C
CoMa
Autoruns
http://www.sysinternals.com/Utilities/autoruns.html
This utility, which has the most comprehensive knowledge of auto-starting
locations of any startup monitor (A starting list of auto-run locations was
obtained from David Solomon's "Windows Internals" seminar), shows you what
programs are configured to run during system bootup or login, and shows you
the entries in the order Windows processes them. These programs include
ones in your startup folder, Run, RunOnce, and other Registry keys. You can
configure Autoruns to show other locations, including Explorer shell
extensions, toolbars, browser helper objects, Winlogon notifications,
auto-start services, and much more. Autoruns goes way beyond the MSConfig
utility bundled with Windows Me and XP.
Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on
third-party auto-starting images that have been added to your system and it
has support for looking at the auto-starting images configured for other
accounts configured on a system. Also included in the download package is a
command-line equivalent that can output in CSV format, Autorunsc.
You'll probably be surprised at how many executables are launched
automatically!
Autoruns works on all versions of Windows including Windows XP 64-bit
Edition (for x64) and Windows Server 2003 64-bit Edition (for x64).
What's new
Autoruns v8.3
Another Autoruns update adds print monitor DLLs and Explorer column
handlers - both of which have been used by real malware - and dramatically
improves scan times when image verification is selected.
http://www.sysinternals.com/Utilities/autoruns.html
This utility, which has the most comprehensive knowledge of auto-starting
locations of any startup monitor (A starting list of auto-run locations was
obtained from David Solomon's "Windows Internals" seminar), shows you what
programs are configured to run during system bootup or login, and shows you
the entries in the order Windows processes them. These programs include
ones in your startup folder, Run, RunOnce, and other Registry keys. You can
configure Autoruns to show other locations, including Explorer shell
extensions, toolbars, browser helper objects, Winlogon notifications,
auto-start services, and much more. Autoruns goes way beyond the MSConfig
utility bundled with Windows Me and XP.
Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on
third-party auto-starting images that have been added to your system and it
has support for looking at the auto-starting images configured for other
accounts configured on a system. Also included in the download package is a
command-line equivalent that can output in CSV format, Autorunsc.
You'll probably be surprised at how many executables are launched
automatically!
Autoruns works on all versions of Windows including Windows XP 64-bit
Edition (for x64) and Windows Server 2003 64-bit Edition (for x64).
What's new
Autoruns v8.3
Another Autoruns update adds print monitor DLLs and Explorer column
handlers - both of which have been used by real malware - and dramatically
improves scan times when image verification is selected.