Using Autoruns to Disable Malware Entries That Survive Reboots

Malware often returns after a computer restarts because an automatic launch mechanism remains active. A trojan may create a registry run entry, scheduled task, service, browser helper, or startup shortcut that quietly reloads the malicious file each time Windows starts.

Microsoft Sysinternals Autoruns provides a detailed view of these persistence points. Unlike the basic Startup tab in Task Manager, it displays many additional locations used by legitimate software and potentially unwanted programs. Used carefully, it can help identify and disable malware entries that survive reboots without immediately deleting files.

Autoruns is a powerful diagnostic utility, not an automatic malware-removal tool. An unfamiliar entry is not necessarily dangerous, and disabling the wrong Windows component can cause instability. The safest approach combines Autoruns with file scans, publisher verification, restore points, and careful restart testing.

What Autoruns Reveals

Autoruns examines startup folders, registry keys, scheduled tasks, Windows services, drivers, codecs, explorer extensions, and other auto-start locations. Its tabs help narrow the investigation, especially when a suspicious process appears again after it was terminated.

The “Logon,” “Scheduled Tasks,” “Services,” and “Drivers” tabs are especially important during malware cleanup. Adware and browser hijackers may use logon entries or extensions, while ransomware and banking trojans can establish services or scheduled tasks for more persistent access. A credential-stealing infection may require broader investigation, such as the steps described in this banking Trojan guide.

Prepare Before Making Changes

Download Autoruns from the official Microsoft Sysinternals source and extract it to a known folder. Right-click the appropriate executable, usually Autoruns64.exe on a modern 64-bit Windows installation, and select “Run as administrator.” Administrative access allows the utility to display and manage protected startup locations.

Before changing entries, create a restore point and record the suspicious item’s name, location, command line, publisher, and timestamp. If the computer is unstable or the infection is actively running, disconnect it from the internet and perform an offline or reputable antivirus scan first. Do not enter passwords or access sensitive accounts until the system is considered clean.

In Autoruns, enable “Hide Microsoft Entries” to reduce clutter, but treat this as a filtering aid rather than proof that everything remaining is malicious. You can also enable signature verification and check selected entries with VirusTotal when available. These features improve triage but should not replace examining the file path and digital signature.

Read Startup Entries Carefully

Investigate the full command line instead of relying only on the displayed entry name. Malware frequently imitates legitimate software with names such as “Windows Update,” “Security Health,” or a random variation of a trusted vendor. Suspicious signs include files launched from temporary folders, user profile subfolders with random names, hidden directories, or executable files lacking a valid publisher signature.

Right-click an entry and choose options such as “Jump to Entry,” “Jump to Image,” or “Search Online.” Compare the file path with the vendor’s normal installation directory. A genuine browser component may be located under Program Files, while an identically named executable running from AppData or Temp deserves closer inspection.

Use this quick comparison when deciding how to handle an entry:

Indicator	Usually Lower Risk	Requires Investigation	Safer First Action
Publisher	Verified, recognized vendor	Blank, misspelled, or unknown publisher	Check the signature and file origin
File location	Program Files or Windows directory	Temp, AppData, Downloads, or random folder	Scan the file before disabling
Command line	Normal application parameters	Encoded text, scripts, or unusual switches	Copy the command for analysis
Startup type	Familiar software update or utility	Random task, service, or logon value	Disable temporarily and document it
VirusTotal result	No detections with a trusted signature	Multiple consistent detections	Isolate and remove through security tools

Disable Suspicious Entries Safely

To stop an item from launching, clear the checkbox beside it rather than deleting the entry immediately. Autoruns will preserve the configuration while preventing the selected program, service, or task from starting. This reversible step makes it easier to identify which change resolves the symptoms.

Work in small groups, preferably one suspicious item at a time. After disabling an entry, restart Windows and check whether the unwanted pop-ups, browser redirects, unknown processes, or repeated security alerts return. If the issue disappears, keep the entry disabled while you investigate and remove the underlying file using trusted security software.

Do not disable core drivers, antivirus components, graphics utilities, storage services, or entries with unclear system dependencies merely because their names look unfamiliar. If Windows becomes unstable, boot into Safe Mode, open Autoruns again, and re-enable the most recent change. A restore point can also reverse broader system modifications.

Verify That Persistence Is Gone

A successful reboot is only an early check. Open Task Manager, review running processes, inspect browser extensions, and run a complete scan with an updated security product. Examine Autoruns again for newly recreated entries, because some malware restores its startup mechanism through a secondary task or service.

Check common persistence areas beyond the first suspicious item. A malicious scheduled task may recreate a registry value; a service may relaunch a deleted executable; and a browser extension may download the payload again. Removing only the visible startup entry may therefore leave the infection active.

Keep a copy of relevant filenames, hashes, paths, and detection results. This information can help security tools identify related components and may be useful when researching current malware behavior through Pc Malware Expert.

Reduce the Chance of Reinfection

Autoruns is most effective when paired with sensible Windows security practices. Keep the operating system, browsers, extensions, and security tools updated. Avoid pirated software, suspicious email attachments, unsolicited remote-access tools, and websites that pressure you to install “urgent” updates.

Use standard user privileges for everyday activity where possible, enable multifactor authentication, and maintain offline or versioned backups for important files. Backups are particularly valuable when a persistent infection develops into ransomware or damages documents before detection.

Apply these habits during future startup investigations:

• Save a restore point and document every change before disabling entries.
• Verify publishers, signatures, file paths, and command lines rather than trusting names.
• Scan suspicious files with reputable security software before opening or deleting them.
• Reboot and perform a second inspection to confirm that the entry was not recreated.
• Change sensitive passwords from a known-clean device after credential-stealing malware is suspected.

Autoruns can expose the mechanism that brings malware back, but lasting cleanup requires removing the associated payload and checking for secondary persistence. Download it from a trusted source, make reversible changes, and use layered scans and backups to protect the system while you work.