The actions of users who are trying to somehow speed up the launch and operation of the version of the Windows operating system installed on the computer look quite natural. Due to the fact that the system's own resources do not allow to produce an absolutely complete and fine tuning parameters, for such purposes a lot of special applications. And one of the most interesting is Autoruns. How to use the program, using absolutely all its features in the Windows environment, will be discussed further. In addition, we will pay special attention to some important settings, since excessive enthusiasm for disabling unnecessary, as it seems to the user, system components can lead to the most unforeseen consequences.
What is the Autoruns program: the main purpose
So what is this application? Based on the official description of the developer, as well as taking into account the many reviews of users and experts, first of all, the application refers to the tools for fine-tuning the operating system in terms of activating or disabling its components, which start directly at boot, but are completely unnecessary for the average user. In addition, many note that the application can also act as a kind of informative utility, which gives the most complete reports on running services and processes. In this regard, it is somewhat reminiscent of the notorious Application Process explorer. However, few people know that this application is able to scan the system for both virus threats and the integrity, presence or absence of some important files. Thus, the Autoruns program can be called both an optimizer and an antivirus. As for the second, of course, one can argue, since the application issues notifications referring exclusively to online resources with anti-virus databases, and not to generally recognized proven tools. Nevertheless, the application quite often reveals such hidden threats that are not detected by either regular or portable anti-virus applets.
Where to download the application?
As for downloading the installation distribution, the most natural solution is to download the utility directly from the developer's site. No less often, when doing a search on the Internet, you can also find links to the Microsoft technical support service, not to mention countless resources on the Runet.
The application is distributed completely free of charge and includes two main components - Autoruns and Autorunsc (in the official release). However, only the first utility will be enough for an ordinary user.
Note: Unfortunately, official resource There is no Russian-language version of this system utility, so you will have to download the Russified modification from another source.
How to install Autoruns for Windows in Russian?
Now we assume that the installation package is fully loaded.
The latest 13.91 installer takes up just over 3.6 MB of disk space and includes the Autoruns manual as a compiled HTML help file (only in official version). The Russian-language modification consists of only one EXE file.
To install / start the program, this executable file is used, which in Windows systems version 7 and above (unless the built-in superuser login is disabled) should be run exclusively as an administrator. It is not necessary to install the Autorunsc applet from the full release, since it is designed to work using the command line, and a regular graphical interface is enough for the average user. Next, you should agree to the license agreement, after which the program starts. Note that the utility does not need to be installed in the usual sense as it is portable.
First launch and getting to know the interface
Finally, the program is launched. Now let's go directly to how to use Autoruns in Russian for Windows 7 or any other version of the system.
The main window displays all active current processes by default. Main panel includes several standard menus and special tabs that are responsible for certain settings. If you have ever used the application, the obvious similarity between Autoruns and this utility is immediately evident. The processes window opens in expanded form and contains information not only about the name of the process itself, but also about the file location, information about digital signatures of publishers, installation date (time stamp) and suspicions of the possible presence of viruses (Virus Total).
Presetting for Users Registered on the Computer
Since the instructions for Autoruns in Russian version not presented, you can download the English-language package and read it in English. If there is no such desire, let's move on to the direct configuration of the main components. First of all, you need to select a user if there are several registration records in the system. To do this, use the corresponding menu on top panel. However, if there is only one user and is, so to speak, his own administrator, this item may not be.
Basic Components of the Options Menu
When talking about how to use Autoruns.exe, there are some important parameters display of system components, processes and services. First go to the selection menu and pay attention to the default settings.
Of the first four items, it is recommended that the activated ones set aside only concealment Windows records, which will not damage the vital components of the operating system itself. Everything else can be edited, and at the same time get information about possible suspicions of viruses.
Note: not all system processes can run as administrator by default, so in the file menu of the Autoruns (File) program, any marked process or service can be run with elevated privileges.
