Simply download and unzip Autoruns from the link below. It is a standalone utility that does not require installation. Add it to a flash drive for portable use and easy access.

http://technet.microsoft.com/en-au/sysinternals/bb963902.aspx

From the Zip file, double-click the autoruns.exe Application listed first. The application opens quickly, and you should see a tabbed interface.

This is the main window for Autoruns. The list shows all software that will run when you start your PC. Most of the programs presented are legitimate and are not malware. It takes some practice to identify malware processes. To disable a program from launching temporarily, uncheck the box next to the entry. To permanently prevent a program from launching, highlight and delete it. You will have to uninstall the program from your computer, as this deletion does NOT remove the software. If you recognize the software name, it is most likely legitimate. Check the Logon tab, as this is where malware will most typically appear. You may want to check the Hide Microsoft and Windows entry setting under Options to hide operating system files from being displayed. This reduces the list you have to go through significantly.

It should be noted that malware will adopt recognizable software names. One way to spot malware is by looking under the Publisher column. If there is no entry or if the publisher’s name is something that you do not recognize, then it is probably malware. If you suspect a recent infection, open the EXE or DLL file for the software and look at the “last modified” date. If it is a recent date and you have not installed any software recently, that is malware. Updates will have a Publisher clearly listed and are confined to operating system updates. These will have recent dates but are not malware. Generally, malware can be found in the C:\Windows folder or the C:\Windows\System32 folder.

This is what a malware entry will look like. In this case, Diskfix and SearchHelper are the culprits. These were not intentionally installed; they were installed by a Trojan downloader. Note that they have generic icons and the filenames are random characters. This is the mark of malware.

These two executable files were found in the C:\Windows\System32 folder using Autoruns.

Once the malware has been identified, you can temporarily disable them, permanently delete them, find them in Task Manager to terminate the processes, delete the files from your hard drive, or move them to a folder that will confine them from restarting. Do all of the above if you are sure that it is malware. Once you have made the changes, reboot the computer and start Autoruns again to see if the programs are still listed there. Next, check the Task Manager to see if they are running. If everything is clear on those fronts, you have succeeded in manually cleaning your PC of hidden malware and your locked antivirus program should be running well again.

If you are not sure about a specific program or file listed in Autoruns, you could use an online virus scanner like Virus Total to scan it. Another option is to research the file name on the Internet.

Today Autoruns for Windows 10 has been released to the public. The new version of the popular autostart manager is offered as a free download from Technet.

It is furthermore still possible to run Autoruns directly from Live.Sysinternals.com.

The official blog post mentions the following changes in Autoruns 10.

This major update to Autoruns introduces the ability to scan offline Windows installations, adds .exe and .cmd extension handlers, defaults to hiding Windows entries to reduce noise in the common use case, and includes bug fixes.

Probably the biggest improvement for many is the ability to scan offline Windows installations. This feature can be used by clicking on File > Analyze Offline System. The system root directory and user profile of the offline system need to be selected.

This opens up new possibilities for dual boot systems as it is now possible to analyze the startup items of one of the systems from the other.

autoruns for windows 10

One of the best tips for new users of Autoruns is to hide Microsoft and Windows entries from the software. This ensures that only third party startup items are displayed in the interface. This can be set in the Options menu of the autostart manager.

Autoruns For Windows 10 can be downloaded directly from Technet. The portable software is compatible with all client versions of Windows from Windows XP on and all server versions from Windows Server 2003 on.

Removing entries from the list of programs that get started during system start will prevent them to be loaded after the next reboot. Inexperienced users should be very cautious on the other hand as the program displays important files that are needed to run the operating system properly.

The update to Autoruns 9.5 added a new tab to the startup manager. Autoruns now displays multimedia codecs “which are gaining popularity as an extension mechanism used by malware gains automatic execution.”

A click on the Codecs tab in Autoruns displays now system codecs as well. It is probably a good idea to hide Microsoft and Windows codecs from the list to make it more accessible.

Autoruns can be downloaded from the Windows Sysinternals homepage. It is compatible with client and server operating systems starting with Windows XP and Windows Server 2003.

Administrators can remove services from Windows operating systems using the following means:

1. Command Line

The basic command to delete a service is sc delete followed by the short name of the service. The short name is not the name that is shown in the Services main menu. Administrators need to right-click the service, select properties and use the ServiceName in the general tab instead.

The command to remove the PC Tools Auxiliary Service would be therefor sc delete sdAuxService.

Windows 7 and Windows Vista users need to run the command from an elevated command prompt.

2. Software

Autoruns by Sysinternals can be used to remove most third party services from the Windows operating system. It does however not necessarily list all services. Users need to fallback to the manual service removal procedure if that is the case. Switching to the Services tab in the application will list the services that are recognized by Autoruns.

Selecting a service in that list and pressing delete will remove it from the Services menu.

Enter Xecutor a multi-lingual (German, English and Spanish) software program that can be used to load software automatically at any time if the computer system is running. It can even import Windows autostart entries from both the Windows Registry and autostart file and include them in its own list although it is not recommended to import security software or system processes that way.

The main interface of Xecutor divides the applications into startup, shutdown and scheduler tabs which can be used to launch software automatically during startup, shutdown or user defined when the computer system is running.

Many of configuration options are available for all three types of situations. Executable files from the computer’s hard drive can be picked by using the file browser. It is possible to add parameters, to configure wait times and an option to minimize the software after launch.

