Autoruns for Windows 13.91

Autoruns

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys.Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond other autostart utilities.

Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.

You'll probably be surprised at how many executables are launched automatically!

Displayed Locations and Entries:

Logon - This entry results in scans of standard autostart locations such as the Startup folder for the current user and all users, the Run Registry keys, and standard application launch locations.
Explorer - Select this entry to see Explorer shell extensions, browser helper objects, explorer toolbars, active setup executions, and shell execute hooks.
Internet Explorer - This entry shows Browser Helper Objects (BHO's), Internet Explorer toolbars and extensions.
Services - All Windows services configured to start automatically when the system boots.
Drivers - This displays all kernel-mode drivers registered on the system except those that are disabled.
Scheduled Tasks - Task scheduler tasks configured to start at boot or logon.
AppInit DLLs - This has Autoruns shows DLLs registered as application initialization DLLs.
Boot Execute - Native images (as opposed to Windows images) that run early during the boot process.
Image Hijacks - Image file execution options and command prompt autostarts.
Known DLLs - This reports the location of DLLs that Windows loads into applications that reference them.
Winlogon Notifications - Shows DLLs that register for Winlogon notification of logon events.
Winsock Providers - Shows registered Winsock protocols, including Winsock service providers. Malware often installs itself as a Winsock service provider because there are few tools that can remove them. Autoruns can disable them, but cannot delete them.
LSA Providers - Shows registers Local Security Authority (LSA) authentication, notification and security packages.
Printer Monitor Drivers - Displays DLLs that load into the print spooling service. Malware has used this support to autostart itself.
Sidebar - Displays Windows Sidebar gadgets.