Scan Options
Now you need to configure the scan options, which will later be applied to automatically detect problems with the ability to correct errors and failures, as well as activate additional controls.
To do this, in the same selection menu, go to the corresponding item, and in the options setting window, mark all lines except the first one so that scanning is performed not only in the location of the selected user, but also in all other places (viruses can hide anywhere). After that, you need to press the rescan button and wait for the results of the scan to appear.
Test Results
When missing objects are detected, program warnings will be issued automatically.
So, for example, when a message appears regarding the launcher of the remote Opera browser, in the example above, this indicates that there is an entry in the registry about this object, but the file itself is missing.
The results can be marked with different colors, and for them there are some numbers and numbers in the virus threat detection column. White highlighting means that everything is in order with the process, its files and additional attributes.
Pink marks objects that do not have a digital signature, and yellow marks files that are physically absent on the hard disk, for which there are entries in the registry.
In the virus scan report, the first digit corresponds to the number of suspicious threats found, and the second to total number checks. Some processes may not be viruses. In addition, it is worth considering the errors of the verification tools themselves. You can clarify the information by clicking on the selected result, after which you will be redirected to an Internet resource containing detailed description suspicious file or process.
Note: it is not uncommon to find inclusion in the risk group and some software products iObit. But it is better not to touch the optimizers, defenders and uninstallers of this developer, since they are not viruses. However, if such components have red numbers in the report, it is recommended to disable them in the startup section.
How to use Autoruns: what to remove or disable in autorun?
Now let's move on to one of the most important sections - the autostart of services and applications that start with Windows. The difference compared to the system configurator (msconfig) can be felt immediately. Autorun Manager or the autoload management tool in the described utility assumes the initial display of all processes in the main window. To deactivate an element, simply uncheck the box containing it. But how do you use Autorun Manager so you don't accidentally disable something important? By and large, you can deactivate almost everything, leaving only the command line, antivirus and components, for example, related to the operation of touchpads on laptops. But if you act wisely, it is better to disable only processes marked in pink.
To be sure, you can visit the executable applets tab at system startup. If empty locations are shown there, you can also delete them or, if necessary, find information in the online search.
Login Components
The logon tab, which corresponds to the Logon process, disables elements that the user does not need, but some of them can be disabled in the main process window. Because the Windows components are not displayed (this option was disabled at the stage presetting), you will not harm the system.
Explorer Options
But, speaking about how to use Autoruns, special attention should be paid to the parameters of the built-in file manager, known as the "Explorer". Deactivating selected components on this tab allows you to remove them from the context menu, which in the operating system itself can be done either through the registry or using third party programs. Here - optional.
Internet Explorer Options
Now a few words about how to use Autoruns in terms of browser settings. In principle, based on statistics, today few users use the built-in Windows browser IE or its more advanced counterpart Edge, so the settings presented on this tab can be left untouched (or removed altogether).
Scheduled tasks, running services, Office components, gadgets and printers
As for scheduled tasks, it is recommended to disable only those that you know. If you do not know the purpose of the process, it is better not to touch such components at all without special need. You shouldn't experiment too much with services. If such a need is already ripe, turn off, again, only those that you know or that are marked with threats. The tabs for drivers, codecs, providers, or the image are best left unedited.
But MS Office startup components can be completely deactivated, since for the most part they relate exclusively to unnecessary add-ons. Finally, if you do not use print services (no connected printers) and sidebars, all elements of the corresponding tabs can also be disabled.
And only after applying all the above settings, you can reboot the system and make sure that it starts much faster than before.
Possible errors and failures
We figured out how to use Autoruns. It remains to say a few words about possible mistakes and the consequences of disabling some processes. Many users complain that sometimes it becomes impossible to roll back Windows. Apparently, this is due just to the shutdown of the service responsible for this. When configuring, hide system components as described above. You can also find complaints about the fact that when deactivating services like Mail.Ru Agent program freezes. In this situation, it can be advised to first disable autostart in the applet itself. As a last resort, you can try to uninstall and then reinstall the program if you really need it, and it was not installed as some kind of partner software. However, other errors are corrected by similar methods.
At the same time, if you want to protect yourself from the possible consequences of applying your own settings, before using the program, make at least a backup copy of the registry using the export function in the editor itself (regedit). Restore All Windows settings from the created REG file without using automatic or manual rollback using system tools from such a copy it will be possible elementarily.
Autorun (autoload) of programs is a tool that allows you to quickly create the desired program without human intervention. working environment user by automatically starting a pre-prepared set of programs. The vast majority of modern home computers are constantly running a lot of automatically running programs, the existence of which users have no idea. As well as ideas about where these programs came from, and why they are needed at all, and who really needs them? Although, for the majority, this is not so important, until there are problems with increased consumption of resources (the computer began to “slow down”), the occurrence of exorbitant Internet traffic, advertising spam, virus infection, loss of documents, passwords, money.
With development computer technology, the possibilities of automatic launch gradually expanded and reached such a level that there was a serious need for user control over autorun processes. After all, today almost any program, from software from computer hardware manufacturers to free application software, tries to make the user happy with constant updates, discount offers when switching to paid products, advertising, etc. In addition, often such, not very desirable software, can collect information about the user himself with sending data via the Internet to no one knows who and no one knows where. Therefore, startup monitoring is becoming more and more popular among users of computer systems. Standard Tools Windows such as utility msconfig.exe or modified controller Windows tasks 10 with the “Startup” tab is better than nothing, but nevertheless, software products with the ability to monitor the maximum number of startup items that allow you to simply, conveniently and safely manage automatically starting processes from the driver to scripts or applications are becoming more in demand among competent users. programs.
General information about the Autoruns program.
autoruns- a free utility from the Sysinternals Suite section Windows Sysinternals from Microsoft, designed to control autorun in the Windows environment. The utility has a wider range of features than the utility program MSConfig, which is part of the standard Windows software.
You can download the program both as part of the Sysinternals Suite package, and separate archive from the links on the pages of the Windows Sysinternals section of the Microsoft TechNet resource. The program does not require installation in the system - just download and unzip the Autoruns.zip archive to any folder and run the executable file autoruns.exe or autoruns64.exe(for 64-bit Windows only). The archive contains documentation for English language autoruns.chm, text file with brief description and license agreement eula.txt and executable files for 32-bit and 64-bit OS GUI utilities autoruns, and command line utilities Autorunsc.
autoruns is one of the most popular software products of the Sysinternals Suite system administration and research software package, and perhaps the most informative and convenient tool for tracking automatic process start points in Windows, including hidden or unusual ones often used by viruses and other malicious software (malware). Autoruns shows you which programs are set to run at boot, user login, and other system events, with information about automatically starting programs displayed in the order in which they are started.
Finding and eliminating malware that has infiltrated the Windows environment is one of the main areas of using Autoruns.
The program allows you to get full list autostart locations, identify their location, investigate ways and sequence of launch, detect hidden entry points, and block, by choice, autostart of an unnecessary process. Huge opportunities, and ease of use of this utility, made it simply mandatory to include Autoruns in a toolkit for practical system research.
To realize the full potential of Autoruns, the utility must be run under an account with administrator rights. In addition to working in the environment of the active operating system (the OS in which you are working), you can use the utility to analyze the startup points of another OS, the system directory of which and the directory with the user profile can be selected using the main menu ( File - Analyze Offline System).
After running the executable autoruns.exe, the main program window will appear on the screen:
The program interface consists of five parts - menu bar(menu bar), toolbar(toolbar), tabs autostart source filters, output area in the form of a list with fixed elements of lines describing the automatically starting process, and an area at the bottom of the screen, with property detailing selected process.