Launch conditions can be defined. The day of the week the software should be launched can be configured. Applications can be set to only launch before or after a specific time. The Scheduler adds another option: The possibility to start an application at a specific time or in intervals. The last option is to add a question before and a message after execution.

Some of the applications that are included in the Sysinternals suite should be installed on every computer such as Rootkit Revealer, Autoruns, Process Explorer and Regmon. This collection might confuse inexperienced users due to the sheer amount of exectuable files that are listed in the main directory. It is difficulty to find out what some of the executables are doing, do you know for instance what psfile.exe will do ?

It would have been nice if at least a readme file would have been included to make it easier to understand the executables. A gui would have been even better. I would advise everyone to visit the Sysinternals website to lookup the programs before you execute them.

Update: The latest version of Sysinternals Suite has a size of 13.3 Megabytes. The collection still contains all programs that have been developed and released by Sysinternals in the past. All you need to do is to download the zip file and unpack it on your system to start using the applications right away.

Some applications ship with Windows Help files that explain the program’s core functionality. Other programs are still listed without information.

This collection is ideal for a troubleshooting CD or stick that you carry around whenever to have it ready whenever you need it.

An alternative to that is Sysinternals Live, which lets you run all Sysinternals applications directly from the web.

First of all, you need a tool to check them out. You could use the run command and enter msconfig which should display the autostart items or you could use a third party tool like Autoruns from Sysinternals which i recommend for this task.

I will show you how to identify the programs that are running using either msconfig or Autoruns. For the sake of simplicity start msconfig using the windows run command and click on the startup item on the menu.

You see a list of programs that are loaded when windows is starting. You probably can identify some without looking them up, if that is the case and you don´t want them running on your system startup disable them.

Now, let us say you found an entry and don´t know why this is loaded by startup. Head to the CastleCops website and enter the filename that is loaded in the search field. If the file is found you see a description and a recommendation (status). In short, if the status shows Y=YES, you should keep it, if it shows N=NO you can disable it. There is also U=USER for users choice, X for definitely not required (often virii, malicious, spyware) and ? for unknown.

Read More:

autoruns
CastleCops

This is a very useful tool that every windows user should run from time to time to check on his autostarts, I bet there will be more than you think there are. Removing some helps to speed up windows startup as well.

Simply run Autoruns and it shows you the currently configured auto-start applications as well as the full list of Registry and file system locations available for auto-start configuration. Autostart locations displayed by Autoruns include logon entries, Explorer add-ons, Internet Explorer add-ons including Browser Helper Objects (BHOs), Appinit DLLs, image hijacks, boot execute images, Winlogon notification DLLs, Windows Services and Winsock Layered Service Providers. Switch tabs to view autostarts from different categories.

Autoruns for Windows version 11.0

Autoruns for Windows is a fully comprehensive startup monitor that displays all programs that are configured to run at system bootup or login. It will show you specific entries in the exact order that Windows processes them. It will even show all of the executables that launch at startup. Inclusive in this comprehensive display are programs in the startup folder, Run, RunOnce, and other Registry Keys.

Aside from showing you what is going on during startup/ bootup, Autoruns enables you to configure specifically to show additional locations such as Explorer and shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and just about everything else you could possibly think of. MSConfig is nothing compared to this. Thus, the term “comprehensive” has been used liberally to describe this startup monitor.

Third-party auto-start images which have been added to your system can be a burden to the operating system and drastically slow startup time. Autoruns 11.0 includes a Hide Signed Microsoft Entries option to assist you in isolating these third-party auto-start images and includes support for examining the auto-starting images that have been configured for other accounts on a given system. Included in the Autoruns package is a command-line equivalent which is capable of output in CSV format, Autorunsc.

Just run Autoruns and you will immediately see all of the currently configured auto-start applications and a complete list of Registry and file system locations for auto-start configuration. You will see:

logon entries
Explorer add-ons
IE add-ons
BHOs
Appinit Dlls
Image hijacks
Boot execute images
Winlogon notification DLLs
Windows Services
Winsock Layered Service Providers

When you switch tabs, you will be able to view other categories of autostarts.

Any executable that is configured to run automatically can be viewed by selecting it and then using the Properties menu item or toolbar. Process Explorer may be running at the time and an active process could be executing. The Process Explorer menu item in the Entry menu will open the process properties dialog box.

Use the Jump menu item or the toolbar button to navigate to the Registry or file system location displayed. You can then disable any auto-start entry by unchecking its checkbox. Use the Delete menu item to delete an auto-start configuration.
On-line help is available for further assistance, which may very well be required as this is a complex utility.

The command-line version is Autorunsc. The syntax is as follows:

Usage: autorunsc [-x] [[-a] | [-b] [-c] [-d] [-e] [-g] [-h] [-i] [-k] [-l] [-m] [-o] [-p] [-r] [-s] [-v] [-w] [[-z ] | [user]]]

• -a Show all entries.
• -b Boot execute.
• -c Print output as CSV.
• -d Appinit DLLs.
• -e Explorer addons.
• -g Sidebar gadgets (Vista and higher).
• -h Image hijacks.
• -i Internet Explorer addons.
• -l Logon startups (this is the default).
• -m Hide signed Microsoft entries.
• -n Winsock protocol and network providers.
• -p Printer monitor drivers.
• -r LSA providers.
• -s Autostart services and non-disabled drivers.
• -t Scheduled tasks.
• -v Verify digital signatures.
• -w Winlogon entries.
• -x Print output as XML.
• -z Specifies the offline Windows system to scan.
• user Specifies the name of the user account for which autorun items will be shown.

AutoRuns 11.0 download: http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx