The Services tab is also worth checking because it is another startup method that the program can run even before the user is logged in to Windows. You can temporarily disable the item from starting up by unchecking the checkbox, edit, delete and even adding new startup entries. This will check the startup items with the latest data to provide a more accurate and up to date analysis. If you have an activate Internet connection, you can click on the refresh icon located at the top right that says “Refresh data online automatically” when your mouse cursor is hovering it. What we really liked about HiJackFree is it will try to automatically determine if the entries are safe or unsafe and labels them with color coding for easier identification. To check for startup entries, click on the Autoruns at the left sidebar where it lists the items being started up based on the different methods. HiJackFree is a free system analysis tool offered by Emsisoft, the maker of the popular Anti-Malware software for advanced users to detect malwares and remove them from the computer. Here are 6 free tools that you can use to analyze the startup items including the tricky locations that aren’t listed in msconfig. HijackThis used to be a popular tool to analyze a malware infected computer that includes startup entries on the scan result but unfortunately it’s been superseded by most other tools of the same type. The most basic method to check for startup items is by using the built-in System Configuration (msconfig.exe) tool in Windows but unfortunately the points being checked are not complete, can be easily disabled through a simple registry hack and MSConfig doesn’t tell you which entries are unsafe. One of the ways to discover an infection in Windows is by checking on the startup places for any suspicious entries.

In order to stay infected, other than being undetected, it has to automatically run when Windows is booted up. Malware is normally programmed to stay infected on the system as long as possible in order to steal more information from the computer through keylogging, to continue spreading and infecting other computers on the network, or to be a part of a botnet waiting for their master to command them to launch a DDoS attack.

Windows autorun program