The list of autostart points is displayed in the order in which they are processed by Windows during the boot process and user registration. By default, a tab opens. Everything with display all possible autorun points displayed in the main window in accordance with the options specified by the item Options main menu. As options (parameters for displaying information), you can select:
Include Empty Location- Show empty sections. Usually, this option is disabled.
Hide Microsoft and Windows Entries- hide autorun points for Microsoft products and Windows processes
Hide Windows Entries- hide autostart points used by Windows itself
Verify Code Signature- Check digital signatures of software modules. The verification status will be displayed in the column of the author of the program Publisher and maybe verified- has been tested and Not Verified- I failed. Internet access is required to verify digital signatures.
When you change the display settings, you need to refresh the screen (press F5).
Information about autostart points in the data window is divided into several columns
Autorun Entry- program name. Each program is accompanied by an autorun point value (registry key, autorun folder, scheduler task folder). The entry about the executable file corresponds to the flag for enabling/disabling autorun. The presence of a checkmark in front of the name means that the process will be launched, the absence - the process is blocked. If the blocked process is already running, then disabling autorun will be in effect for the next system reboot. The blocking process can be disabling a driver or service through the registry, deleting a shortcut from the startup folder, disabling the execution of a task by the scheduler.
Description - short description automatically started process.
Publisher- The author of the program. The digital signature verification flag can be displayed as part of the Publisher column (Veryfied, or Not Veryfied). The presence and validity of a digital signature is a sign that this process is not malicious. The inaccuracy or absence of a digital signature, as a rule, should draw attention to this record. However, unsigned files may not always be a virus or other unwanted software, since the existence of a digital signature is not a mandatory standard for software manufacturers.
Image Path- path and name of the executable file.
Autoruns divides all autorun items into groups corresponding to different autorun categories. The category is selected by choosing desired tab:
Everything- displays all autorun points known to the Autoruns utility.
Logon- displays information about autorun elements related to the initialization of user profile settings by the system service Winlogon(Userinit), user shell (Shell), as well as various programs launched during the registration process, using the elements of the Autorun folder, the Run, RunOnce, Load registry keys, etc. AT latest versions Autoruns item added to the main menu user, which allows you to switch to displaying autostart points for individual users, or system accounts (Local System, Network, etc.). When choosing a different type account, the list of autostart points for the "Logon" tab will change.
explorer- displays information about shell extensions (Shell Extensions) Windows Explorer, executable event handler modules (Shell Execute Hooks)
Malicious programs often use the introduction of their own entries into this group of autorun elements, which provide the ability to control the infected system. The most common cases:
Adding an entry to the registry key to autorun programs for the current user
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Same trick for all users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Adding a file or a link to a virus file in the "Startup" folder
- Adding an entry to the parameters section of the Winlogon service
The registry key is used to initialize the user profile
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit standard accepting a string value
C:\WINDOWS\system32\userinit.exe
The key contains a comma at the end of the entry, and Windows will automatically start any programs that are listed after this comma. So, for example, the entry C:\WINDOWS\system32\userinit.exe,%TEMP%\svchost.exe in addition to the standard userinit.exe program, it will also launch svchost.exe, which in no way can be located in the \TEMP temporary files folder and generally run from this group of autorun points. Everything written after userinit.exe must be removed - these entries provide the launch of malicious programs.
userinit.exe executes the user profile initialization sequence and launches the shell (shell), which in the Windows environment is used Explorer (Explorer.exe). Explorer implements GUI user (GUI) - desktop, tools for working with shortcuts, folders, files, etc. If Explorer.exe fails to start, then the user gets a blank desktop without any controls.
To start the user shell, data from the registry key is used
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell The standard string value of this key is - Explorer.exe. If it is different, then it is most likely viral infection.
Malicious programs can also use one-time autostart points (RunOnce, RunOnceEx parameters), overwriting the contents of these registry keys after each reboot or user registration.
