Extra Topics (Joe’s Blog Site)

I have created an article on How to speed up boot time using Sysinternals Autoruns. I strongly suggest that you read that article first. A lot of people are asking which startup program items can be deleted or unchecked in Sysinternals Autoruns that slows down the boot sequence and those harmful items added by trojans and spywares.

Well I found a great website that have a database of startup programs. It currently has 23,403 startup items on its database at the time of this writing. It allows you to search for programs that you find starting automatically on your computer and determine if they are considered to be harmful, optional, unnecessary, or necessary to run.

The database is alphabetically organized so you can browse through using its index. You can also use its search feature to find the program you want to know.

Each entry in the database will have a Status assigned to it. The key to this status is the following:

• Y - This status flag means that this entry should be left alone and be allowed to run as if it is unchecked it may break the functionality or use of a particular program.
• N - This status flag means it is unnecessary to run this program automatically when Windows starts as you can run it manually when necessary.
• U - This status flag means it is up to you whether or not you feel this program needs to run automatically.
• X - This status flags means the item should definitely not start up automatically. Items that have this flag are generally malware such as viruses, trojans, hijackers, spyware, etc.
• ? - This status flag means the status of this entry is unknown at this time and more research is necessary.

Link to list of startup program items: http://www.bleepingcomputer.com/startups/

Usually after installing some applications in your Windows operating system, you would notice that it gets longer and longer for your Windows XP/2000/Vista to start. A lot of applications automatically adds entries to your start up list to automatically load every time you start Windows. Some of these entries are features for automatically checking the internet for updates, some are for making other applications load faster, some are for providing additional shortcuts or functions, and many more. But in most cases, you won’t need them…

You have probably used msconfig or Microsoft System Configuration Utility, (or simply System Configuration in Windows Vista) right? Using this tool, you can troubleshoot the Windows startup process. But there’s a better one. You can use Sysinternals Autoruns instead.

Sysinternals was a Web site (formerly known as “ntinternals”) operated by the company Winternals Software LP and was acquired by Microsoft on July 18, 2006.

Anyway, one of the utilities by Sysinternals is Autoruns. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.

How to use Sysinternals Autoruns

1. Go to Microsoft’s page and download Autoruns.zip from there or you can directly download Autoruns.zip from here. It’s only about 490KB.
2. After downloading, extract the zip file into a folder. The package contains 4 files, namely autoruns.chm, autoruns.exe, autorunsc.exe, and Eula.txt.
3. Now, execute autoruns.exe and wait for a few seconds while it scans your system’s registry.
   

   Autoruns initial display

   It shows you the currently configured auto-start applications in the locations that most directly execute applications.
   • Logon This entry results in scans of standard autostart locations such as the Startup folder for the current user and all users, the Run Registry keys, and standard application launch locations.
   • Explorer Select this entry to see Explorer shell extensions, browser helper objects, explorer toolbars, active setup executions, and shell execute hooks.
   • Internet Explorer This entry shows Browser Helper Objects (BHO’s), Internet Explorer toolbars and extensions.
   • Services All Windows services configured to start automatically when the system boots.
   • Drivers This displays all kernel-mode drivers registered on the system except those that are disabled.
   • Scheduled Tasks Task scheduler tasks configured to start at boot or logon.
   • AppInit DLLs This has Autoruns shows DLLs registered as application initialization DLLs.
   • Boot Execute Native images (as opposed to Windows images) that run early during the boot process.
   • Image Hijacks Image file execution options and command prompt autostarts.
   • Known DLLs This reports the location of DLLs that Windows loads into applications that reference them.
   • Winlogon Notifications Shows DLLs that register for Winlogon notification of logon events.
   • Winsock Providers Shows registered Winsock protocols, including Winsock service providers. Malware often installs itself as a Winsock service provider because there are few tools that can remove them. Autoruns can uninstall them, but cannot disable them.
   • LSA Providers Shows registers Local Security Authority (LSA) authentication, notification and security packages.
   • Printer Monitor Drivers Displays DLLs that load into the print spooling service. Malware has used this support to autostart itself.
   • Sidebar Displays Windows Vista sidebar gadgets
4. Disable or delete entries. If you don’t want an entry to active the next time you boot or login you can either disable or delete it. To disable an entry uncheck it, you can recheck it if you change your mind later. Once an item is deleted or unchecked, it is automatically applied.If you don’t know what an entry is for, you can right click and select “Search Online…”
   

   Search online if you don't know what the entries mean

5. After deleting and/or unchecking entries, there’s still one last thing to do. On the right column of each tab is the Image Path. This shows the paths where the files are located. Now, try to look for entries that says “File not found“. You’d surely find at least 5 or more. Delete these entries! These entries also slows your boot time because Windows looks for them every time you start your system but the files no longer exists.
6. Although it’s not necessary, you may Save the results later so you can Compere the results in some other time. You can compare the current Autoruns display with previous results that you’ve saved. Select File|Compare and browse to the saved file. Autoruns will display in green any new items, which correspond to entries that are not present in the saved file. Note that it does not show deleted items. See more details on the save, load, and compare feature.

That’s it!!!