# Autoruns - Sysinternals | Microsoft Learn

Here’s a concise summary of the Autoruns v14.11 article by Mark Russinovich (published Feb 6, 2024):

Overview

* Autoruns is a comprehensive Windows utility that shows programs and drivers configured to run automatically at system boot, user logon, and when launching Windows apps (Explorer, Internet Explorer, media players, etc.).
* It reports startup locations including startup folder, Run/RunOnce registry keys, Explorer shell extensions, toolbars, Browser Helper Objects (BHOs), AppInit DLLs, image hijacks, Winlogon notifications, auto-start services, Winsock providers, codecs, and more.
* The “Hide Signed Microsoft Entries” option helps focus on third‑party autostarts.
* The download includes a command-line equivalent, Autorunsc, which can output CSV and supports scanning other user accounts.

Usage (interactive Autoruns)

* Run the GUI to see autostart entries across categories using tabs (logon entries, Explorer add-ons, IE add-ons, services, scheduled tasks, etc.).
* Select an entry and use Properties to view its details; if Process Explorer is running, you can open process properties for a matching active process.
* Use Jump to Entry to navigate to the Registry or filesystem location of an autostart item.
* Disable an entry by unchecking it; delete using Delete.
* Options allow filtering (e.g., non-Windows entries), signature verification, and VirusTotal checks and submissions.
* The User menu lets you view autostarts for other user accounts.

Autorunsc (command-line)

* Autorunsc is the CLI version; usage synopsis and many parameters are provided (selection of autostart types with -a, output formats -c/-ct/-x, signature and VirusTotal options, offline system scanning, and specifying user profiles).
* Key capabilities include: selecting categories (all, boot execute, AppInit, Explorer addons, IE addons, logon, services, scheduled tasks, Winlogon, codecs, Winsock, etc.), CSV/tab-delimited/XML output, digital signature verification (-s), hiding Microsoft entries (-m), showing file hashes (-h), timestamps (-t), VirusTotal querying/uploading (-v, -vt), and scanning an offline system (-z).

Downloads and resources

* Download Autoruns and Autorunsc: <https://download.sysinternals.com/files/Autoruns.zip> (2.8 MB)
* Run from Sysinternals Live: <https://live.sysinternals.com/autoruns.exe>
* Related resources: Windows Internals Book and Windows Sysinternals Administrator's Reference (links preserved in original article).

Other

* The article includes an embedded demonstration video and links to additional training (Troubleshoot Windows startup).
* Last updated: 02/06/2024

If you’d like, I can:

* Produce a one-paragraph ultra-short summary for quick reference.
* Extract and format the Autorunsc parameter table into a compact cheat-sheet.