Additional information about a suspicious file can be obtained by using the search mechanism on the Internet (Menu Entry - Search Online) or using the context menu of the right mouse button. And the easiest way is to send the suspected file to be checked by online scanners. For example, to the site VirusTotal.com
Internet Explorer - displays a list of browser helper objects (BHO - Browser Helper Objects), elements of the Internet Explorer (IE) control panel, registered ActiveX controls, additional modules (plugins) built into the Internet browser (browser).
Exploiting vulnerabilities in Internet browsers is one of the most common methods of virus infection. The modern browser is actually complex software package, a kind of interpreter of the content obtained from the pages of visited sites, and in addition, it is a software product, the properties of which can be extended or changed using settings and additional software modules, including those introduced by third-party developers. These properties of Internet browsers are also used by malware creators. In addition to viruses, various unwanted software modules, performing the substitution of the search engine, downloading ads, tracking user actions, substituting the home page, etc. In most cases, a symptom of unwanted software is an unknown publisher, information about which is displayed in the field Publisher.
Services- displays a list of system services automatically loaded by Windows. System services (services) are loaded before user registration in accordance with the settings defined by registry keys
HKLM\SYSTEM\CurrentControlSet\Control
HKLM\SYSTEM\CurrentControlSet\Services
Services that do not have a description, a digital signature, or an invalid digital signature should be checked first. An additional sign of unreliability can be the start of a service from unusual place- temporary files directory \TEMP, user profile directories, directory with a strange name. The executable files for the vast majority of system services are located in the \WINDOWS\System32 folder.
Drivers- displays a list of drivers that are allowed to run (parameter start in the registry key related to the driver is not equal to 4 which means disabling the driver.) Sometimes there are serious viruses that use rootkit technology to mask their presence in the system. In the event of such an infection, malware installs a special driver that intercepts system calls and corrects the results of their execution in such a way as to exclude detection of its files, processes, network connections. In severe cases, Autoruns will not help and you will need to use special software to detect rootkits
Scheduled Tasks- displays a list of tasks scheduled for execution by the scheduler (Task Scheduler).
Sometimes malware makes it possible to launch itself by creating a special task for the Windows Task Scheduler. The Autoruns utility allows you to get a list of tasks and disable any of them.
Image Hijacks- displays information about the use of the symbolic debugger of individual processes, the list and parameters of which are set in the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Also, autorun points are displayed, where it is possible to start executable files in addition to the command interpreter (command processor), and when opening any files with the .exe extension
Appinit DLLs- a list of all DLLs registered in the system is displayed. Used to connect user libraries loaded using user32.dll
Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls usually does not contain any entries, but can be used by legitimate programs as well as malware, since this ensures that its DLL is injected into all user processes using the user32.dll call. If the key contains the name of some dll, you need to analyze the information about the publisher, digital signature, and, if necessary, execute online check on VirusTotal.
Known DLLs- a list of DLLs that are loaded into application programs that reference them.
The search for malicious DLLs can be performed using the same algorithm - analysis of the description, information about the publisher, the presence and reliability of a digital signature, and, if necessary, a check on VirusTotal.
Boot Execute- programs that must be executed early in Windows boot (e.g. a scheduled disk check on the next system reboot)
Winlogon Notifications- a list of DLLs that are registered to fire on events related to user login or logout (logon/logoff), splash screen startup, shutdown, or reboot.
Winsock Providers- list of providers Windows services to access network functions. Usually, these are DLLs that can be loaded for applications to interact with network services. Sometimes the antivirus or firewall libraries may be listed.
LSA Providers- List of registered LSA (Local Security Authority) providers. The LSA is part of a system for checking user credentials and assigning a Security Context based on the user's account.
Print Monitors- a list of printer drivers that are loaded according to entries in the registry key
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
Sidebar Gadgets- list of gadgets installed by users of Windows 7 and later OS
office- information about additional modules of office software.
