Usually after installing some applications in your Windows operating system, you would notice that it gets longer and longer for your Windows XP/2000/Vista to start. A lot of applications automatically adds entries to your start up list to automatically load every time you start Windows. Some of these entries are features for automatically checking the internet for updates, some are for making other applications load faster, some are for providing additional shortcuts or functions, and many more. But in most cases, you won’t need them…
You have probably used msconfig or Microsoft System Configuration Utility, (or simply System Configuration in Windows Vista) right? Using this tool, you can troubleshoot the Windows startup process. But there’s a better one. You can use Sysinternals Autoruns instead.
Sysinternals was a Web site (formerly known as “ntinternals”) operated by the company Winternals Software LP and was acquired by Microsoft on July 18, 2006.
Anyway, one of the utilities by Sysinternals is Autoruns. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.
How to use Sysinternals Autoruns
- Go to Microsoft’s page and download Autoruns.zip from there or you can directly download Autoruns.zip from here. It’s only about 490KB.
- After downloading, extract the zip file into a folder. The package contains 4 files, namely autoruns.chm, autoruns.exe, autorunsc.exe, and Eula.txt.
- Now, execute autoruns.exe and wait for a few seconds while it scans your system’s registry.
It shows you the currently configured auto-start applications in the locations that most directly execute applications.
- Logon This entry results in scans of standard autostart locations such as the Startup folder for the current user and all users, the Run Registry keys, and standard application launch locations.
- Explorer Select this entry to see Explorer shell extensions, browser helper objects, explorer toolbars, active setup executions, and shell execute hooks.
- Internet Explorer This entry shows Browser Helper Objects (BHO’s), Internet Explorer toolbars and extensions.
- Services All Windows services configured to start automatically when the system boots.
- Drivers This displays all kernel-mode drivers registered on the system except those that are disabled.
- Scheduled Tasks Task scheduler tasks configured to start at boot or logon.
- AppInit DLLs This has Autoruns shows DLLs registered as application initialization DLLs.
- Boot Execute Native images (as opposed to Windows images) that run early during the boot process.
- Image Hijacks Image file execution options and command prompt autostarts.
- Known DLLs This reports the location of DLLs that Windows loads into applications that reference them.
- Winlogon Notifications Shows DLLs that register for Winlogon notification of logon events.
- Winsock Providers Shows registered Winsock protocols, including Winsock service providers. Malware often installs itself as a Winsock service provider because there are few tools that can remove them. Autoruns can uninstall them, but cannot disable them.
- LSA Providers Shows registers Local Security Authority (LSA) authentication, notification and security packages.
- Printer Monitor Drivers Displays DLLs that load into the print spooling service. Malware has used this support to autostart itself.
- Sidebar Displays Windows Vista sidebar gadgets
- Disable or delete entries. If you don’t want an entry to active the next time you boot or login you can either disable or delete it. To disable an entry uncheck it, you can recheck it if you change your mind later. Once an item is deleted or unchecked, it is automatically applied.If you don’t know what an entry is for, you can right click and select “Search Online…”
- After deleting and/or unchecking entries, there’s still one last thing to do. On the right column of each tab is the Image Path. This shows the paths where the files are located. Now, try to look for entries that says “File not found“. You’d surely find at least 5 or more. Delete these entries! These entries also slows your boot time because Windows looks for them every time you start your system but the files no longer exists.
- Although it’s not necessary, you may Save the results later so you can Compere the results in some other time. You can compare the current Autoruns display with previous results that you’ve saved. Select File|Compare and browse to the saved file. Autoruns will display in green any new items, which correspond to entries that are not present in the saved file. Note that it does not show deleted items. See more details on the save, load, and compare feature.
That’s it!!!










