Autoruns: See Everything That Starts With Windows (Without Breaking It)

There are programs running on your Windows PC that you never clicked.

They start when Windows starts or when you sign in. Some come from the Startup folder. Some from the registry, as services, or as scheduled tasks. And some sit in places normal people shouldn’t have to know exist.

That’s where Autoruns comes in. It’s a free Microsoft Sysinternals tool that shows you everything configured to start automatically. Not the cute little startup list in Task Manager. The real list. The big one. The “why is that even there?” list. Here’s how to use it without breaking your computer, because that part matters. A lot.

Prefer to watch instead of read? Here’s the full walkthrough — or skip it and keep reading below.

What Autoruns Actually Shows You

Task Manager’s Startup apps page is useful, but it’s the kiddie pool. Autoruns is the deep end. It shows startup entries from logon locations, scheduled tasks, services, drivers, Explorer and browser add-ons, Winlogon entries, codecs, print monitors, and a lot of other Windows plumbing you don’t normally see.

That doesn’t mean everything in it is bad. Autoruns isn’t a malware scanner. It’s a flashlight. You still have to use your brain before you turn things off. (If the slow PC checklist didn’t find the culprit, this is the next step.)

Step 1: Make a Restore Point, Then Download It From Microsoft

1. Create a restore point first: Start, type Create a restore point, open it, and click Create.
2. Get Autoruns only from Microsoft’s own Sysinternals page: learn.microsoft.com/sysinternals/downloads/autoruns. Not from a random driver site with seventeen blinking download buttons.
3. Extract the ZIP file, right-click Autoruns64, and choose Run as administrator so you see the full picture.

When it opens, don’t panic. Yes, it looks like Windows dumped a filing cabinet onto your screen. That’s normal.

Step 2: Make It Readable

1. Go to Options and turn on Hide Microsoft Entries.
2. Go to Options → Scan Options and enable Verify code signatures.
3. Refresh the scan.

You can also enable VirusTotal checks, but understand what that means: files get checked against VirusTotal, and depending on the option, unknown files may be uploaded. That’s usually fine on a home PC. If you work with private business or client files, slow down and think about the privacy side first.

Now you’re looking at non-Microsoft entries with signatures checked. That’s the view I want most home users to start with.

Step 3: Know What to Look For

Here’s what I check first:

• An unknown or missing publisher
• A File not found entry (leftovers from software you removed)
• Random-looking names
• Something running from AppData or Temp
• Browser helpers you don’t recognize
• Scheduled tasks from software you forgot existed

Something starting from C:\Users\YourName\AppData\Roaming isn’t automatically malware. Most normal software installs into Program Files, though, and a lot of junk and malware likes user folders because it needs fewer permissions to live there. Suspicious is enough to investigate. It’s not enough to delete.

Step 4: Disable First. Don’t Delete.

This is the most important part. Autoruns lets you disable an entry by unchecking its box, or delete it. Those aren’t the same thing.

Unchecking disables it, and you can re-check it if something breaks. Deleting removes the startup entry entirely. If you’re not absolutely sure, disable. Think of it like flipping a light switch instead of ripping the wires out of the wall.

Step 5: Work Through the Tabs in Order

Logon: things that start when you sign in. Cloud storage tools, printer utilities, chat apps, game launchers, RGB lighting software. Does your game launcher need to start every time? Probably not. Does your backup software? Probably yes.

Scheduled Tasks: a big one. Legitimate software uses scheduled tasks, and so does junk, because tasks come back after a reboot. Look for weird names, unknown publishers, missing files, and strange paths.

Services: be careful here. Security, backup, and VPN software all depend on services. Don’t go through this tab like you’re mowing the lawn. After you disable anything here, restart before you change anything else, so if something stops working you know exactly which change did it.

When you find something suspicious, right-click it. Autoruns can jump to the file, show its properties, or search online for it. Check the path, publisher, signature, and date. One stray VirusTotal detection isn’t proof. Multiple detections, plus an unknown publisher, plus a weird folder? That’s a very different conversation.

What Not to Touch

• Don’t disable your security software unless you’re deliberately replacing it.
• Don’t disable backup software unless you know it’s safe.
• Don’t disable drivers just because they look technical.
• Don’t disable Microsoft entries unless you know exactly what you’re doing.
• Don’t delete entries as your first move.

And don’t treat Autoruns as a “make my PC faster” button. Disabling junk can help startup time, but this is about understanding what starts with your computer and getting rid of what doesn’t belong. Malware wants to start with Windows. So does vendor bloat. Autoruns shows you who invited themselves to the party. (If you see something with a scary system-sounding name, here’s what svchost.exe really is.)

The Short Version

1. Make a restore point, then download Autoruns only from Microsoft.
2. Run Autoruns64 as administrator.
3. Hide Microsoft entries, verify code signatures, and refresh.
4. Check Logon, then Scheduled Tasks, then Services (carefully).
5. Research before you disable, disable instead of deleting, and restart after each change.

Stay grumpy.