Autoruns for Windows v14.09

  • Commodity
  • three minutes to read

By Marking Russinovich

Published: Feb 16, 2022

Download Download Autoruns and Autorunsc (3.vii MB)
Run at present from Sysinternals Alive.

Introduction

This utility, which has the virtually comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you lot offset various congenital-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys. Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more.Autoruns goes way beyond other autostart utilities.

Autoruns'Hibernate Signed Microsoft Entries option helps you to zoom in on third-political party machine-starting images that accept been added to your system and it has support for looking at the machine-starting images configured for other accounts configured on a system. Also included in the download packet is a command-line equivalent that can output in CSV format, Autorunsc.

Y'all'll probably be surprised at how many executables are launched automatically!

Screenshot

Autoruns

Usage

Simply runAutoruns and it shows you the currently configured machine-start applications as well as the full list of Registry and file system locations available for auto-start configuration. Autostart locations displayed by Autoruns include logon entries, Explorer add-ons, Internet Explorer add-ons including Browser Helper Objects (BHOs), Appinit DLLs, epitome hijacks, boot execute images, Winlogon notification DLLs, Windows Services and Winsock Layered Service Providers, media codecs, and more. Switch tabs to view autostarts from dissimilar categories.

To view the properties of an executable configured to run automatically, select it and use theProperties menu item or toolbar button. If Process Explorer is running and there is an active procedure executing the selected executable then theProcess Explorer carte item in theEntry card will open the process properties dialog box for the procedure executing the selected image.

Navigate to the Registry or file system location displayed or the configuration of an auto-offset item by selecting the detail and using theLeapto Entry menu particular or toolbar push button, and navigate to the location of an autostart image.

To disable an auto-kickoff entry uncheck its check box. To delete an motorcar-start configuration entry use theDelete card item or toolbar button.

The Options menu includes several display filtering options, such as only showing non-Windows entries, as well as admission to a scan options dialog from where you can enable signature verification and Virus Total hash and file submission.

Select entries in theUser menu to view auto-starting images for different user accounts.

More information on brandish options and boosted information is available in the on-line help.

Autorunsc Usage

Autorunsc is the control-line version of Autoruns. Its usage syntax is:

Usage: autorunsc [-a <*|bdeghiklmoprsw>] [-c|-ct] [-h] [-thou] [-s] [-u] [-vt] [[-z ] | [user]]]

Parameter Description
-a Autostart entry selection:
* All.
b Boot execute.
d Appinit DLLs.
e Explorer addons.
g Sidebar gadgets (Vista and higher)
h Image hijacks.
i Internet Explorer addons.
chiliad Known DLLs.
l Logon startups (this is the default).
grand WMI entries.
due north Winsock protocol and network providers.
o Codecs.
p Printer monitor DLLs.
r LSA security providers.
south Autostart services and not-disabled drivers.
t Scheduled tasks.
w Winlogon entries.
-c Impress output as CSV.
-ct Print output every bit tab-delimited values.
-h Show file hashes.
-m Hide Microsoft entries (signed entries if used with -v).
-s Verify digital signatures.
-t Show timestamps in normalized UTC (YYYYMMDD-hhmmss).
-u If VirusTotal check is enabled, show files that are unknown by VirusTotal or have non-zippo detection, otherwise show only unsigned files.
-x Impress output as XML.
-v[rs] Query VirusTotal for malware based on file hash. Add 'r' to open up reports for files with non-nil detection. Files reported equally non previously scanned will be uploaded to VirusTotal if the 's' option is specified. Note scan results may not be available for five or more than minutes.
-vt Before using VirusTotal features, you must accept the VirusTotal terms of service. If y'all haven't accepted the terms and you omit this option, you will be interactively prompted.
-z Specifies the offline Windows arrangement to browse.
user Specifies the name of the user account for which autorun items will be shown. Specify '*' to browse all user profiles.
  • Windows Internals Book The official updates and errata folio for the definitive book on Windows internals, by Marker Russinovich and David Solomon.
  • Windows Sysinternals Ambassador's Reference The official guide to the Sysinternals utilities by Mark Russinovich and Aaron Margosis, including descriptions of all the tools, their features, how to use them for troubleshooting, and example existent-world cases of their apply.

Download

Download Download Autoruns and Autorunsc (three.7 MB)
Run now from Sysinternals Live.