Task Manager shows a fraction of the startup entries. Autoruns lists every Run key, service, scheduled task and shell hook, and it can hide the ones Windows actually signed.
Run **Autoruns** as administrator, hide the **Microsoft-signed** entries, then check the **Logon**, **Scheduled Tasks** and **Services** tabs. Disable first, delete only after a week without problems.
Autoruns needs elevation to read every hive and task. Options > Hide Microsoft entries and Hide empty locations cut the list from thousands of rows to something you can actually read.
Options > Hide Microsoft entries
Options > Hide empty locationsSort by publisher and look at the rows without one. A missing signature is not proof of malware, but it is the first place to look, especially when the path sits in a temporary folder.
Logon tab > Publisher, Image PathPersistence rarely lives only in the Run keys. The Scheduled Tasks tab and the Services tab hold entries that Task Manager never shows, and both hide behind a signer column of their own.
Tabs: Scheduled Tasks, ServicesRight-click a suspicious file and let Autoruns check it against an online scanner. A hash lookup settles a name you do not recognise faster than any forum thread.
Right-click > Check VirusTotalUnchecking an entry keeps the configuration intact and is undone with one click. Deleting is for entries you have identified and no longer want at all.
Reboot, open Autoruns again and compare. Entries that came back tell you more than the ones that stayed disabled, and the boot time in Task Manager gives you a rough before and after.
The Microsoft filter is off, or a driver vendor signs with its own certificate. Filter by tab and read one at a time.
A parent service recreates it. Disable the service that owns it, not the visible row.
Treat it as suspicious until proven otherwise. Check the path, the signature and the hash before touching anything else.
Re-enable the row and reboot. Autoruns changes nothing permanent until you save or delete.
Yes, it is read-mostly. Unchecking entries is reversible, and nothing is removed until you delete a row.
No. It shows persistence, which is one useful signal and not a full scan.
Re-check every entry you disabled in the same tab, then reboot. If you deleted rows, reinstall the affected application to restore its startup entries.
Free · no account needed · tracks your progress