Autoruns Help

Autoruns

Copyright © 1996-2004 Mark Russinovich and Bryce Cogswell

Sysinternals - www.sysinternals.com

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor (A starting list of auto-run locations was obtained from David Solomon's "Windows Internals" seminar), shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. A "Hide Signed Microsoft Entries" option helps you to zoom in on third-party auto-starting images that have been added to your system.

You'll probably be surprised at how many executables are launched automatically!

Autoruns works on all versions of Windows.

Note: before you send e-mail reporting what you believe to be an auto-start location that's overlooked by Autoruns, please make sure that Autoruns doesn't cover it and verify that the location actually works.

License

You may not distribute Autoruns without permission from Sysinternals. To request permission contact licensing@sysinternals.com.


Disabling and Deleting Entries

If you don't want an entry to active the next time you boot or login you can either disable or delete it. To disable an entry uncheck it. Autoruns will store the startup information in a backup location so that it can reactivate the entry when you recheck it. For items stored in startup folders Autoruns creates a subfolder named Autorunsdisabled. If there are disabled items in these folders when you logon Explorer will create a window to the folder on the desktop (but not execute the images within it).

You should delete items that you do not wish to ever execute. Do so by choosing Delete in the Entry menu.


Configuring the Displayed Locations and Entries

Simply run Autoruns and it shows you the currently configured auto-start applications in the locations that most directly execute applications. You can toggle on other locations in the View menu. Perform a new scan that reflects changes by refreshing the display.

  • Show AppInit DLLs: This has Autoruns shows DLLs registered as application initialization DLLs.

  • Show Explorer Addons: Select this entry to see Explorer shell extensions, browser helper objects, explorer toolbars, active setup executions, and shell execute hooks.

  • Show Services: Enabling this results in the display of all Windows services configured to start automatically when the system boots.

  • Show Winlogon Notifications: Shows DLLs that register for Winlogon notification of logon events.

  • Show Winsock Protocols: Shows registered Winsock protocols, including Winsock service providers. Malware often installs itself as a Winsock service provider because there are few tools that can remove them. Autoruns can uninstall them, but cannot disable them.

Unless the Include Empty Locations selection is checked Autoruns doesn't show locations with no entries.

The Verify Signatures option appears on systems that support image signing verification and can result in Autoruns querying certificate revocation list (CRL) web sites to determine if image signatures are valid. Autoruns displays the text "(Not verified)" next to the company name of an image that either does not have a signature or has a signature that is not signed by a certificate root authority on the list of root authorities trusted by the system.

Use the Hide Signed Microsoft Entries (or Hide Microsoft Entries on a system that doesn't support image signing verification or when you've deselected Verify Signatures) in the View menu to help you identify software that's been added to a system since installation. Autoruns prefixes the name of an image's publisher with "(Not verified)" if it cannot verify a digital signature for the file that's trusted by the system. The Hide Signed Microsoft Entries selection omits images that have been signed by Microsoft.

On Windows NT/XP/2000/2003 systems that have multiple user accounts the Users menu is populated with user names. Select one to view the auto-starting images for that account.


Getting More Information about an Entry

There are several ways to get more information about an autorun location or entry. To view a location or entry in Explorer or Regedit chose Jump To in the Entry menu or double-click on the entry or location's line in the display. You can view Explorer's file properties dialog for an entry's image file by choosing Properties in the Entry menu. You can also have Autoruns automatically execute a Google search in your browser by selecting Google in the Entry menu.


Reporting Bugs and Feedback

If you wish to report a bug please provide a complete description of your system and describe the behavior you see compared to what you expect to see. Please try to supply enough information so that we can reproduce the problem. Send bug reports to mark@sysinternals.com.