Autoruns — The Ultimate Startup Manager, Not a Single One Missed
In a word: The most well-known startup item management tool from Microsoft’s Sysinternals suite, showing all programs that auto-start with Windows — covering 20+ startup points including logon items, services, scheduled tasks, browser plugins, drivers, codecs, known DLLs, and more. Completely free, helps you discover hidden auto-start programs deep in your system.
Have You Also Experienced “Slow Boot But Don’t Know What’s Causing It”?
Scenario 1: Your computer takes 2 minutes from pressing the power button to being able to use the desktop. You only have a few icons in your system tray — QQ, WeChat, input method — looks normal. But you don’t know that there might be dozens of “invisible” startup items ruthlessly slowing down your boot time.
Scenario 2: You suspect your computer has malware or rogue software — it runs automatically every time you boot. You open Task Manager’s “Startup” tab and only see a few normal startup items. But you know malware can hide in services or scheduled tasks — things Task Manager can’t see.
Scenario 3: You see a startup item called “Helper Service” — you’re not sure if it’s legitimate software (like a graphics driver helper service) or malware. You want to quickly check its file path, digital signature, and search for information online.
Autoruns is designed for these “comprehensive startup item investigation” scenarios — Task Manager’s “Startup” tab only shows 1 out of 20+ startup points. Autoruns shows them all.
What Is Autoruns?
Autoruns is a startup item management tool from Microsoft’s Sysinternals suite, from the same team as Process Explorer. Its function is extremely focused: shows all programs registered to “auto-start with Windows.”
Windows has 20+ ways to auto-start:
- Registry startup items (RUN keys, RunOnce, etc.)
- Windows Services
- Scheduled Tasks
- Startup Folders
- Browser Helper Objects and Extensions
- Drivers
- Winlogon Shell/Notify
- AppInit DLLs
- Known DLLs
- Codecs
- …
Task Manager monitors only 1 of these (registry RUN keys + startup folders). Autoruns monitors all 20+.
It doesn’t monitor “how much memory a startup item uses” — that’s Task Manager’s job. Autoruns does only one thing: lists all programs that run automatically at startup, letting you decide whether to “keep” or “disable.”
Core Features
1. 20+ Startup Category Tabs — Sees 20x More Than Task Manager
Autoruns’ main interface has multiple tabs, each corresponding to a startup point category:
| Tab | What It Shows | Can Task Manager See It? |
|---|---|---|
| Everything | Consolidated view of all startup items (default) | Only a small portion |
| Logon | Programs that start at login (RUN keys) | Yes |
| Scheduled Tasks | Tasks triggered at specific times/events | No |
| Services | Windows services set to auto-start | No |
| Winlogon | DLLs loaded by the Winlogon process | No |
| Boot Execute | Programs executed at system boot | No |
| Image Hijacks | Image hijack points — can be exploited by malware | No |
| AppInit | DLLs loaded into all processes | No |
| Known DLLs | DLLs already loaded by the system | No |
| LSA Providers | Security authentication providers | No |
| Winsock Providers | Network service providers | No |
| Print Monitors | Print monitoring drivers | No |
| Browser Helper Objects | IE/Edge browser helper objects and plugins | No |
The “Everything” tab merges all content together — this is the most commonly used view. You can browse all startup items at once.
2. Detailed Information for Each Startup Item — Far Beyond “Disable Startup”
Autoruns displays the following information for each startup item:
| Column | Description |
|---|---|
| Name | Startup item name |
| Description | Description (from file version info) |
| Publisher | Publisher/company name |
| Image Path | Full exe/DLL file path |
| Entry Location | Registry path or startup folder location |
| Entry | Registry key value name |
| Enabled/Disabled | Whether currently enabled |
| Launch Time | When during boot phase it starts (some items only) |
File path is the most important information — if a startup item claims to be “Microsoft Windows Update” but its path is in C:\Users\xxx\AppData\Local\Temp\ — it’s almost certainly malware.
3. Signature Verification and Online Search — Quickly Judge if It’s “Good”
Autoruns’ status column uses colors and markers to help you judge:
| Status Marker | Meaning |
|---|---|
| Normal | File exists + digital signature valid + from trusted publisher |
| Not Verified | File exists + no digital signature |
| File Missing | Startup item registered, but the referenced exe doesn’t exist (software uninstalled but startup item remains) |
| Yellow | Suspicious — no signature or publisher info |
Right-click a startup item → select Search Online → automatically opens a browser search for that file name (helps you quickly check “why is svchost.exe starting here?”).
Practical usage: For every “suspicious-looking” startup item → right-click → Search Online → check if the result is malware → if yes → disable + delete file.
4. Disabling Is Not “Deleting” — Can Be Reverted at Any Time
Autoruns’ “disable” is simply unchecking:
- Uncheck → startup item is commented out, won’t run next boot
- Re-check → restores normal startup
- Delete → permanently removes from registry (recommended to disable first, confirm no issues, then delete)
“Disable first, confirm no issues, then delete” — this is the best practice for using Autoruns.
