How do I find the unknown program enabled during Start-Up?

I am using a computer with Windows 10 and, as a normal procedure to reduce the boot time, I accessed the Task Manager and checked what was "Enabled" during the "Start-up".

When I opened that tab, I saw a program called "Program", without Publisher information, which I have now disabled.

After that, I went straight to the Control Panel -> Programs and Features, in order to find out what the program is and to delete it; however, nothing with that name appears.

Given that, assuming that I don't know since when do I have that program on this computer, how can I know what this program is, so that I can decide on whether to remove it or not?

Gonçalo Peres 龚燿禄

Posted 2019-11-05T11:49:14.127

Reputation: 375

7Go to Microsoft Downloads, SysInternals and get Autoruns 64-bit. Download it, install it and run it and see if it shows you the program on your computer. Yellow highlighted sections in the Autoruns display are errors and can be deleted. – John – 2019-11-05T12:00:18.490

3You can also display more columns in Task Manager, by the way, including “Startup type” and “Command line”. Just right-click any column header. – Daniel B – 2019-11-05T12:20:37.933

1@Persistence Can you elaborate? Is it that it is easier to find this information on Arch, or is it that something like this would not occur on Arch? – Abdul – 2019-11-06T13:51:38.490

@Abdul think my comment got deleted... Fair enough tbh but unless you've installed some strange packages nothing will autorun unless you tell it to by enabling it as a service with systemd or adding it to a small handful of startup scripts. Nothing really happens by accident in Arch, you've basically got complete control – Persistence – 2019-11-06T15:01:29.287

Is there an entry for it in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp? – TylerH – 2019-11-08T16:26:36.317

Answers

You can go to Microsoft Downloads, SysInternals and get Autoruns 64-bit (download it here). Download it, install it and run it and see if it shows you the program on your computer.

For your specific problem, access the "Logon" Tab.

Yellow highlighted sections in the Autoruns display are errors and can be deleted.

That should solve your problem.

John

Posted 2019-11-05T11:49:14.127

Reputation: 5 395

You can rightclick on an entry and click Open file location wich leads you to the directory where the program is installed.

As mentioned in the comments by Ismael Miguel this answer only applies to Windows 8, Windows 8.1 and Windows 10 (and the Windows Server variants). For Windows 7 and older, you need to use msconfig.

kevinSpaceyIsKeyserSöze

Posted 2019-11-05T11:49:14.127

Reputation: 391

3This answer only applies to Windows 8, Windows 8.1 and Windows 10 (and the Windows Server variants). For Windows 7 and older, you need to use msconfig. – Ismael Miguel – 2019-11-06T18:21:01.837

1@IsmaelMiguel OP clearly specified he uses Windows 10 – Emanuel Vintilă – 2019-11-07T18:29:17.633

2@EmanuelVintilă That's true, but someone who searches for an answer to this question, on older devices, will find that it doesn't work for them. Besides, it is just a sentence that was added, and only increases the value of the answer, without making it invalid for what the O.P. asked. – Ismael Miguel – 2019-11-07T18:35:50.467

"This answer only applies to Windows 8, Windows 8.1 and Windows 10 (and the Windows Server variants)." Autoruns works just fine in Windows 7 and shows the Yellow entries to delete just fine – John – 2019-11-07T23:33:29.627

@John ye the thing with autorun imho is that you have to download a tool. – kevinSpaceyIsKeyserSöze – 2019-11-07T23:38:11.720

Of course you need to download Autoruns from Systinternals (Microsoft) but once downloaded and installed it works fine – John – 2019-11-07T23:39:36.560

Start-up entries are in the registry at Software\Microsoft\Windows\CurrentVersion\Run.

There is one of these for each user and machine. For the current session that would be
HKLM\Software\Microsoft\Windows\CurrentVersion\Run and
HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Any shortcuts in a Start Menu group called Startup will also be run. Again, there are both per-user and per-machine locations, which are
%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup and
%AppData%\Microsoft\Windows\Start Menu\Programs\Startup.

Additionally, a scheduled task can be set to run at boot or login. This data is also in the registry Microsoft\Windows NT\CurrentVersion\Schedule, but in a much more complex format. This can be explored with the "Task Scheduler" app.

OrangeDog

Posted 2019-11-05T11:49:14.127

Reputation: 679

1@DaveSmylie do you mean HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run? – OrangeDog – 2019-11-06T08:51:26.687

3Do all startup programs show up in that key? For instance, if you place a shortcut in the "Start-up" folder of the Start Menu, it still loads on startup, just as it did in Windows 95 (indeed, probably inherited from Windows 3's Program Manager?). I haven't checked on Windows 10, but for many versions that directory was scanned directly, separately from the various registry keys. – IMSoP – 2019-11-06T15:52:07.707

2@IMSoP yes, there's also the magic Start Menu folder in addition to the registry. – OrangeDog – 2019-11-06T15:53:15.143

7@IMSoP Actually there's a lot of ways to make something start with the system. For example you can schedule a task that executes on logon. Autoruns is great at finding these. – gronostaj – 2019-11-07T08:31:42.433

3@gronostaj Yeah, that was kind of my point. This answer implies that looking in one registry key is sufficient, but it's really not. – IMSoP – 2019-11-07T09:24:55.903

@IMSoP I think it is in this case. We have a screenshot from Task Manager, so it must be in the registry. – gronostaj – 2019-11-07T10:10:23.607

2@gronostaj I just checked Task Manager on my system, and the programs I load through the Start Menu folder show up there. I've no idea what other areas it includes, but it's certainly more than just that one set of registry entries. – IMSoP – 2019-11-07T10:13:58.667