The main menu (menu bar) of the Autoruns program.
The purpose of some menu items of the Autoruns utility is discussed above.
Main menu items file
find- search for text in the current Autoruns output window.
load- open a previously saved Autoruns report from a file
Save- save the current Autoruns log.
Compare- comparison of the current Autoruns report with the previously saved one. Allows you to quickly identify new autorun items that have appeared since the compared report was saved. New items are highlighted in green.
Main Menu Items Entry
All menu items Entry refer to the highlighted report item on the current Autoruns screen. All options are also available from the right-click context menu.
Delete- Remove the autorun item. It is not possible to restore a deleted item using the Autoruns utility itself. Thoughtlessly deleting critical startup items can lead to a system crash. In order not to delete an element, but only to block it, you need to reset the checkbox (uncheck) in the first column of the line of this element.
Copy- Copying the data of the selected line to the clipboard.
Verify- Check the digital signature of the selected element.
jump to- as in most Sysinternals products, allows you to quickly navigate to that registry key or Windows directory The that is associated with this autostart point. A very convenient mode that allows you to save time and nerves when analyzing information. The transition can also be performed by double-clicking on the selected element.
Search Online- Autoruns will launch a web browser and use it to search for information about the autorun point associated with the current report item. The search mechanism is used, to which we configure the browser, for example, Yandex search
Properties- Display the properties of the executable file of the automatically started process.
Process Explorer- Run the utility Process Explorer from Sysinternals to monitor the activity of the selected process. Process Explorer must be present and must be able to be launched using the path in environment variable path
Autorunsc is a variant of Autoruns for use on the command line.
Autorunsc is a variant of the Autoruns program for running in command line. It is convenient to use for collecting and processing data about automatically starting processes on remote computers, for tracking changes in autorun, etc.
Command line format:
autorunsc [-a[*][b] [c] [d] [e] [g] [h] [i] [k] [l] [-m] [-o] [-p] [-r] [-s] [-v] [-w] [[-z
Command line options:
| * | show all elements; |
| -b | objects executed in the early stages of loading; |
| -c | write the output to a CSV file; |
| -d | application initialization DLLs; |
| -e | Explorer add-ons; |
| -g | mini-applications (gadgets) of the sidebar; |
| -h | image file interceptors (Image hijacks); |
| -i | additional components of Internet Explorer |
| -l | Items that automatically start when you log in (this setting is the default) |
| -m | do not show items that are digitally signed by Microsoft; |
| -n | Winsock protocol providers; |
| -p | print monitor drivers; |
| -r | LSA providers; |
| -s | services in autostart mode and non-disabled drivers; |
| -t | assigned tasks; |
| -v | verify digital signatures; |
| -w | Winlogon elements; |
| -x | print output in XML format; |
| -z | set an inactive Windows system for scanning; |
| user | show automatically launched objects for the specified user account. |
Examples of using:
autorunsc /?- display a hint on using the program.
autorunsc –a *- display all autorun items in this system.
autorunsc64.exe -a * |find /i "adobe"- display all startup items associated with Adobe software products.
autorunsc –a b- display autorun items related to the boot of this system.
autorunsc -s *- display information about automatically starting services and drivers.
autorunsc –s * > services.txt- the same as in the previous example, but with the results written to a text file.
autorunsc64.exe -aw -m- display information about startup items for Winlogon, excluding entries for Microsoft software products.
autorunsc64.exe -aw -x- the same as in the previous example, but with the presentation of the results in XML format.
One of the main purposes of Autoruns is to find and neutralize malicious software. Powerful capabilities for researching and neutralizing autorun elements make it easy to deal with an infection that has infiltrated the system. Any virus that is deprived of the ability to automatically run becomes completely harmless, just like a regular text file stored on a computer.
When in doubt about any of the autorun items listed in the Autoruns output list, try to investigate it in detail using the following techniques:
Review the description, publisher information, and the presence and validity of the digital signature.
