AutoRuns 14.30

Autoruns by Sysinternals

Autoruns is the most comprehensive Windows startup monitoring utility available, created by Mark Russinovich and maintained by Sysinternals/Microsoft. It enumerates every auto-start location — logon entries, services, drivers, Explorer and Internet Explorer add-ons, AppInit DLLs, Winlogon notifications, scheduled tasks, codecs, Winsock providers and many other places where programs can be configured to run automatically.

What it does

Run Autoruns and you see a consolidated, tabbed view of every auto-starting image on the local (or offline) system. The tool exposes the precise Registry and file-system locations for each entry, lets you jump directly to the entry, view properties, and open the running process in Process Explorer if applicable.

Key features

• Extensive coverage of autostart locations including shell extensions, BHOs, AppInit DLLs, image hijacks, Winlogon and boot execute entries.
• Option to hide signed Microsoft entries so you can focus on third-party or unknown items.
• Integrated signature verification and VirusTotal lookup with optional file submission for unknown samples (requires accepting VirusTotal terms).
• Command-line equivalent Autorunsc for scripted or remote inventory and CSV, tab-delimited or XML output.
• Filtering and display options, export of results for analysis or troubleshooting, and per-user autostart views (including scanning all profiles).
• Ability to disable (uncheck) or delete entries directly from the UI; jump-to-entry and Process Explorer integration for deeper inspection.
• Can run from Sysinternals Live (https://live.sysinternals.com/autoruns.exe) or download as Autoruns.zip from the official Sysinternals site (https://download.sysinternals.com/files/Autoruns.zip).

Using Autoruns effectively

1. Start Autoruns and let it populate the tabs for Logon, Services, Drivers, Scheduled Tasks and add-ons.
2. Enable signature verification and use the Hide Signed Microsoft Entries option to surface third-party items.
3. Investigate suspicious items by viewing Properties, using Jump to Entry, and opening the running image in Process Explorer.
4. Disable an entry by unchecking it or remove it permanently with Delete; export the list to CSV or XML before making mass changes.
5. For automation or offline inspections, use Autorunsc with flags to collect specific categories, show hashes, or query VirusTotal.

Who should use it

Autoruns is essential for IT professionals, system administrators, incident responders and advanced users who need precise control and visibility of Windows startup behavior. It helps troubleshoot slow boots, diagnose malware or unwanted persistence mechanisms, and document autostart configurations across machines.

Security and privacy notes

VirusTotal queries and uploads are optional and require acceptance of VirusTotal terms. Use caution when deleting entries — disabled entries can be re-enabled if needed, but deleting registry or file-system entries can impact system stability if core components are removed.

Why it stands out

• Depth: Autoruns covers more autostart locations than typical startup managers.
• Integration: Works with other Sysinternals tools (Process Explorer) and VirusTotal for investigation workflows.
• Flexibility: GUI and command-line versions allow both interactive troubleshooting and automated reporting.