailed list of startup items, including system services for all computer accounts. Of course, the program provides the ability to manage these lists - remove unnecessary elements, disable/enable them. Autoruns will not be able to add a program to startup, but there are many very useful options.
The program's working window is divided into 20 categories of programs present in autorun, and the last tab displays all the elements of the list.
If you look at the full list, you will notice that some lines are highlighted in a different color. Yellow indicates that the executable file present in the list is not present in the specified location. Programs marked in pink were classified by Autoruns as suspicious. You can check them for the presence of malicious code directly from the utility - it will send the file for scanning to the Virustotal service, provided that you are already registered with it.
Click on any line of the list, and detailed information about the selected file will be displayed below - its name, creator, version and creation date.
To disable an element from autorun, you must uncheck the box to the left of the entry. You can delete a startup item using RMB by clicking Delete (but remember that you won’t be able to restore this item using the utility). By double-clicking on the line, you will be taken to the registry editor, where you can adjust the launch parameters.
Autoruns displays the startup list for the current user, but you can work with similar lists for other users by clicking on the User tab and selecting the desired item.
So, you have become familiar with the basic ways of adding/editing programs in startup. How do you solve the problem of adding a new element to the list of programs launched at startup? Share your experience in the comments, it may be very valuable for other users.
Removing an entry from autorun in Autoruns
In Autoruns, you can delete an entry about the autorun of a program that does not need to be launched when the system starts.
Attention! Autoruns does not create backup copies of autorun objects that are deleted. Therefore, take care in advance to create a system restore point or create a Windows backup to restore your computer to working condition if something goes wrong.
- Uncheck the box next to the corresponding autorun item.
- Select an element and right-click on it.
- In the context menu, click on the “Delete” item.
- In the warning window, click on the “Yes” button.
- After this, the autorun object will be deleted from the operating system.
Using the Task Scheduler
Windows has another tool that allows you not only to add programs to startup, but also to do this with certain parameters. The Scheduler is launched by typing “Task Scheduler” in the Windows search console.
If you click on the “Scheduler Library” item in the left panel, a window will open with a list of programs that are launched when specified events occur or at a certain frequency. Among the triggers, you can specify the start of the system.
The right pane lists the actions that can be performed on list items. In particular, there are buttons that allow you to disable or delete the selected item, as well as add a program/application to startup in Windows 10/8/7.
In this case, the task execution parameters are controlled in the lower central window of the utility. In particular, in order for the program to start when the computer is turned on, in the “Trigger” section you need to select the “At startup” option.
Checking the startup element for viruses in VirusTotal
The VirusTotal online service checks files and links for viruses using more than 70 anti-virus scanners. When checking on the service, the databases of all leading anti-virus software manufacturers are used.
The user has the opportunity to check a suspicious file from his computer using the Autoruns application. To do this, you need to go through the following steps:
- Select the autorun element in the program work area.
- Right-click on it and in the context menu that opens, click on “Check VirusTotal”.
- When you first open the VirusTotal service in your default browser, a window with information about the service will open.
- Close your browser.
- Click on “Check VirusTotal” again.
- In the Autoruns program window, the “VirusTotal” column will display the result of scanning the object for viruses.
If you click on the link with the scan result, a VirusTotal service window will open with detailed information. Antiviruses and the result of checking a specific scanner are listed here.
Bulk scanning of startup objects for viruses in Autoruns
Using the Autoruns program, you can run a mass scan of all autorun elements. Follow these steps:
- Open the Options menu.
- Select “Scan Options...” from the context menu.
- In the “Autoruns Scan Options” window, check the “Check VirusTotal.com” box.
- Click on the "Rescan" button.
After the scan is completed, the results of checking startup items will appear in the program window in the “VirusTotal” column.
If the scan reveals that some files did not pass the scan, it is not necessary to assume that it is a virus. Before making a decision, look for detailed information about the property on the Internet.
The image above shows that two anti-virus scanners found something in the Mail.Ru Cloud program. It is clear that there are no viruses there; perhaps the scanners are fighting because of some advertising offers.
Location
Wondering where the startup options are? Here are three simple steps:
- First you need to open the editor using the regedit query, which is entered in the Run console.
- To find settings for a specific user, follow the path:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - The general settings control is hidden in another location:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run