- Perform double click by the element under investigation and check its autostart point in the registry or file system directory.
- Use context menu Search Online or the keyboard shortcut CTRL+M for more information on web search results.
- If you have a saved log of previous sessions - compare the current data with the saved ones (menu File Compare).
- Submit the file for online verification by VirusTotal.com. If the file is malicious, it is highly likely that the VirusTotal service will confirm this fact.
- For detailed analysis activity of a suspicious process, use a related utility from Sysinternals. You can use the direct call of the utility through the context menu item for the selected startup item.
Today, Autoruns, supported by developers for many years, is one of the most effective programs to control startup. However, real-time startup monitoring programs are becoming more and more popular. Such programs run automatically and constantly monitor the status of startup items, taking action when any software tries to "register" for automatic start. It is clear that the main disadvantages of such programs are the increased consumption of system resources and the impossibility of full control of all autorun elements. An example of monitoring programs can be free Anvir Task Manager, characterized by increased resource consumption, and less voracious, but significantly inferior in capabilities PT Startup Monitor .
In this tutorial, we will learn how to work with the Autoruns program.
Autoruns is a utility with which you can manage automatic loading drivers, service programs and other system components. That is, with this utility you can add or remove certain programs that start automatically when the Windows operating system boots.
1. First, let's run .exe file autorun utilities. As you can see in the image below, I have it called "Autoruns_Rus_Setup". It may be called differently for you, but the label next to the file name will be the same for everyone.
2. The window “ AutoRuns License Agreement". Click the button To accept».
3. Next, the main window will open in front of you, in which you can see all the programs, modules, system services, and drivers running on your PC.
4. As you can see from the photo below, you can use tabs that sort running services into sections.
5. In order to find out the properties of any object, just click on it with the left mouse button and in the lower left corner of the utility you will see: the size of the object, time and date of creation, version, file (object) location path.
Certain advice about which program, module, driver, etc. delete from startup, and I won’t leave you one, because this is an individual approach and should be repelled from your preferences, specifications PC. It's best to prioritize and leave only those items on the list that you use from the very beginning of Windows boot.
6. In order to remove a program from autorun, right-click on it and select " Delete».
7.Next, a new window will appear asking you to confirm if you agree to delete the autorun entry. Just click " Yes».
With the help of such simple manipulations, you can significantly speed up the loading of your Windows operating system (reduce boot time), by getting rid of desired programs, services, etc. Just pay close attention to this matter.
Thank you for your attention. The basic basics of using the AutoRuns utility are considered.
auto run is a program used in some versions of the operating system Windows systems and which allows the system to automatically install new program for the user. Unlike earlier versions of the OS and some other OS programs that require the user of the computer to actively make an effort to install the program on the computer. Process autorun commonly used for compact discs (CDs) or other hardware that is used to install a program on a computer. auto run allows you to detect the presence of installation on such hardware, and then allows the program to be easily installed on the computer.
Sometimes used as a synonym for AutoPlay, Autoload is not the same thing. AutoPlay was synonymous with early versions of OS programs, but it has since been organized as a standalone feature for automatically playing media files. auto run , on the other hand, for automatic installation programs and does not affect discs or other formats that contain multimedia data such as videos and music.
When the device is connected to a computer that contains programs such as a CD inserted into the drive on the computer or a USB flash drive in USB port on the computer, then the computer's operating system will usually detect that the device is. This causes a notification to be sent to the OS, which in turn starts the autorun process. The process starts by detecting the OS autorun mode if it is disabled on the computer; if so the process must go on.
As long as autorun is enabled on the computer, the operating system looks for the file auto run in the root directory of the program on the media. This file allows the OS to easily run and install the program. Typically, a pop-up window will appear on the user's desktop indicating that the program will install automatically, allowing the user to cancel or approve the installation. In addition, the user does not have to interact with the installation of the program, although most programs will also provide license agreement with the end user (EULA), which must be accepted and may allow the user to change some aspects of the installation.
