This is a lightweight utility from the Sysinternals family, designed for comprehensive analysis of Windows OS startup items. The program collects and displays entries from all known startup sources: the registry (Run, RunOnce, and service branches), Startup folders, Task Scheduler, shell extensions, drivers, Winsock providers, and browser add-ons. For each entry, the software displays the path to the executable file, launch parameters, publisher, and digital signature status, making it easier to decide whether to temporarily disable or remove the item. The utility is useful for reducing boot performance and investigating suspicious activity. This excellent combination of local auditing and integration with external services helps detect and neutralize malware persistence mechanisms.
Key Features
Display all autostarts from Run, RunOnce, Startup folder, services, scheduled tasks, and Winsock providers — a complete overview of autostart locations.
Display drivers and Winlogon notification DLLs, which is important for diagnosing kernel-level problems — applies to driver autoloads.
Hide Microsoft Entries filter for quickly excluding signed components — speeds up the search for third-party entries.
Integration with VirusTotal for automatic hash checking and file reputation assessment — a key tool for malware detection and threat intelligence.
Built-in digital signature verification and publisher display for each entry — the digital signature verification feature makes it easier to decide whether to delete.
Command-line version of autorunsc for batch analysis, automation, and export to CSV/XML — useful for regular command-line tool audits.
View autoruns for all users and system accounts with filtering capabilities — useful when analyzing multiple user accounts.
Snapshot compare for tracking changes after installing applications — helps with comparing snapshots and rollbacks.
Displaying paths, startup parameters, and file size is important data for manual verification and startup cleanup.
Convenient search and filters by file name, publisher, and signature.
Tools for assessing the impact on system boot and reducing startup time are useful when working with boot performance.
