Explorer (context menus, shell extensions, etc.).The additional tabs let you view the information sorted into categories, including: Unlike MSConfig, Autoruns doesn’t require administrative privileges. You’ll probably be amazed (and a little appalled) at the number you see here. There are 18 different tabs across the top.The first tab, appropriately labeled “Everything,” shows you all of the types of programs and services that are configured to run at startup. As you can see in Figure 1, the program is much more comprehensive than the built-in Windows tool MSConfig.Īt first glance, you might find the interface a little overwhelming. Both are downloaded as executables in a zipped file, along with a help file (autoruns.chm).

The command line version is autorunsc, which is also included in the download. It runs on Windows XP/Server 2003 and above, and you can download it here. You can also disable startup programs directly from within Autoruns. And it shows them in the order in which they’re processed by Windows. It’s very configurable, allowing you to display not only the programs in the startup folder and registry keys Run and RunOnce, but also Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, autostart services and a lot more. The next tool we’re going to look at is Autoruns, which shows you what programs are set up to run during the system bootup and login process. This month in Part 2, I will talk about how you can use the Autoruns tool to find malware that boots at startup. In part 1 of this series, I recapped some of what I learned from Mark Russinovich at this year’s MVP Summit, in regard to using Process Explorer to find suspicious processes that might indicate malware running on your system.

Hunt Down and Kill Malware with Sysinternals Tools (Part 3).

Hunt Down and Kill Malware with Sysinternals Tools (Part 1).

If you would like to read the other parts in this article series please go to: