Look deeper with Microsoft's free Sysinternals tools

Steps

1. 01

   Back up first, and decide to look rather than change

   • Back up your files before you open either tool
   • Run the ordinary Windows Security scans first — most people never need to go further than that

   !Careful: These tools show the inner workings of Windows and will let you switch off things it needs in order to start. Nothing in this fix asks you to delete anything.

   Also see: Back up properly (3-2-1 rule) · Think your PC has a virus? Scan it properly

2. 02

   Download them only from Microsoft

   • Type learn.microsoft.com/sysinternals into the address bar yourself, then open Downloads and find Autoruns and Process Explorer
   • Check each tool's page for the Windows versions it currently supports, then download it, right-click the zip file and choose Extract All — there is nothing to install

   ✓You should see: learn.microsoft.com in the address bar on the page you download from.

   Why?

   Other sites offer copies of these tools, and a copy from anywhere else may not be the real thing. Microsoft lists the Windows versions each tool currently supports on its download page, and the two tools do not always match.

3. 03

   Autoruns: see what starts with Windows

   • Right-click the 64-bit version (Autoruns64) and choose Run as administrator
   • Open the Options menu and turn on the option that hides Microsoft's own entries
   • Read what is left — the entries that run at sign-in, the scheduled tasks and the services first — looking at who published each one and where its file lives

   Why?

   With Microsoft's entries hidden, the list is short enough to read. An entry with no publisher, or one running from a temporary folder, is worth a closer look. It is not proof of anything.

4. 04

   Optional: ask VirusTotal about each file

   This step sends information from your PC to a service outside Microsoft, so read the warning before you switch it on

   • In Autoruns, open the scan options from the Options menu and turn on the VirusTotal check, leaving the option to submit files switched off
   • Agree to VirusTotal's terms of service when asked — Microsoft requires that before the feature works
   • Read the VirusTotal result beside each entry: one detection isn't proof; several is a reason to stop and get help

   !Careful: The check sends a fingerprint of each file (its hash) to VirusTotal, an outside service. With file submission switched on, it uploads the files themselves. Do not use it on a work PC without permission, and leave submission off.

5. 05

   Process Explorer: see what is running now

   • Right-click the Process Explorer program and choose Run as administrator
   • Read the list: it shows every running program and the account running it. Its Options menu has the VirusTotal check too, and the option that verifies signatures
   • Write down anything you cannot identify, and look the name up before deciding what it is

   !Careful: Do not end or 'kill' a process from here. Ending the wrong one can crash Windows and lose unsaved work, and it tells you nothing a note of the name would not.

6. 06

   Untick, don't delete — and know how to undo it

   • To stop one entry starting, untick its box in Autoruns — Microsoft's own instruction for disabling an entry
   • Write down each box you untick, then restart and use the PC normally
   • To undo it, open Autoruns as administrator again, tick the box, and restart
   • If Windows will not start normally afterwards, start in Safe Mode and tick the box again

   !Careful: Never use Delete in Autoruns. Delete removes the entry itself and there is no way to get it back. Leave ticked anything published by Microsoft, your antivirus, or your PC's or graphics card's maker.

   Also see: Start Windows in Safe Mode