Professional Media and User Reviews
| Source | Review |
|---|---|
| TechSpot | ”Autoruns is the definitive tool for managing startup programs — nothing else comes close to its comprehensive coverage of every autostart location” |
| CNET | ”The most thorough startup manager available for Windows — shows you every program that runs automatically, even those hidden deep in the system” |
| How-To Geek | ”If you want to speed up your Windows boot time, Autoruns is the first tool you should reach for — it reveals startup entries that Task Manager misses” |
What Real Users Say
“After using Autoruns, I discovered my computer had over 70 startup items! Task Manager only showed 8. The ‘Everything’ tab listed services, scheduled tasks, drivers… all invisible. After disabling the unnecessary ones, boot time dropped from 2 minutes to 45 seconds. I had no idea there were so many ‘hidden auto-start’ items on my computer.” — Software Engineer, Zhihu
“Every time I help a friend fix their computer, I first scan with Autoruns — then disable all kinds of junk startup items. Some software’s auto-update services, input method background processes, even malware startup items. Autoruns’ ‘File Missing’ column (red marker) is especially useful — it directly tells you which startup items reference programs that no longer exist. Those are residual entries from software that was uninstalled but left behind.” — IT Operations, V2EX
“When investigating malware, Autoruns is essential. Once I found a startup item under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run with the path C:\Windows\svchost.exe — but the real svchost.exe is at C:\Windows\System32\svchost.exe. The path didn’t match, immediately identifying it as an imposter.” — Security Researcher, Zhihu
Comparison with Similar Tools
| Dimension | Autoruns | Task Manager (Startup) | CCleaner (Startup) |
|---|---|---|---|
| Price | Completely Free | System Built-in Free | Free/Pro $29.95 |
| Developer | Microsoft Official (Sysinternals) | Microsoft | Piriform/Avast |
| Startup Points Covered | ⭐⭐⭐⭐⭐ 20+ types | ⭐⭐ 1 type | ⭐⭐⭐ 3-4 types |
| Number of Items Shown | All (70-200+ startup items) | Several to a dozen | Dozens |
| View File Path | Yes, full path | Yes | Yes |
| Verify Digital Signature | Yes Exclusive | No | No |
| Online Search | Yes, right-click Search Online | No | No |
| Disable/Restore | Yes, toggle checkbox | Yes, enable/disable | Yes, disable/restore |
| Portable Version | Yes (Recommended) | N/A | No |
| Installation Required | No, run directly | System built-in | Yes |
Selection advice:
- Most comprehensive + Most professional → Autoruns (Microsoft official, ultimate startup item manager)
- Quick disable of a few common startup items → Task Manager (Ctrl+Shift+Esc → Startup tab)
- Clean residual startup items + uninstalled software leftovers → CCleaner’s startup manager (Tools → Startup)
- Autoruns is not for “disabling QQ/WeChat auto-start” — it’s for finding “hidden startup items you didn’t know existed.”
Download and Installation Guide
Official Download
Autoruns is part of the Sysinternals suite, distributed through official Microsoft channels:
| Channel | Download Address | Notes |
|---|---|---|
| Microsoft Official (Recommended) | learn.microsoft.com/sysinternals/downloads/autoruns | Direct download autoruns.zip |
| Sysinternals Suite | Download the full suite | Contains Autoruns + Process Explorer + 60+ tools |
Safety Note: Autoruns is a free tool published by Microsoft. No installation required, run directly. The ZIP download is about 1.5MB. Extract and run
autoruns64.exe(for 64-bit systems).It will prompt you to accept the EULA — click “Agree.”
Strongly recommended to run as Administrator: Right-click → Run as administrator. Otherwise, many system-level startup items won’t be displayed or manageable.
Usage Recommendations
- First use: Open → wait for auto-scan (about 5-15 seconds) → see the complete startup item list
- Disable startup items: Uncheck the corresponding entry (not delete — can be re-checked to restore at any time)
- Find suspicious startup items: Sort by the “Publisher” column → look for entries without signatures or unknown publishers
- Delete residual items: See red markers (file missing) → select and press Delete to remove registry residue
- Use “Hide Microsoft Entries”: Check menu “Options” → “Hide Microsoft Entries” → only show third-party startup items, reducing clutter
FAQ
Q: What’s the difference between Autoruns and Task Manager’s startup management? A: Task Manager can only see the most common 1 type of startup point (registry Run keys + startup folders). Autoruns can see 20+ types — including services, scheduled tasks, Winlogon, AppInit DLLs, browser plugins, etc. A typical computer will show 80-200 startup items through Autoruns (including system built-in ones), while Task Manager only shows 5-15.
Q: Will disabling system built-in startup items with Autoruns cause problems? A: Disabling system service startup items may cause corresponding features to stop working. If you’re not sure whether a startup item’s “Publisher” is Microsoft or a third party — first use Autoruns’ “Hide Microsoft Entries” feature to hide Microsoft’s own items, showing only third-party items. This prevents accidentally disabling critical system services. Beginners should only disable red-marked “File Missing” items — these are residuals from uninstalled software, safe to disable.
Q: Can Autoruns help with antivirus? A: It can help discover suspicious programs, but cannot replace antivirus software. Autoruns can: ① Show all startup items for you to judge which are suspicious; ② Right-click → Search Online to look up file information; ③ Verify digital signatures to determine source. But it won’t actively “alert” you. If you find a suspicious startup item — disable it and run a full antivirus scan.
Q: With all these startup items listed, will my computer be faster? A: Disabling unnecessary third-party startup items → boot speed will noticeably improve. Disabling system services → may not noticeably improve speed and could cause feature loss. A typical office computer has 80+ startup items, about 50 from the system and 30 from third parties. Disabling about half of those 30 unnecessary third-party ones can reduce boot time by 30-50%.
Q: Does Autoruns have a portable version? A: Yes, it’s portable software. Download the ZIP, extract to any folder, and run directly. To remove, simply delete the entire folder. This is standard for Sysinternals tools.
Autoruns is the “searchlight” of startup management — Task Manager’s little flashlight only illuminates the tip of the iceberg (logon startup items), while Autoruns’ powerful beam lights up the entire iceberg (services, scheduled tasks, drivers, AppInit DLLs…). For the two scenarios of “investigating slow boot” and “suspecting malware auto-running,” Autoruns is the only tool that gives you the complete answer.