Without this capability in the computer's OS, programs must be installed manually. Some users prefer to install programs manually, which allows them more control over where and where the program will be installed, and usually does not require much effort. In earlier versions of the OS, however, the benefits of automatic installation were much greater, and the process was introduced to reduce technical support to customer questions regarding software installation.
Of those programs that you quickly get used to, they are so useful. The utility not only helps to manage startup applications, but also allows you to solve a number of problems typical of computers running Windows control.
The secret behind Autoruns' success is very simple: it combines the functionality of the Task Manager and the Services utility with some additional features in one convenient application.
Unfortunately, many users do not know about Autoruns or simply do not know how to use this utility. For those who met with Autoruns for the first time - or just want to brush up on already known information - I offer five useful tips on using this tool.
1. Don't rely solely on Autoruns to protect you from online threats
Yes, Autoruns allows you to prevent malware from automatically running, spyware and some viruses, but this does not mean that the utility can provide comprehensive system protection against cyber threats. In fact, Autoruns should not be considered a security tool at all. The program can temporarily help protect against viruses and malware, but is not able to prevent their penetration into the system. The only truly sane way to use Autoruns to fight viruses is to temporarily disable suspicious applications and remove them later.
2. Use Autoruns to manage startup programs
It makes no sense to add and remove programs from the "Startup" folder (Startup) manually if there are Autoruns. The utility copes with this task much more efficiently. With Autoruns, you can view a list of all running programs and enable or disable unnecessary ones. This does not remove disabled applications from the list, so it is very easy to re-enable them later. This eliminates the need to look for the program's executable file and create a shortcut in the Startup folder. In addition, Autoruns allows you to manage applications that are normal mode hidden from the user.
3. Use Autoruns to Manage Internet Explorer Add-ons
Some Internet Explorer add-ons can disrupt the normal operation of the system, and I have had to deal with such situations more than once. The easiest way to disable a broken toolbar or plugin is through Autoruns. This is especially useful if the add-on is preventing IE from launching. Just open Autoruns, go to the "Internet Explorer" tab and disable the suspicious plugin. If you don't know which add-on is causing the problem, disable all but one of them and try running . If the browser does not start, then this add-on is to blame. Disable it, enable all the others and restart IE, and remove the faulty plugin or try reinstalling it.
4. Look for help information on the Internet
Autoruns has a great built-in search feature that allows you to highlight an item and search the web for related information. This is especially true if no information about the process is specified (except perhaps a registry key, and that's it). Before taking any action, right-click on the item and select the "Search Online" option. Autoruns will redirect you to a browser with a list of search results for the exact object name. This will help you understand exactly what function this process performs. For example, on the tab "Everything" (All) there is an object "pku2u.dll". If you select it and use an Internet search, you can find out that this DLL is an integral component, which means that you should not remove or disable it.
5. Save your settings
I use the save, load and export feature of Autoruns very often.
This allows you to apply different startup configurations on the same computer. To take advantage of this feature, configure Autoruns to perform a specific task and save the configuration via the File | Save" (File | Save). The settings will be saved in a file with the extension ".arn". To load a specific configuration, use the File | Open” (File | Open) and select desired file settings. Be sure to keep at least one file with a verified working Autoruns configuration in stock. It is useful not only for restoring settings in case of any failure, but also for comparing with the current configuration, which can be done using the “File | Compare" (File | Compare). Select a file to compare and click Open. All new objects that are not present in the original configuration will be highlighted in green. This is very convenient because it allows you to quickly remove unnecessary objects that are not in the checked configuration.
Lifesaver
The Sysinternals Autoruns utility should be in the arsenal of every self-respecting administrator. It not only helps fight malware and viruses, but also allows you to fine-tune applications in Windows startup. When used properly, Autoruns helps keep the system running smoothly.